>
    Strata Copilot
    Configure an Interface as a DHCP Relay Agent
    Focus
    Download PDF
    Focus
    1. Home
    2. Next-Generation Firewall
    3. DHCP
    4. Configure an Interface as a DHCP Relay Agent
    Download PDF
    Next-Generation Firewall

    Configure an Interface as a DHCP Relay Agent

    Table of Contents

    Configure an Interface as a DHCP Relay Agent

    Configure an interface as a DHCP Relay Agent to transmit DHCP messages between clients and servers.
    To enable a firewall interface to transmit DHCP messages between clients and servers, you must configure the firewall as a DHCP relay agent. The interface can forward messages to a maximum of eight external IPv4 DHCP servers and eight external IPv6 DHCP servers. A client DHCPDISCOVER message is sent to all configured servers, and the DHCPOFFER message of the first server that responds is relayed back to the requesting client.
    Capacities are as follows:
    • You can configure a combined total of 500 DHCP servers (IPv4) and DHCP relay agents (IPv4 and IPv6) on all firewall models except for PA-5200 Series and PA-7000 Series firewalls
    • On PA-5220 firewalls, you can configure a maximum of 500 DHCP servers and a maximum of 2,048 DHCP relay agents minus the number of DHCP servers configured. For example, if you configure 500 DHCP servers, you can configure 1,548 DHCP relay agents.
    • On PA-5250, PA-5260, and PA-7000 Series firewalls, you can configure a maximum of 500 DHCP servers, and a maximum of 4,096 DHCP relay agents minus the number of DHCP servers configured. For example, if you configure 500 DHCP servers, you can configure 3,596 DHCP relay agents.
    Before configuring a DHCP relay agent, make sure you have configured a Layer 3 Ethernet or Layer 3 VLAN interface, and the interface is assigned to a virtual router and a zone.
    (PAN-OS 12.2.2 or a later release) When you configure DHCP Relay Overwrite on the relay interface, the firewall modifies the subnet mask and default gateway in DHCP Offer and Acknowledge messages before forwarding them to clients. This directs clients to route all traffic through the firewall, enabling security policy enforcement on the traffic without changes to the DHCP server or client devices.

    PAN-OS

    Configure an interface as a DHCP Relay Agent to transmit DHCP messages between clients and servers.
    1. Select DHCP Relay.
      Select NetworkDHCPDHCP Relay.
    2. Specify the IP address of each DHCP server with which the DHCP relay agent will communicate.
      1. In the Interface field, select the interface you want to be the DHCP relay agent.
      2. Select either IPv4 or IPv6, indicating the type of DHCP server address you will specify.
      3. If you checked IPv4, in the DHCP Server IP Address field, Add the address of the DHCP server to and from which you will relay DHCP messages.
      4. If you checked IPv6, in the DHCP Server IPv6 Address field, Add the address of the DHCP server to and from which you will relay DHCP messages. If you specify a multicast address, also specify an outgoing Interface.
      5. (Optional) Repeat the prior three steps to enter a maximum of eight DHCP server addresses per IP address family.
    3. (Optional) (PAN-OS 12.2.2 and later versions) Configure DHCP Relay Overwrite to modify the subnet mask and default gateway delivered to DHCP clients.
      Enable Overwrite.
      • For Gateway, enter the IP address of the firewall interface to deliver to clients as their default gateway.
      • For Subnet Mask, enter the subnet mask to deliver to clients. For intra-VLAN microsegmentation, enter 255.255.255.255.
    4. Commit the configuration.
      Click OK and Commit.

    Strata Cloud Manager

    On Strata Cloud Manager, configure an interface as a DHCP Relay Agent.
    On Strata Cloud Manager, configure an interface as a DHCP Relay Agent. You can configure a maximum of eight DHCP server addresses per IP address family.
    1. Log in to Strata Cloud Manager.
    2. Configure the interface that will act as a DHCP relay agent.
      1. Configure a Layer 3 interface or Layer 3 VLAN interface.
      2. Assign the Layer 3 interface to a logical router.
      3. Assign the Layer 3 interface to a zone.
    3. Select ConfigurationNGFW and Prisma AccessDeviceDHCPDHCP Server Relay and select the Configuration Scope where you want to create the DHCP server relay agent.
      Select a firewall from your Folders or select Snippets to configure the DHCP server relay agent in a snippet.
    4. Select an Interface Name.
    5. To add a DHCP relay agent, Enable IPv4 and select the plus sign (+) to enter the IPv4 address of the DHCP server to and from which you will relay DHCP messages.
    6. (Optional) (IPv4 is enabled) (PAN-OS 12.2.2 and later versions) Configure DHCP Relay Overwrite to modify the subnet mask and default gateway delivered to DHCP clients.
      DHCP Relay Overwrite supports IPv4 only.
      Enable Overwrite Server Options.
      • For Subnet Mask, enter the subnet mask to deliver to clients. For intra-VLAN microsegmentation, enter 255.255.255.255.
      • For Gateway, enter the IP address of the firewall interface to deliver to clients as their default gateway.
    7. To add a DHCPv6 relay agent, Enable IPv6 and select the plus sign (+) to enter the IPv6 address of the DHCP server to and from which you will relay DHCP messages. If you specify a multicast address, also specify an outgoing Interface.
    8. Save the configuration.
    9. Push Config to push your configuration changes.

    © 2026 Palo Alto Networks, Inc. All rights reserved.