Palo alto interface DHCP

[tsepochechile]

I have configured DHCP on 4 interfaces, each DHCP on a different subnet. I connected each Palo alto port to a unique switch with the understanding that all devices connected to particular PA port will get ip addresses only from the corresponding DHCP but unfortunately the ip addresses are leased randomly. 

Scenario:

port 1: DHCP pool (192.168.1.10 - 192.168.1.50)

port 2: DHCP pool (192.168.2.10 - 192.168.2.50)

port 3: DHCP pool (192.168.3.10 - 192.168.3.50)

port 4: DHCP pool (192.168.4.10 - 192.168.4.50)

port 5: DHCP pool (192.168.5.10 - 192.168.5.50)

devices on switch that is connected to port 1 get ip addresses from port 5 DHCP.

[Raido_Rattameister]

Switches are layer 2 and no ip helper / dhcp forwarding configured in them?

If you connect endpoint directly to Palo port do you still get IP from wrong subnet?

[reaper]

- make sure your switches are not bridged anywhere / vlans are used properly if you have managed switches

- ensure you're only allowing intrazone dhcp and block interzone dhcp (if your firewall ports are layer2)

- if you set the DHCP mode to AUTO, the DHCP server will disable itself if it finds other DHCP server on the interface network. this may help tracking 'bridges' on the switches

- check your arp/mac table to see if endpoint mac addresses are showing up on multiple interfaces