Skip to main content
stlblufan
stlblufan
New Member
August 26, 2014
Solved

On-Net / Off-Net

  • August 26, 2014
  • 17 replies
  • 57661 views
I am running 5.2 on a 60C, with FortiClient 5.2.1 on all clients, all of which are " on-net" . However, on the 60C, all of the clients show up as " off-net" . Is there something that I need to do in order to make them register properly?
    Best answer by rwdorman
    Quick update - AFter getting the suggestion earlier in this thread I setup Option 224 in my DHCP server (Windows 2012 server) to send a single valued string attribute with the serial number of the registered fortigate and on-net/off-net works as I wanted it to. In defense of TAC: this is not a published, documented or supported method of making this work so YMMV.

    17 replies

    Show previous replies
    Christopher_McMullan
    Staff
    Christopher_McMullan
    Staff
    April 9, 2015

    I was just chatting with one of my colleagues, who was mentioning Option 224. He tested regular text to work in Windows Server 2012, but that hex is required in 2008R2 and below.

    It jogged my Rain Man memory about this post, so I decided to answer your question.

    If you need to use hex, and don't want to manually run the conversion, set the FortiGate as the DHCP server and sniff a DHCP request to retrieve the proper hex string for the serial number.

    Otherwise, if you have a 2012 instance, capture the string using Wireshark.

    jodros
    jodros
    New Member
    April 23, 2015

    How does option 224 with a serial number work in a clustered environment?  I need to get this configured as we cannot have our fortigates running as our corporate DHCP servers.  They are in a cluster.  Do I need to enter both in option 224?  Do I only need to enter the master?

     

    Thanks

    terry_jjr
    terry_jjr
    New Member
    May 4, 2015

    So I configured a predifined option on our 200R2 DHCP server IPv4 as follows: name - forticlient status, data type - String, code - 224, no description.  Clicked OK and then added the HEX string in which I got by converting the serial number to HEX here http://www.asciitohex.com/  I then configured the new DHCP option on the single scope and I am testing now.

     

    Its worth mentioning that I am running 5.2.3 firewall firmware and 5.2.3 forticlient.  The status shows registered-online whether I am connected internally or via vpn.  The only thing that changes is the interface that I am connected to on the firewall (port1 or vpn_0). 

     

    The problem I have is that I do not have the DHCP option enabled in the fortigate which means the tick box for the client on-net/off-net status is not available or enabled.  How do you guys that have this working deal with this?

    jodros
    jodros
    New Member
    May 5, 2015

    I am glad you have this working.  Yes you will see different interfaces if your fortigate is also terminating a VPN.  I am assuming that the 2008R2 server is providing DHCP for VPN users?

     

    As far as your problem, I am confused.  Do you need a way to monitor which FortiClients are showing on/off net?  If so you can under monitoring.

    terry_jjr
    terry_jjr
    New Member
    May 5, 2015

    Hi Jodros,

     

    as per my screenshot, in order for the fortigate to register what a client is doing and whether it is on-net (internal) or off-net (external), you need to have that option ticked.  This option is only available if all three options are ticked as per the screenshot.

     

    My problem is that the clients appear to be working, but when the VPN is established, the still appear on-net according to the monitoring tab in the fortigate GUI.

     

    thanks,

     

    jodros wrote:

    I am glad you have this working.  Yes you will see different interfaces if your fortigate is also terminating a VPN.  I am assuming that the 2008R2 server is providing DHCP for VPN users?

     

    As far as your problem, I am confused.  Do you need a way to monitor which FortiClients are showing on/off net?  If so you can under monitoring.

    terry_jjr
    terry_jjr
    New Member
    May 5, 2015

    I just did some wireshark sniffing on the DHCP client on the internal network and I couldn't see option 224 coming from the DHCP server.  I am wondering if my settings are correct.  I can all the other standard options in the wireshark file.  Do my settings look correct on the DHCP server?

    terry_jjr
    terry_jjr
    New Member
    May 7, 2015

    The on-net/off-net status option is not available in the VPN configuration.  I am only able to specify the range the fortigate will give the clients and nothing more :(

     

    It appears that there is a growing demand for a feature to support 3rd party DHCP based on customer feedback.

    The more people that ask for this, the faster it will be delivered.

    jodros
    jodros
    New Member
    May 8, 2015

    I see.  I have not dealt with the SSLVPN configuration on the fortigate, as we utilize Juniper.  Is it causing any issues having the FortiClient think that it is off-net when you are connected over SSLVPN?

    Jeroen
    Jeroen
    New Member
    May 12, 2015

    We've tried the option 224 in a windows 2008 enviroment. With windows 7 clients. This seems to work perfect. But the apple users with Forticlient doesn't show up on-net when they are in the same segment as the other windows 7 clients.

    PACIT
    PACIT
    New Member
    June 12, 2017

    I am new to Forti-ALL We have just purchased a 100e Fortigate V5.4.  I want to employ FortiClient across our campus but must see it in action working as needed before I can buck the 3ed party support that sold us the Fortigate as they are pushing something else. My background 6 years removed was Novell but I'm working this MS Server 2008 environment now that provides DHCP from the server.  I see 5.4 requires DHCP running on the Fortigate to provide "On-Net / Off-Net" recognition.  I NEED to make sure laptops going off campus can not disable Forticlient. Can the Fortigate DHCP service run parallel to the Microsoft AD-DHCP in a limited fashion just for remote clients? 

    Terms & ConditionsCookie settingsAccessibility statement