FortiAP DHCP issues Behind Cisco Catalyst 2960x switches

[thedude78]

Hello,

We are running into an issue deploying our new FAP-U321EV access points. When connected to a Cisco Catalyst 2960x switch they are almost always unable to obtain an IP address.  What we are seeing is that the DHCP Discover packets are not making it past the 2960x.  Other Systems (Windows Machiens, Cisco APs, etc.) all obtain an IP correctly on the same switch port.  DHCP Snooping is currently disabled on the switch and we run into the same issue. Switches have been updated to latest firmware. There are two anomalies that we have noticed which may be nothing.

1. The DHCP discover packets from the AP's are much larger than those of a windows machine. 590 bytes as apposed to 342 bytes.
2. Occasionally (very rarely) the AP will get an IP and when it does it operates fine on the VLAN and connects to the controller without issue (until the lease expires or it is rebooted)

I am hoping that if someone else has run into this, they may be able to share what they have learned.  I have engaged technical support and will update the thread should they provide any answers.

Thanks

[thedude78]

NIKHIL,

Enabling portfast on our edge ports of the Cisco switches did allow our AP's to get an IP properly.  We have since moved away from FortiWLC and are using a cluster of Fortigates to control them.  We did not have a lot of luck with our WLC deployment and early Code on the FAP-U APs.

Are your SSID's running in tunnel mode, or Bridge mode?  If you are bridging I would ensure that your client VPN's are trunking across all switches between the AP and the core of your network.

When running WLC's we did run into some specific bugs with Client DHCP, and relaying to our DHCP server but I can't remember what they were off the top of my head, or the version of code on the WLC at the time. I would suggest contacting Fortinet Support to inquire about any DHCP bugs in your code version.

[NIKHRAJ]

HI Dan,

Thanks for the reply. Just raised a case with Fortinet support to investigate from their end.