DHCP RELAY issue after upgrading to MR-8

Question

Hi all, 
 just closed a ticket with Sophos Support. 
 There is a confirmed bug (NC-20755). After uprading to MR-8, DHCP relays do not work properly. 
 I have a configuration the several VLANS, and DHCP relay configured to serve dynamic IPs. 
 A temporarily workaround was to delete the DHCP relay, and configure a DHCP server instead. And it works. 
 Sophos Support connected to the firewall in SSH to fix the issue. The problem will be solved int V17 rev 1. 
 Beware that an upgrade to V17 will erase this fix, that theoretically has to be reapplied to V17 also (and it should work, but not sure at the moment). If not, a rollback from V17 to V16 need to erase totally the XG and restore configuration from a backup. Not so easy. 
 Best regards

MichaelBolton · Answer

Antonio, 
 Strange support told you that is was MR8 that caused it but I'm not supprised anymore. Sophos support is a joke. It broke in MR5, I opened a case, and was tracked as NC-19984. Our case is still open so we could track how long it takes Sophos to fix a core function. Opened June 19th. Support told me then it would not be fixed until V17 which I am worried to try. The workaround was to enable "Relay Through IPsec" which was found by another forum member, not even a Sophos engineer. We are on MR8 and have not made any changes to DHCP relay settings since the workaround we applied with MR5. 
 Original post. 
 https://community.sophos.com/products/xg-firewall/f/network-and-routing/93247/dhcp-relay-not-working-in-mr5 
 
 Mike

JacobAnderson · Answer

Thanks Antonio! 
 
 I found a work around for my lab environment, and thought I would share it. 
 
 Since all of my machines are are virtualized I just added a nic for each vlan on my dhcp box via esx. 
 
 So in my case the dhcp server has 3 more network interfaces and the settings look like the following: 
 IP Address: x.x.x.x 
 Subnet Mask: x.x.x.x 
 Default Gateway: this is left blank to ensure the primary nic is used for all traffic 
 
 Preferred DNS Server: this is left blank as well 
 
 That has me up and running again. I hope this solution will help someone else in need. 
 
 Cheers