Ensuring that Clients will only be getting IPs from authorized DHCP server

Forum|Forum|1 year ago
May 7, 2025
2 replies
776 views

Hi Team,

Wanted to work on protecting the network from DHCP snooping. FortiGate acts as DHCP server. The plan is to block DHCP request from malicious or unauthorized DHCP server. How can this be achieved?

Note that I do not have a FortiSwitch in place.

Will using a local in policy to block the traffic help?

Thank you in advance!

FortiGate

sw2090

SuperUser

Since DHCP is udp broadcasting that can only work within a subnet/Interface (except if you relay it) this is so called net-internal-traffic. That will not hit any policy. Your FGT will just receive the broadcasted DHCPDISCOVER and answers it with a DHCPOFFER.

I don't think there is any way to filter that.