FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
By default, when the FortiGate firewall is in the transparent mode, it drops all broadcast traffic except ARP. This will result in the dropping of the DHCP broadcast traffic by default with the following entries being seen in the debugs:
(DMZ-MOBILE) # id=20085 trace_id=1738 func=print_pkt_detail line=4373 msg="vd-DMZ-MOBILE received a packet(proto=17, 0.0.0.0:68->255.255.255.255:67) from port3." id=20085 trace_id=1738 func=init_ip_session_common line=4522 msg="allocate a new session-000476b2" id=20085 trace_id=1738 func=__br_forward_check line=166 msg="drop broadcast: in: port3, out: port2"
To enable the flow of transit DHCP traffic in transparent mode it is necessary to:
1) Enable broadcast-forward in the concerned interfaces from CLI.
config system interface edit port2 set broadcast-forward enable next edit port3 set broadcast-forward enable end
2) Configure policies in both directions allowing the DHCP traffic.
The policies need to be in both directions because the OFFER packet will come in with different IP addressing (the source will be the server IP)
Note: a) If vlan interfaces are involved, the policies need to be setup between them. b) DHCP discover traffic does not hit multicast policies.
The document 'FortiOS Handbook - Transparent Mode' which is available in the Fortinet Document Library provides additional information on this subject.
