PXE Boot DHCP Option 66 + 67 - Client falsely using the Firewall IP-Address as TFTP Server

We are facing the same issue, but with Sophos UTM 9.714-4.
We have to deploy ip based deskphones and they use the tftp address to know where to look for the central management.
In UTM the DHCP option is called "tftp-server-name", but its the same Code 66.
If the client phones get a dhcp address from the firewall they recieve their ip address, netmask, gateway and dns correctly, but tftp stays empty.
I have tried it with windows dhcp server, but that one is sending out the ip address of the first set DNS server as TFTP instead of the set parameter.

Main difference to your case: I did not specify a boot file since that is automatically chosen depending on the ip deskphone type.

Update: I just rechecked the Sophos UTM. TFTP Server and Next Server are different setable options.
After also setting the "Next Server" flag to the wanted tftp address it worked. the clients recieved the correct address from the sophos utm dhcp.
Maybe you need to set the "Next Server" flag via CLI additionally? 

Maximilian Wild said:

Maybe you need to set the "Next Server" flag via CLI additionally? 

unfortunately that is not possible. The XG Setting is called Next Server on GUI but is uses 66 on the backend.

On CLI there is nothing to configure Next server, only Option 66.

And we have it also working on UTM. That is just a missing feature on XG if not a bug (Next Server on GUI).

asked  the support tech if that (orange text) is testworthy:

edit that file dhcpd.conf manually and reload dhcpd after like followed:

/cfs/system/dhcp/dhcpd.conf

shared-network reds28 {

        subnet 192.168.9.40 netmask 255.255.255.248 {

        }

        pool {

                 # DHCPCONFID=15;

                 range 192.168.9.42 192.168.9.44;

                 ping-check false;

                 server-identifier 192.168.9.41;

                 option subnet-mask 255.255.255.248;

                 option routers 192.168.9.41;

                 option domain-name-servers 192.168.9.41;

                 option bootfile-name "test.efi";

                 option tftp-server-name "192.168.9.45";

                 filename "test.efi";

                 next-server 192.168.9.45;

                 max-lease-time 172800;

                 default-lease-time 86400;

        }

}

Most likely this will at at least get overwritten, when someone changes a DHCP setting somewhere else on GUI. Don't want to test this unless I have OK from support for that.

Tech Support closed my support case now with status

This is to inform you that under this JIRA NC-117690, the issue is considered as feature request (...) please contact your Reseller or local Sales Engineer. 

The question about changing the config as asked above is still unanswered.

Thanks for all the digging, i had a support case of my own to get this resolved, same reply.

I can confirm that the Sophos DHCP doesnt send the "next server ip adress" entry, in comparison with our old Windows DHCP Server which does. How that is not a feature, i don't know.

The way i got my PXEboot working again is by letting the PXE Server send out its own DHCP offer (tried with WDS), so that the Client gets its IP from Sophos and PXE info from the WDS.

Hope this helps you as much as your digging helped me

cheers

Thorben Paulik said:

PXE Server send out its own DHCP offer

How does the communication between PXE client and PXE Server and server happen here? Is that all unicast?

So client gets PXE Server IP from Sophos and is then sending unicast to it and getting unicast offer back?

Do you require DHCP Server on the WDS Server for it?

Thorben Paulik said:

PXE Server send out its own DHCP offer

How does the communication between PXE client and PXE Server and server happen here? Is that all unicast?

So client gets PXE Server IP from Sophos and is then sending unicast to it and getting unicast offer back?

Do you require DHCP Server on the WDS Server for it?

You can set the WDS Server to "Answer all Clients" in the WDS Configuration tool.

This prompts the WDS Server to react to DHCP/PXE requests it receives with giving out its information, including the "next server ip address"

which then makes the client ask the WDS for a boot file based on its vendor class (i think, not 100% sure thats exactly what happens), and bam, PXE boot.

Be aware that DHCP requests get dropped when going through a router/firewall, so the WDS has to be in the same network as the client, or you'll have to work with a DHCP relay. Also, you'll have to disable options 66, 67 on the Sophos DHCP, so the client doesnt get conflicting information.

I don't know if other PXE Servers have this kind of option or how that works on other systems, but that is how it works for me, setting up laptops and PCs from a preconfigured image using WDS.

Thanks for this information.This may be suitable for mid-size remote locations. In our case we have some small remote sites, with a few clients only, no servers. Having a fast Internet line, it would have been no problem to let them PXE boot over WAN against a server located on the main site.

Now with the limitations of the Sophos Firewall DHCP Server, we would need to setup 3rd party DHCP server on site or do PXE relay to the main site DHCP server - but the downside is that when there is trouble with the VPN connection, they don't get any DHCP address at all.

Yeah, kinda sucks that Sophos doesn't support that feature yet, as it seems pretty basic.

I'll try to put in a feature request myself tomorrow, hopefully that will put a permanent solution on a higher priority.

our idea is now, that whenever we need to PXE boot a client at a small remote location to get it reinstalled, we disable the XG DHCP Server and start the DHCP Server Application tool of our choice (dhcpserver.de) on an other computer in the same network. Have it configured with the required ini options. And then do the network boot of the client that needs the reinstall. When boot is done, we stop the DHCP Server app and start XG DHCP Server again.

If anyone is going that way, this dhcpsrv.ini works for PXE boot with next server and bootfile + options 66,67

[SETTINGS]
IPPOOL_1=192.168.123.246-246 ; one IP in Range only
IPBIND_1=192.168.123.28 ; IP of computer where dhcpsrv runs
AssociateBindsToPools=1
Trace=1
DeleteOnRelease=0
ExpiredLeaseTimeout=3600

[EC-79-49-4E-DF-C4] ; a DHCP reservation for a single machine
IPADDR=192.168.123.246

[GENERAL]
LEASETIME=1800
NODETYPE=8
SUBNETMASK=255.255.255.0
BOOTFILE=\bblefi-x64\shim_x64.efi ; your custom PXE boot file
NEXTSERVER=192.168.234.1 ; your TFTP Server IP
DNS_0=192.168.123.1 ; some DNS Servers
DNS_1=192.168.234.2
ROUTER_0=192.168.123.1 ; probably your Sophos Firewall IP
OPTION_66="yourTftpServerName-or-IP.yourdomain.local" ; your TFTP Server FQDN or IP
OPTION_67="\bblefi-x64\shim_x64.efi"

By the way: 

NC-117690 DHCP "Next Server" and "Boot File" ignored PXE Boot DHCP Option 66 & 67

Is fixed in the upcoming V20.0 MR1. 

Hi,

In my case don't work on SFOS 20.0.0 GA-Build222