This discussion has been locked.
You can no longer post new replies to this discussion. If you have a question you can start a new discussion

IP keeps changing on interface

Hey, guys. I have a weird issue going on at the moment. I have a Sophos UTM (its just a dell box with extra nic cards) set up with my normal LAN then a guest WAP(its just a netgear router with DHCP turned off and not even plugged into the WAN port on it). For what ever reason, my guest interface IP keeps changing. I've noticed it happens when my router is restarted, but have not seen it restart lately. System logs show a whole lot of "2016:11:01-00:01:00 jonespwns dhclient: DHCPREQUEST on eth0 to 192.168.133.1 port 67" when this happens. I'm not entirely sure why DHCP is trying to do anything to it as I have the guest interface statically assigned. Any help is appreciated. My girlfriend is gonna beat me if the wifi keeps dropping. thanks in advance!



This thread was automatically locked due to age.
Parents
  • Hey,

    It looks like you've disabled the DHCP server on the wifi router, but the router itself needs also an IP address to be manageable. I think this is the reason for the DHCPREQUEST pakets. Or it could be also a wifi client, which reconnects after the router restarted and ask for a DHCP address. But it's not normal that the IP address of the UTM interface changes its address.

    - Is 192.168.133.1 the normal address of the Guest interface?
    - What IP get's the UTM when the IP has changed?- Have you enabled DHCP on the Guest LAN?

    Jas

  • WAP is 192.168.133.254 and the INT is 192.168.133.1. When the IP changes on the INT it is like 192.168.133.22. And yes, I have DHCP enabled on my guest network (but not on my WAP). I wouldn't think it would change a statically assigned IP on the INT, though. It hasn't done that on my normal LAN.

  • Interesting problem.... :)

    When this happens, can you see the DHCP address like the 192.168.133.22 under the leases of the DHCP scope? That will mean that the UTM is assigning an IP address to itself.
    Is the router directly connected to the Guest interface of the UTM, or is there a switch between them?
    Where do you see the new DHCP address? In the static IP settings of the interface in the Web GUI?

    Could you post the interface table? You will find it under "Support" -> "Advanced" -> "Interface Table".

  • Honestly, I didn't think to check and see if it shows up there. It hasn't done this for a day or so now, so i'm more or less just waiting for it to happen again. Also, the router is connected straight into the UTM. It would show the IP address in the interface setting for Eth0 (guest network) in the web GUI, so I would always go back into there and just fix the IP. Here is the table

    1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default 
        link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
        inet 127.0.0.1/8 scope host lo
           valid_lft forever preferred_lft forever
        inet6 ::1/128 scope host 
           valid_lft forever preferred_lft forever
    2: eth1: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
        link/ether 00:1a:a0:c2:cd:c7 brd ff:ff:ff:ff:ff:ff
        inet 192.168.1.1/24 brd 192.168.1.255 scope global eth1
           valid_lft forever preferred_lft forever
    3: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc hfsc state UNKNOWN group default qlen 1000
        link/ether 00:25:86:e3:b1:19 brd ff:ff:ff:ff:ff:ff
        inet 192.168.133.1/24 brd 192.168.133.255 scope global eth0
           valid_lft forever preferred_lft forever
    4: eth2: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
        link/ether 00:00:ba:20:06:45 brd ff:ff:ff:ff:ff:ff
        inet 50.171.63.161/23 brd 50.171.63.255 scope global eth2
           valid_lft forever preferred_lft forever
    5: ifb0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc tbf state UNKNOWN group default qlen 32
        link/ether be:9a:0c:69:1c:7c brd ff:ff:ff:ff:ff:ff
  • That means when the router reboots the IF of the UTM goes down and up again. This could cause a DHCP request. But normaly not when you've configured a static address for that IF.

    What is No. 5? Is this a bridged interface? Looks like it has something to do with your Guest IF ETH0 because it's also down at the moment.

    5: ifb0: <BROADCAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc tbf state UNKNOWN group default qlen 32
        link/ether be:9a:0c:69:1c:7c brd ff:ff:ff:ff:ff:ff

     

    Could this be the reason for the behaviour?
    If you check the interface page in your Web GUI, do you see any "Bridged Interface" or "... Network"? If yes, do you know for what this is?

     

  • I don't have anything in my webgui that references that. I only have my Guest Int, LAN, WAN, and a disabled VLAN3. So I don't even know what that is.

  • I've asked StartPage what IFBx is. It has to do with QoS / Download Throtteling. I think you have limited the bandwith for your Guest LAN or something like that. It should be not the cause of the problem.

    At the moment I've no more ideas what this behaviour can cause.

    Do you configured any special DHCP options? Have you tried to delete and re-add the DHCP range and the interface? Maybe this helps...

    If it happends again, please check if the UTM assings the address by itself.

Reply
  • I've asked StartPage what IFBx is. It has to do with QoS / Download Throtteling. I think you have limited the bandwith for your Guest LAN or something like that. It should be not the cause of the problem.

    At the moment I've no more ideas what this behaviour can cause.

    Do you configured any special DHCP options? Have you tried to delete and re-add the DHCP range and the interface? Maybe this helps...

    If it happends again, please check if the UTM assings the address by itself.

Children
  • Yeah. I do have some QoS on it. So that would make sense. I did delete and readd the DHCP interface last night. I think I had even done that a month or so ago, but I could be wrong. I'll also note to look at the list to see if it is the DHCP handing out the IP. Thanks for the help!