Skip to main content
Shawn_Stevens
Shawn_Stevens
New Member
September 6, 2019
Solved

DHCP Relay Behavior

  • September 6, 2019
  • 1 reply
  • 2854 views

Hi Everyone,

 

Does anyone know how Fortinet behaves when the FW acts as DHCP relay? I am trying to design a scenario whereas the clients in the branch need to go through VPN tunnel to get to the DHCP server in our HQ. We have a route advertised from HQ branch via OSPF to the branch about how to get to the server, also the branch advertises the route back to HQ, after that the closest route match in the branch will be default route which will go to internet (Which obviously there is no server available, since our server is within private range in HQ) Our concern is what happens if a client requests a DHCP address when the tunnel is down for any reason? I understand that clients won't be able to get an address, but specifically what happens when the tunnel re-establishes? 

 

1. Does the FW maintains the connection from when the tunnel was down, then the clients will be matching the same connection which points to towards the default route, when the tunnel is back up? If yes then this will be an issue. In this case, is there any feature to tell the FW to monitor the server connectivity and don't create a connection if the server is not reachable? 

 

2. If my understanding is correct, is there any workaround?

 

Any help here is greatly appreciated!

 

SStevens 

 

 

    Best answer by OneOfUs

    DHCP relay on the Fortigate follows the rules of routing.  When the tunnel is down it would attempt to forward out the default route (as you suspected).  Once the tunnel is back up routing over the VPN would resume and any new DHCP requests would be sent across the tunnel.

    1 reply

    OneOfUs
    OneOfUsAnswer
    New Member
    September 9, 2019

    DHCP relay on the Fortigate follows the rules of routing.  When the tunnel is down it would attempt to forward out the default route (as you suspected).  Once the tunnel is back up routing over the VPN would resume and any new DHCP requests would be sent across the tunnel.

    Terms & ConditionsAccessibility statement