Technical Tip: WAN interface is not getting IP address from a router using DHCP

Description

This article describes one specific issue in which the FortiGate does not get the IP address from the DHCP Server managed by a Router.

Scope

FortiOS, 3rd party vendor.

Solution

Some Routers provide a way to deliver the public IP address directly to the FortiGate by a bridge interface on the router, but some of them have issues with the DHCP service, which does not answer the clients if the BOOTP flag is defined as broadcast in the Discovery packet.

As the Router does not process it, the Offer packet is not sent, and the IP address assignment process stops, because the FortiGate does not have any reply from any DHCP Server.

To identify it, execute a packet capture from the WAN interface, looking for the bootp flag as highlighted in the image below:

Also check if there is no Offer packet from the DHCP Server.

To fix it, change the option 'dhcp-broadcast-flag' under the WAN interface on the client device (FortiGate) to disable:

config system interface
    edit "wan"
         set dhcp-broadcast-flag disable
     next
end

After this change, the Discovery packet should be like:

Points to consider if it does not work:

1. Even after the change, if there is no Offer from the DHCP server on the packet capture, it will be necessary to check the DHCP Server instead of FortiGate

2. If the Offer packet was sent to the FortiGate, get the pcap along with backup and TAC report, and open a case with TAC Support to investigate the case.