Problem with TFTP proxy in a PXE scenario

[eegor]

Hi everybody
I checked about 90 entries about tftp on this board an couldn't find a solution so I risk to open a new entry.

What I have to provide for a customer:

• Windows Server Deployment
      - Client is in 172.17.0.0/24
      - Deployment Server is in 172.17.2.0/24.

How I try to solve this:

• DHCP Relay on interface of 172.17.0.0/24 forwarding to Deployment Server (172.17.2.21), Append circuit ID active (although that should have no influence in my situation)
• TFTP Proxy on interface of 172.17.0.0/24

What the problem is:

• The TFTP Proxy seems to respond only to a part of the requests. The deployment does not work. It stops after a few transmitted files.

Troubleshooting so far:
1. Checking deployment in general. For this check I moved the client to 172.17.2.0/24. It worked right away. Deployment seems to be OK.
2. Since a few files were transmitted, I assume DHCP and PXE to be OK. This has also been verified by a check with tcpdump.
2. Dumping the traffic on both sides and taking a closer look at the tftp transmissions. Here I find the following issue:

On the client side:
15:32:44.772640 IP 172.17.0.156.1025 > 172.17.2.21.69:  53 RRQ "smsboot\x64\pxeboot.n12" octet blksize 1432 tsize 0
15:32:45.078866 IP 172.17.0.156.1025 > 172.17.2.21.69:  53 RRQ "smsboot\x64\pxeboot.n12" octet blksize 1432 tsize 0
15:32:45.778912 IP 172.17.0.156.1025 > 172.17.2.21.69:  53 RRQ "smsboot\x64\pxeboot.n12" octet blksize 1432 tsize 0
15:32:46.414791 IP 172.17.2.21.55877 > 172.17.0.156.1025: UDP, length 27

These are three requests for the file pxeboot.n12. The last line is the answer where length of the file and transmission size are transmitted.

On the server side:
15:32:46.413284 IP 172.17.2.252.49937 > 172.17.2.21.69:  53 RRQ "smsboot\x64\pxeboot.n12" octet blksize 1432 tsize 0
15:32:46.414733 IP 172.17.2.21.55877 > 172.17.2.252.49937: UDP, length 27
15:32:48.432937 IP 172.17.2.252.59580 > 172.17.2.21.69:  53 RRQ "smsboot\x64\pxeboot.n12" octet blksize 1432 tsize 0
15:32:50.446170 IP 172.17.2.252.63749 > 172.17.2.21.69:  53 RRQ "smsboot\x64\pxeboot.n12" octet blksize 1432 tsize 0

Why is this an issue:
The dump for both interfaces is from the same pfsense box, so the time values are accurate. Here, a request seems to spend about 2 to 4 seconds inside the firewall until it's transmitted. That behaver gets worse over time. Next in my dump are 5 requests with about 8 seconds, then 14 requests with up to 16 seconds and so on. The whole transmissions stalls after four successfully but delayed file transactions. That's where the client aborts, with about 5 open file requests.
If I do not deploy over the firewall, every request is answered right away, no second request is necessary.

Why should this be a TFTP Proxy problem:
The firewall log is listing several blocks during these transactions. Here is a screenshot (not aligned with the tcpdump). 172.17.2.252 is the firewalls interface on the server side. It seems like the deployment server tries to communicate to some parts directly with the client and but then as well via the firewalls interface (172.17.2.252). I'm not sure how the TFTP Proxy actually works but this behaver seems a bit strange to me.

Version: 2.1.2 (amd64)
I have more log and dump material, but I don't want to flood this post. So feel free to ask if you need more detail. 
Thank you for your time and help

I opened a ticket in professional Support now. I will post the solution here if there is any