The DHCP tab lets the firewall address the devices on its network automatically, so a workload that asks for an address gets one, along with the firewall as its gateway and DNS.
DHCP runs on the primary network
A firewall serves DHCP on its first (primary) network only. Other attached networks still get firewall, NAT and routing, but not DHCP from the firewall.
Turn it on
Switch on Run DHCP on this network and set:
| Field | What it means |
|---|---|
| Pool start | The first address the firewall hands out |
| Pool end | The last address it hands out |
| DNS servers | One or more addresses, separated by spaces or commas. Blank uses a public default |
| Lease (seconds) | How long an address is held before it is renewed. Default 3600, minimum 60 |
Then select Save DHCP.
The pool must sit inside the network's address range, the end cannot come before the start, and the pool must not include the firewall's own address, because that is the gateway it hands out. The firewall's address on the network is also the default DNS it serves.
Reserve a fixed address
To pin a device to the same address every time, add a reservation under Reserve an address:
- MAC, in the form
bc:24:11:00:00:01(lowercase hex), - Address, inside the network's range, and
- Hostname, optional.
Turn DHCP on and save it first; reservations attach to a running scope. Each MAC and each reserved address is used once per network.
See who has a lease
When the firewall is online, the DHCP tab shows the active leases it is holding: the address, the device's MAC, its hostname, and how long until the lease expires. This is read live from the firewall each time you open the tab.