Skip to main content
Dooks
New Member
June 5, 2020
Question

Help with DHCP on VLAN Interfaces

  • June 5, 2020
  • 3 replies
  • 7500 views

Hi all. I am relatively new to fortinet and would appreciate any assistance on the following matter.

Ive created an SSID "RadiusWifi"  which authenticates users via a RADIUS server. This SSID is also set up to dynamically assign the connected user to their designated VLAN as configured on the RADIUS Server using WPA2 Enterprise. I acheived this by creating all of the VLANS with 'Manual' IP addressing and configured a DHCP Server on each . I  assigned each of the created VLANS to the "RadiusWifi" interface. Users are currently able to connect and be correctly assigned to their designated VLANs. 

My problem is... I would like it to be set up so that each of the authenticated users  get IPs from an external DHCP server when they connect rather than using the ips provided by the fortigate VLAN interface's DHCP.

The users typically connect to the network via a wired connection which recieves ips from the external DHCP . My intention is for the "RadiusWifi" SSID to be an extension of the users wired connection. As a result, they would be assigned ips from the same subnet they typically connect to on a wired connection.

Can this be done?

Am i approaching the issue in the wrong way? are there alternative methods for dynamically  assigning these users their designated subnet? (example: A possible RADIUS Server Configuration)

Any assitance will be greatly appreciated.

Cheers.

 

    3 replies

    sw2090
    SuperUser
    SuperUser
    June 5, 2020

    the easiest way might be to set the dhcp service on the vlan interface to be a dhcp forward to the external dhcp.

    I am doing this on our Fortigates here for some wlan that has to get dhcp from an internal server behind the fgt.

     

    lobstercreed
    New Member
    June 5, 2020

    Exactly what Sebastian said.  The option is under "Advanced" in the GUI.  Select "Relay" as the mode and then specify one or more DHCP server addresses.  (If you need more than one, i.e. for redundancy, just put a space between the multiple IPs.)

     

    In CLI it is under config system interface, then under edit <interface name> you would put:

    set dhcp-relay-service enable

    set dhcp-relay-ip "x.x.x.x" "x.x.x.x" etc

    sw2090
    SuperUser
    SuperUser
    June 8, 2020

    ist it really?

     

    Afair in FGT Cli the dhcp settings are on their own.

    There is config system dhcp server for that...

     

    However I never did config this on cli so far ;) 

     

    Thought Leadership. Security Summit. Thursday, November 12th, PGA National Resort, Palm Beach Gardens, FL.
    Thought Leadership. Security Summit. Thursday, October 8th. Disney's Grand Californian Hotel & SPA, Anaheim, CA.
    Security Operations Summit: Modernize SecOps. Operate AI-Native.AMER: November 4 | 9:00 AM PST. India and SAARC: November 5 | 10:00 AM IST. EMEA: November 5 | 10:30 AM CET. APAC: November 5 | 11:00 AM SGT