Guest User!

You are not Sophos Staff.

Thread Info
  • State Suggested Answer
  • Locked Locked
  • Replies 7 replies
  • Answers 1 answer
  • Subscribers 4 subscribers
  • Views 11481 views
  • Users 0 members are here
Options
Suggested
This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

Issue: DHCP is not working for one client. Help!

Chris Sang

I'm having an issue with a new device obtaining a DHCP lease.  The client is a LiftMaster MyQ Internet Gateway device and a static IP can't be set.  I see the request hit the DHCP log but it just loops between discover and offer every 5 seconds (log below).  I've attempted to set a static definition but the behavior didn't change.  I don't see anything of interest in the firewall or IPS logs.  I've turned off IPS and country blocking to see if the behavior changed and it doesn't appear to be affected either.  Just to ensure the device wasn't faulty, I plugged the client directly into the modem bypassing the UTM completely and it obtained an IP from my ISP and the green online line lit up.  Any help in identifying the issue or a viable work around would be greatly appreciated.

 

DHCP Log:

2017:07:26-13:41:57 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:02 sophos dhcpd: DHCPDISCOVER from 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:02 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:07 sophos dhcpd: DHCPDISCOVER from 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:07 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:12 sophos dhcpd: DHCPDISCOVER from 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:12 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:17 sophos dhcpd: DHCPDISCOVER from 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:17 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:22 sophos dhcpd: DHCPDISCOVER from 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:22 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:27 sophos dhcpd: DHCPDISCOVER from 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:27 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:32 sophos dhcpd: DHCPDISCOVER from 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:32 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:37 sophos dhcpd: DHCPDISCOVER from 64:52:99:6b:50:b0 via eth0
2017:07:26-13:42:37 sophos dhcpd: DHCPOFFER on 192.168.1.128 to 64:52:99:6b:50:b0 via eth0



This thread was automatically locked due to age.
Parents
  • 0

    What do you learn from doing #1 in Rulz?  (My guess is UDP Anti-Flooding activity.)

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    I thought the same thing however, UDP flood protection is off on the Anti-DoS/Flooding tab.  Is there anything that might be squashing broadcast traffic even on the same network perhaps?

  • 0 in reply to Chris Sang

    Ya gotta do #1, Chris, just to eliminate those issues before looking elsewhere.

    Is the .128 IP assigned to any other device already?  Remember that DHCP in the UTM doesn't use reservations like Windows DHCP, you must make static assignments outside of the pool assigned dynamically.

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to BAlfson

    Bob,

    I've looked through Intrusion Prevention, Application Control, Firewall and Advanced Threat Protection and don't see anything relevant to this MAC address or IP.  I don't see any blocks because of floods and actually went through and disabled UDP/ICMP/TCP Flood protection without any change in behavior.  It appears something is blocking the DHCPRequest from the client but I can't for the life of me figure out where.

    -Chris

  • 0 in reply to Chris Sang

    Sounds like it's time to do a packet capture.   What do you see as root at the command line with the following?

    tcpdump -n -i eth0 ether host 64:52:99:6b:50:b0

    Cheers - Bob

     
    Sophos UTM Community Moderator
    Sophos Certified Architect - UTM
    Sophos Certified Engineer - XG
    Gold Solution Partner since 2005
    MediaSoft, Inc. USA
  • 0 in reply to Chris Sang

    I was just having problems with DHCP reservations for IPv6 today, until I turned off the PC, rebooted the UTM, then turned the computer back on, then it finally wanted to serve out the proper reservation.  If you haven't rebooted the UTM yet, give it a shot.  Also, any vlan in play? 

Reply
  • 0 in reply to Chris Sang

    I was just having problems with DHCP reservations for IPv6 today, until I turned off the PC, rebooted the UTM, then turned the computer back on, then it finally wanted to serve out the proper reservation.  If you haven't rebooted the UTM yet, give it a shot.  Also, any vlan in play? 

Children
  • 0 in reply to GoBlando

    Thanks everyone for their input and effort.  When I started the packet capture as suggested by Bob, I plugged the device in and it worked without issue!  So now I have a packet capture of it working (not helpful).  I have no idea what was causing the problem. If it acts up again, I will post my packet capture to this thread.  At this point its working.  Perhaps gremlins?

Unfiltered HTML