<div>
It would appear you have a WatchGaurd rule allowing DHCP &quot;through&quot; each firewall, so the PC is hitting the nearest (point in time) one, if the real near one is busy, the other has time to answer.
</div>


<div>
I don't beleive I have created a rule to allow dhcp to go through, however, maybe another rule I created might also be letting dhcp go through, I will revise the configurations. Thanks. 
</div>


<div>
When a workstation boots up it sends out a broadcast request across its network segment for a DHCP server. DHCP servers detect this and respond, beginning a negotiation with the workstation for an IP address lease. Since the request is only a broadcast, it is stopped by any router. The only way it can pass through the router is if you made an exception in the router - perhaps you added a DHCP helper - to allow it through to the other network segment.<br />
<br />
-tigermatt
</div>


<div>
The watchguard firewalls also act as the router, It sounds like a policy within the firewall is allowing the dhcp traffic to go through. 
</div>


<div>
<br />
That should be the only place where such a rule can be present, unless the configuration of the two network segments is more complex than described. Check both firewalls and see what you can find.<br />
<br />
-tigermatt
</div>


<div>
I don't see any policies tha would allow dhcp or port 67. &nbsp;Should I be checking other ports maybe? &nbsp;Also, the network is that simple. &nbsp;This issue just started happening since last friday. The two sites where actually set up in a weird way. &nbsp;There was a point to point connection that would extend the .1 network to the remote site. &nbsp;All the administration staff was on the .1 network while students where on the .70. &nbsp;The server has two nics one with an IP on each subnet. &nbsp;So I ended up putting everyone on the .70 network and disabled the .1 nic on the server. &nbsp;I joined the two networks by bridging the switches that connect each network. &nbsp;So now everyone is on the .70 network. &nbsp;These DHCP issue happened shortely after, we where not having these problems before. &nbsp;Hope this helps, please advise. 
</div>


<div>
What about other UDP ports? See any of them open?
</div>


<div>
The only one that i see is the outgoing policy that has udp any. &nbsp;Can I maybe create a policy that deny's dhcp packets? 
</div>


<div>
You could try, it's strange that it's forwarding them automatically though. Nothing about DHCP Relay mentioned anywhere?<br />
<br />
-tigermatt
</div>


<div>
I think due to ANY service which you might have created to allow the VPN traffic between the sites is responsible for allowing DHCP over the VPN tunnel. You can create a specific service to deny UDP 67/68 traffic and place it above ANY service; or you can configure your DHCP server to give IP addresses based on MAC or limit the scope of IP addresses leased.<br />
<br />
Thank you.
</div>


<div>
I think I will be creating a rule that deny's the traffic, I will let you know how it goes. Thanks. 
</div>


<div>
I blocked out going dchp traffic on both firewalls and it seems to be working, I just hope it does not deny dhcp traffic within the network though. Thanks for all your help, it everything is cool I will close this thread in a few days. 
</div>


<div>
Firebox cannot inspect or interfere with the traffic going over LAN; the traffic has to pass from one interface to another of the firebox for the firewall to take effect. It is with almost every firewall product in the market.<br />
If you have servers sitting on optional port getting DHCP IP from server on trusted; then we might want to look at the policy to make sure it is correct, we would like the policy to be configured as below:<br />
DHCP-deny-policy<br />
Allowed<br />
From: remote-subnet<br />
to: local-subnet<br />
<br />
Please do test so we know for sure that the problem is solved; please update the thread per your convenience.<br />
<br />
Thank you.
</div>


<div>
That's correct - DHCP broadcasts across local network segments which don't pass through a router CANNOT be blocked. Only when they pass through a router can they be blocked.<br />
<br />
I suspect the fact you had all UDP ports open outgoing was what was causing this. Blocking just DHCP is a good idea.<br />
<br />
If you need more information, please let us know; otherwise, I guess this question can be closed. :-)<br />
<br />
-tigermatt
</div>


<div>
I created the rule on both firewalls but it did not work, I will try the config posted above and update later. thanks. 
</div>


<div>
Oops my bad; for the DHCP-deny-policy I mentioned Allowed; it should have been &quot;Enabled and Denied&quot; instead; have you configured denied already.<br />
<br />
Please check and update.<br />
<br />
Thank you.
</div>


<div>
I created a dey dhcp rule on the firebox that is at the perimeter of the .1 network. It is configured as enabled and deny from Any to Any external, trusted bovpn and optional. &nbsp;Not sure if it wil work, let you know in a bit. 
</div>


<div>
<div class="content wysiwyg-content">
I have been noticing that some client pc's are pullling a dhcp address from the wrong subnet. &nbsp;The subnets are 192.168.70.0/24 and 192.168.1.0/24. &nbsp;For some reseaon client PC's on the .1 subnet are pulling down a .70 ip address. &nbsp;The two sites are connected via two watchguard firewalls. &nbsp;Each site has its own dhcp server. &nbsp;
</div>
</div>


I have been noticing that some client pc's are pullling a dhcp address from the wrong subnet.  The subnets are 192.168.70.0/24 and 192.168.1.0/24.  For some reseaon client PC's on the .1 subnet are pulling down a .70 ip address.  The two sites are connected via two watchguard firewalls.  Each site has its own dhcp server.  

Client PC's pulling DHCP addresses from the wrong subnet

Software firewalls, also known as host-based firewalls, provide a layer of software on one host that controls network traffic in and out of that single machine. Most operating systems now include firewall software, but many available software firewalls include central distribution, antivirus systems and disaster recovery.

Software Firewalls

Networking is the process of connecting computing devices, peripherals and terminals together through a system that uses wiring, cabling or radio waves that enable their users to communicate, share information and interact over distances. Often associated are issues regarding operating systems, hardware and equipment, cloud and virtual networking, protocols, architecture, storage and management.

Networking

The Dynamic Host Configuration Protocol (DHCP) is an auto configuration protocol used on IP networks and an extension of the Bootstrap Protocol. DHCP allows for computers to be configured automatically to communicate with each other over an IP network without the need for manual setup by a network administrator. The implementation of DHCP relies on a DHCP server to hand out network configuration information to DHCP-capable clients that request an IP address (and other information required or useful in communicating with other devices on an IP network). In addition to an IP address, common configuration information served over DHCP includes a default gateway, subnet mask and DNS sever(s).