Issues with DHCP Relay following upgrade to 7.4.3 on 40F and 7.4.2 on Fortiswitch 124F

Hello Martin

Do you have on your FortiGate any IP pool that includes the DHCP server's IP in its range? (check under Policy & Objects > IP Pools).

E.g.:

• DHCP server's IP: 10.0.0.5
• IP pool: 10.0.0.1-10.0.0.8

If this is the case then you may need to disable the "ARP Reply" in that IP pool.

Hi @Martin_Hancock,

Please refer to this article https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-DHCP-relay-issue/ta-p/215535

Regards, 

hi @hbac

I have also followed those instructions with no success.  I have also logged a support ticket with Fortinet as well as everything was working perfectly prior to upgrading the firmware on both the fortiswitch and the Fortigate

I have also checked the IP pools - none exist.

Hi @hbac

I have the following logs and this is where it stops

2024-02-21 10:56:05 Insert option(82), len(14)
2024-02-21 10:56:05 found route to 192.168.1.2 via 192.168.6.254 iif=20 oif=17/PlanB-WAN, mode=auto, ifname=
2024-02-21 10:56:05 (xid:d206fe7a) forwarding dhcp request from 192.168.6.254:67 to 192.168.1.2:67
2024-02-21 10:56:09 (xid:d206fe7a) received request message from 192.168.6.116:68 to 255.255.255.255 at FS_WintonLAN
2024-02-21 10:56:09 (xid:d206fe7a) got a DHCPREQUEST
2024-02-21 10:56:09 (xid:d206fe7a) Warning! can't get server id from client message
2024-02-21 10:56:09 Insert option(82), len(14)
2024-02-21 10:56:09 found route to 192.168.1.2 via 192.168.6.254 iif=20 oif=17/PlanB-WAN, mode=auto, ifname=
2024-02-21 10:56:09 (xid:d206fe7a) forwarding dhcp request from 192.168.6.254:67 to 192.168.1.2:67

When i run a packet capture on the PC the DHCP request is sent to my Fortigate and then nothing else happens.

I ran the packet sniffer and the DHCP traffic is definitely going out the correct interface - it is going out my WAN interface

AWS-WINTON # diagnose sniffer packet any "port 67 or 68" 4
interfaces=[any]
filters=[port 67 or 68]
80.874356 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
80.874618 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
80.874627 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
83.878144 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
83.878343 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
83.878353 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
85.886799 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
85.886979 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
85.886987 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
89.889325 FS_WintonLAN in 192.168.6.116.68 -> 255.255.255.255.67: udp 334
89.889580 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
89.889590 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350

@Martin_Hancock 

But I see there is no response from server. Then I think there must be some troubleshooting from DHCP server side.

• First I'd sniff on DHCP server too see if the DHCP queries are reaching the interface and if response is leaving the interface 
• I'd enable more DHCP service debug on DHCP server to see what's happening there

So far I suspect that there is something in FOS 7.4.3's forwarded queries that your DHCP server doesn't like. But we need some log evidence.

On the other hand can you share your DHCP relay config on FortiGate?

Hi @AEK 

I have already carried out a packet sniff on the DHCP server and it seems that the packets are not reaching it.  The strange thing is that i have other sites that are running Fortigate 40F models and they get their IP address via DHCP relay over the WAN with no issue but these sites do not have Fortiswitches in them.

This is the config of my DHCP relay

set vdom "root"
set dhcp-relay-service enable
set ip 192.168.6.254 255.255.255.0
set allowaccess ping https http
set alias "AWS Winton LAN"
set role lan
set snmp-index 8
set dhcp-relay-ip "192.168.1.2"
set interface "fortilink"
set vlanid 6

DHCP snooping is turned off at the VLAN level.  How do i check it at the switch level?  The switches are connected via fortilink

I’ve checked that and I can’t find anything referring to DHCP snooping

HI @AEK 

7.4.2 on my switching