Skip to main content
ITadm
ITadm
New Member
February 27, 2019
Solved

DHCP reservation

  • February 27, 2019
  • 1 reply
  • 111651 views

Hello, 

 I've got a Fortigate 30E Firewall and I need to create some reservations on one of my VLANS. The idea is to use DHCP reservations as a sort of ACL so only hosts with known MAC addresses can get access to this VLAN.

 

Previously I was using watchguard and I could set DHCP range to for exapmle: 192.168.1.200 - 192.168.1.200 and make reservations up to 192.168.1.254.

In FortiOS I can't do it this way and the IP range of DHCP has to be exactly the same as number of reserved addresses, it creates some issues, because in my network it looks like this:

 

192.168.1.129/25

 

192.168.1.130-140 - warehouse workstations

192.168.1.141-150 - warehouse printers

192.168.1.151-160 - office workstations

192.168.1.161-170 - office printers 

and so on

 

So, when I was adding for example an office workstation I could make a reservation for address 192.168.1.155 and I didn't have to block unused addresses. Now I can't split it nicely, but I have to make a stack of addresses with all connected devices like 192.168.130-160 and when I add an office printer I need to extend DHCP range to 192.168.161 and it's a little bit too messy for me. 

 

I hope I didn't overcomplicate it and you get my point. My question is: do you have any ideas how I can keep the IP addressing structure of my network without leaving empty addresses in DHCP?

    Best answer by ede_pfau

    hi,

     

    all addresses, assigned and reserved, need to be contained within the DHCP range.

    I suggest the following:

    - in Network>Interface>(internal)>DHCP>Advanced, you've got a table called 'MAC Reservation + Access Control'. The last line is for all DHCP requests which are not listed as reserved. By default, these are assigned an IP address. You can toggle that to 'block' requests from unknown MAC addresses. Double click the line to edit.

    1 reply

    ede_pfau
    SuperUser
    ede_pfauAnswer
    SuperUser
    February 27, 2019

    hi,

     

    all addresses, assigned and reserved, need to be contained within the DHCP range.

    I suggest the following:

    - in Network>Interface>(internal)>DHCP>Advanced, you've got a table called 'MAC Reservation + Access Control'. The last line is for all DHCP requests which are not listed as reserved. By default, these are assigned an IP address. You can toggle that to 'block' requests from unknown MAC addresses. Double click the line to edit.

      ITadm
      ITadmAuthor
      New Member
      February 27, 2019

      Thanks, I didn't spot this option :) ! How about static IP addresses? It should block only DHCP requests and static should work fine, right?

      ede_pfau
      SuperUser
      ede_pfau
      SuperUser
      February 28, 2019

      Correct, this does only relate to DHCP dynamic assignment. If you use static addresses as well it's up to you to avoid address conflicts. DHCP will test if an address is already active on the network and will not offer it a second time. If that was (by incident) a reserved address you'd be out of luck.

        Terms & ConditionsAccessibility statement