Skip to main content
tanr
New Member
June 6, 2019
Question

Managed FortiSwitch 6.0.4 1xxE DHCP Snooping and Blocking

  • June 6, 2019
  • 1 reply
  • 12557 views

We updated our FortiGates to 6.0.5 a little while back and are now starting the upgrade to 6.0.x with our FortiSwitches.

 

I used our secondary location, which only has a single FortiGate and FortiSwitch 124E-POE to test this, and upgraded the FortiSwitch from 3.6.9 to 6.0.4. 

 

Seemed to work okay, then saw no DHCP responses were getting back to clients.  The FortiSwitch appeared to be blocking them. 

 

Logging in directly through a management port and checking the vlan interface GUI page showed DHCP Snooping On/Enabled for each vlan interface (with switch port is listed as untrusted) and a warning label saying "DHCP Server(s) have been blocked". 

 

Turning off DHCP snooping for the vlan interface allowed normal DHCP requests and responses.

 

Note that DHCP had been working fine with the switch on 3.6.9 (when managed by a FortiGate on 6.0.5).

 

Release notes for FortiSwitch 6.0.4 says DHCP Snooping is supported for 1xxE devices, but not DHCP Blocking.

Admin guide for Managed FortiSwitch 6.0.4 says 1xxE switches DON'T support DHCP Snooping nor Blocking.

Admin guide for Standalone FortiSwitch 6.0.3 says 1xxE switches DO support DHCP Snooping, but not Blocking.

 

For a switch that isn't able to DHCP Blocking it seemed to be doing it a bit too well.  If the switch (when managed) doesn't support DHCP Snooping, then why is it enabled?  Upgraded config issue?

 

Anybody know whether DHCP Snooping and DHCP Blocking are actually supported, currently broken, not supported, or something else for a 6.0.4 124E-POE FortiSwitch managed by a 6.0.5 FortiGate?

 

I'd like to understand what's happening with this switch before updating our other location which has 248E and 108E switches, along with non-Fortinet switches.

 

1 reply

tanr
tanrAuthor
New Member
June 7, 2019

Additional detail:  The FortiGate GUI for the 124E-POE switch ports shows the "DHCP Snooping" column with Trusted or Untrusted.  EDIT: The 124E-POE shows a blank cell for DHCP Snooping on the FortiLink interface ports. 

 

My 108E-POE on 3.6.9 (which doesn't support DHCP snooping) shows that field as blank.

 

Any ideas before I call TAC?

tanr
tanrAuthor
New Member
June 7, 2019

Update:  Called TAC and they looked at 124E-POE config

 

Turns out that:

 

1. A FortiGate managed FortiSwitch 124E *does* support DHCP Snooping on the 6.0.x firmware

 

2. Upgrading from the 3.6.9 firmware on which the 124E does not support DHCP Snooping to 6.0.4 incorrectly set its FortiLink interface as an untrusted port within the FortiSwitch (not visible from the FortiGate)

 

3. Solution: ssh to the FortiSwitch, config switch interface, edit "FortiLinkInterfaceName", set dhcp-snooping trusted, end

 

Hopefully this helps out someone else if they get burned by this.

ede_pfau
SuperUser
SuperUser
June 8, 2019

Thanks for investigating this, and sharing!

Seems the doc department was outpaced (again)...