Skip to main content
championc1
championc1
Explorer
July 22, 2025
Solved

Obtaining new DHCP leases over a Fortigate InterVDOM link - is it possible ?

  • July 22, 2025
  • 2 replies
  • 1229 views

I have created an InterVDOM link on my firewall (7.4.7), and it can renew existing leases, but I canot seem to be able to get any config which will enable new leases to be obtained / given

The topology is a remote site has a VPN back to HQ.  The remote site has DHCP Relays configured, pointing to DHCP servers on the LAN.  The setup works perfectly when routing the traffic from our VPN vdom to our LAN vdom over the internal switching.  But once I try and route the traffic over an InterVDOM link, all traffic other than new DHCP leases work.  As soon as I disable the policy routes, the DHCP and everything else works.

Best answer by AdaCasper

  1. Use DHCP Relay Across the VDOMs
    On the VDOM that’s receiving the DHCP requests (e.g., VPN VDOM), configure a DHCP relay that points to the DHCP server in the other VDOM (e.g., LAN VDOM). However, since the VDOMs are separated, this requires allowing the DHCP relay packets to traverse the InterVDOM link.

    Create Firewall Policies for UDP Port 67/68
    Make sure you've created firewall policies between the VDOMs that allow UDP traffic on ports 67 and 68 (used by DHCP). Without this, relay traffic might be blocked even if it looks like it's passing.

    Use a VLAN or Interface with DHCP Relay at the Border
    If possible, create a dedicated interface or VLAN that acts as a border between VDOMs and runs the DHCP relay agent there, so it can bridge the requests cleanly.

    Alternative: Use IP Helper on L3 Device
    If your FortiGate allows CLI configuration of DHCP relay at the system level (not just interface level), you might be able to use the config system dhcp relay CLI command and assign the source interface/IP accordingly.

     

2 replies

Toshi_Esumi
SuperUser
Toshi_Esumi
SuperUser
July 22, 2025

You just told the cause yourself. Why do you have the policy routes and what are the policy routes doing?

Toshi

    championc1
    championc1Author
    Explorer
    July 23, 2025

    I can't have all traffic using the link.  I only want to initially test with just one site out of maybe 20 sites

    AdaCasper
    AdaCasper
    New Member
    July 23, 2025

    It sounds like the issue lies in how DHCP broadcasts are handled across the InterVDOM link. While your existing leases can be renewed—likely using unicast—new DHCP lease requests rely on broadcast traffic, which is typically not forwarded across VDOMs unless explicitly configured.

    championc1
    championc1Author
    Explorer
    July 23, 2025

    So how can I explicitly configure forwarding these broadcasts please ?  Any suggestions ?

    AdaCasper
    AdaCasperAnswer
    New Member
    July 24, 2025

    1. Use DHCP Relay Across the VDOMs
      On the VDOM that’s receiving the DHCP requests (e.g., VPN VDOM), configure a DHCP relay that points to the DHCP server in the other VDOM (e.g., LAN VDOM). However, since the VDOMs are separated, this requires allowing the DHCP relay packets to traverse the InterVDOM link.

      Create Firewall Policies for UDP Port 67/68
      Make sure you've created firewall policies between the VDOMs that allow UDP traffic on ports 67 and 68 (used by DHCP). Without this, relay traffic might be blocked even if it looks like it's passing.

      Use a VLAN or Interface with DHCP Relay at the Border
      If possible, create a dedicated interface or VLAN that acts as a border between VDOMs and runs the DHCP relay agent there, so it can bridge the requests cleanly.

      Alternative: Use IP Helper on L3 Device
      If your FortiGate allows CLI configuration of DHCP relay at the system level (not just interface level), you might be able to use the config system dhcp relay CLI command and assign the source interface/IP accordingly.

       

      Terms & ConditionsAccessibility statement