Troubleshooting Tip: Wireless clients do not receive IP through DHCP from Bridged SSID

Description

This article describes how to troubleshoot if the clients are not getting IP addresses from bridged SSIDs. 

Scope

FortiGate, all firmware.

Solution

Check if DHCP is enabled on the VLAN interface that is configured as the bridge SSID.

If yes, run the following sniffer command:

diagnose sniffer packet <interfacename> 'port 67 or port 68' 4 0 l 

In the above screenshot, 'Test1' is the VLAN interface name.

If there is no traffic seen, that means FortiGate is not receiving any discovery packet from the client.

If there is any switch in between, and the DHCP offer packet is not reaching the client, then check if DHCP snooping is enabled on the switch.

config switch vlan
    edit <vlan-id>
        set dhcp-snooping enable

If the switch is a FortiSwitch, try to add the FortiGate interface as the trusted interface.

config switch-controller managed-switch 
     edit <FortiSwitch_serial_number> 
       config ports 
           edit <port_name> 
               set dhcp-snooping trusted            
                       next
       end 
     next
  end 

set dhcp-snooping trusted: Options are 'trusted | untrusted'.

Other possible reasons:

1. For a Bridge mode SSID to work, the VLAN interface must be added to the Allowed VLANs of the switch port, where the FortiAP is connected. Otherwise, the Workstations will not get the DHCP IP, and the traffic will be dropped at the Switch Port.
   
   

2. If the AP is connected on a VLAN, do not specify the same VLAN in the bridged SSID (optional VLAN) to be broadcast by the AP. Traffic on that bridged SSID will already be tagged on the same VLAN as the AP. There is no need to add additional tagging. 
   
   

   

   
   

3. Another DHCP Server offering DHCP appears on the network while DHCP snooping is enabled on the interface or VLAN.
   To resolve the issue, navigate to Network -> Interfaces, edit the desired interface, and disable DHCP snooping. Alternatively, find and disable the rogue DHCP server that is causing the conflict.
   
   

   

Related article:

Technical Tip: How to bridge a FortiGate WiFi network to a wired network or VLAN network