Skip to main content
Ylli_Seitaj
Staff
Staff
September 22, 2025

Troubleshooting Tip: Hostname is missing for devices connected via IPsec VPN

  • September 22, 2025
  • 0 replies
  • 935 views
Description This article describes an issue related to the hostname, which is missing on the logs of the DHCP server, when users connect via IPsec VPN using IKEv2 and SAML, and FortiGate is configured as a DHCP relay.
Scope FortiGate.
Solution

The devices are connected as follows:

 

Client (FortiClient) --- (connected via IPsec VPN to FortiGate) --- FortiGate (DHCP relay) - DHCP server.

 

The FortiGate configuration used for this issue is:

 

config vpn ipsec phase2-interface
    edit "toclient"
       set dhcp-ipsec enable
       next
    end

config sys interface
    edit "toclient"
       set dhcp-relay-service enable
       set dhcp-relay-type ipsec
       set dhcp-relay-ip x.x.x.x <<<<External dhcp server
    end

config system settings
    set dhcp-proxy enable
    set dhcp-server-ip "x.x.x.x"
    set dhcp6-server-ip <ipv6>
    set gui-sslvpn enable
    set gui-advanced-policy enable
end

 

When the clients connect trough IPsec VPN using IKEv2 and SAML, the connection is successful. However, the hostname is not shown on the DHCP server logs as shown in the image below.  

 

Screenshot_1.png

 

The hostname is sent using Option 12, as defined in RFC 2132 (screenshot below is taken from) RFC 2132: https://www.ietf.org/rfc/rfc2132.txt.

 

Screenshot_2.png

 

This behavior is noticed in environments with IPsec VPN using IKEv2 and SAML. This is currently not supported on FortiOS, and it is addressed to the engineering team through NFR: 1217216.

    Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
    Virtual event | September 2026. SASE summit. The age of autonomous trust. Register here!