Knowledge Search


[ScreenOS] The firewall not responding to the DHCP request that is sent by a DHCP Relay Agent

  [KB19962] Show Article Properties

If the ScreenOS firewall Interface is configured as a DHCP Server, the request may come from a client via DHCP Discover or as a unicast from a Relay Agent. However, the firewall responds only to the Discover messages.

The ScreenOS firewall interface can be configured as a DHCP server so that clients can simply connect and access network resources. Now DHCP requests are of 2 types:

  • Directly from a client using DHCP Discover, which is an broadcast on UDP port 67.

  • From an DHCP Relay Agent as an unicast on UDP port 67.

The ScreenOS firewall works correctly in scenario 1; but will not work in scenario 2. The following message is reported in the output of debug flow basic:

ipid = 8475(211b), @2d57f910

packet passed sanity check.
no session found
flow_first_sanity_check: in <ethernet0/2>, out <N/A>
self check, not for us
chose interface ethernet0/2 as incoming nat if.

packet dropped: for self but not interested



This configuration is not supported in ScreenOS. For more information, refer to KB3390 - [ScreenOS] Can a NetScreen firewall be used as a DHCP server in a DHCP relay environment

The ScreenOS firewall responds to only broadcasted DHCP Discover messages. It does not address unicast DHCP request packets (mostly from Relay Agents). The DHCP functionality is just an add-on that is provided on the firewall. It cannot act as an full fledge DHCP server. This is by design.

Related Links: