> Source: [sk1000015](https://support.checkpoint.com/results/sk/sk1000015)

# sk1000015 - Standby ClusterXL member responds to DHCP requests in High Availability cluster

| Property | Value |
|----------|-------|
| Solution ID | sk1000015 |
| Date Created | 2026-08-21 |
| Last Modified | 2026-10-13 |
| Technical Level | General |
| Products | Security Gateway |
| Versions | R82.10 |
| OS | Gaia |

## Symptoms

- In a ClusterXL High Availability (HA) environment that uses the Dynamic Host Configuration Protocol (DHCP) Server feature:

* The standby cluster member processes DHCP broadcast traffic.
* The standby cluster member responds to DHCP client requests while it is in the STANDBY state.
* Both cluster members send DHCP responses, such as `DHCPOFFER` and `DHCPACK`.
* DHCP lease conflicts occur because clients receive DHCP replies from more than one cluster member.
* DHCP leases can reference both member IP addresses and the cluster IP address.
* Logs show different DHCP offers from different cluster members for the same client.  

  Example:
  * `Active member offered DHCP address: 192.168.1.100`
  * `Standby member offered DHCP address: 192.168.1.110`
* Packet captures on the standby member show DHCP responses sourced from the standby member's Media Access Control (MAC) address.
* The issue is not observed in an earlier environment, where the standby member do not exhibit DHCP daemon activity or send DHCP responses under the same conditions.

## Cause

A behavioral regression in the affected software release causes the standby ClusterXL member to process and respond to DHCP client requests instead of suppressing DHCP server responses while in the STANDBY state.

As a result, both cluster members may participate in DHCP address assignment, potentially causing conflicting DHCP leases for clients that receive responses from both members.

## Solution

Contact [Check Point Support](https://www.checkpoint.com/support-services/contact-support/) to get a Hotfix for this issue.

A Support Engineer will make sure that the Hotfix is compatible with your environment before providing it.  
For faster resolution and verification, collect these files:

1. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Management Server involved in the case.
2. [CPinfo](https://support.checkpoint.com/results/sk/sk92739) file from the Check Point Firewall, each Cluster Member, or the Security Group involved in the case.

For Hotfix installation instructions, refer to [sk168597 - How to install a Hotfix](https://support.checkpoint.com/results/sk/sk168597).

<br />

---

# Agent Instructions

This content is from the Check Point Support Center (https://support.checkpoint.com), the official knowledge base for Check Point cybersecurity products.

## Navigating This Knowledge Base

- **Complete index**: [llms.txt](https://support.checkpoint.com/llms.txt)
- **All SK articles**: [SecureKnowledge Sitemap](https://support.checkpoint.com/sitemaps/secureknowledge-sitemap-index.xml)
- **SK article URL pattern**: `https://support.checkpoint.com/results/sk/{skId}`
- **Markdown responses**: AI bot User-Agents automatically receive `text/markdown` content