- The device has firmware version 6.1.X or below
- The device is in an NSRP cluster
Trying to associate a DHCP server with an sub-interface in the above case will permit only the option to have a “DHCP Relay Agent”.
Knowledge base: KB14185 confirms this. However, on a NS-Series security device with version 5.4 r10 or above (did not test anything lower) I did not encounter this problem.