Skip to main content
Highlander50
Highlander50
New Member
January 31, 2022
Question

DHCP issue

  • January 31, 2022
  • 3 replies
  • 2835 views

I have a dhcp problem on several of my client sites (spoke). my client has 44 remotes sites, all connected in VPN on the central site (2 VPNs, fiber and Lte links).
For unknown reasons, DHCP requests do not work and users disconnect from the network after the DHCP lease expires. the problem starts working again when I do this:

diag sys session filter dst 10.x.x.x
diag sys session clear

 

the Problem do not happen on all the site at the same time, and any changed has made on the configuration, and the problem happen randomly

 

Is  someone can help me with please

3 replies

bnEnsignenergy
bnEnsignenergy
New Member
February 1, 2022

I have spoke sites experiencing the same issue.

 

FG-81E's connected back to the hub (VM01, 601E, 501E) via IPsec interface tunnels, OSPF routing.  Issue appeared after upgrading to 6.4, not all sites affected.  Same work around, cleared sessions with the destination of the DHCP server on the other end of the tunnel.

Sniffing for UDP 67+68 traffic on the spoke shows that the FG is sending DHCP traffic out the physical interface that the IPsec tunnel is attached to, not within the tunnel.  All other traffic from the spoke LAN to the hub LAN (same subnet that the DHCP server resides on), exits the spoke through the tunnel and not the physical interface.

 

Currently running 6.4.7 on the hubs and 6.4.7/6.4.8 on the spokes

Highlander50
Highlander50Author
New Member
February 2, 2022

Hello @bnEnsignenergy 

did you fix you problem ? if yes how ? 

do you have any tshoot step or idea ?

bnEnsignenergy
bnEnsignenergy
New Member
February 2, 2022

No I haven't identified the root cause or opened a ticket with support, but it's on the list of things to do.

The current work around that I'm using is to clear the stuck session that's sending traffic out the physical interface instead of the tunnel interface.  I'm only noticing this issue on spoke sites connected via a static VPN tunnels, I have a dial-up VPN tunnel from my home office to hub/HQ (w/ OSPF) and have never had an issue receiving DHCP from the hub.

Terms & ConditionsAccessibility statement
Thought Leadership Security Summit. Outpace New Threats with AI - enhanced defense. Tuesday, Septmeber 15, 8:30 AM - 2:30 PM PT. The Golf Club at Newcastle, WA.
Fortinet Flag the Hack. Wednesday, August 26, 9:00 AM - 5:00 PM ET, COSM, Atlanta, GA.