Description
This article describes the procedure to configure FortiGate for facilitating PXE booting.
Scope
FortiGate v6.4.
FortiGate v7.0.
FortiGate v7.2.
Diagram
Ensure the following configuration and infrastructure is in place before configuring FortiGate.
1) TFTP PXE server hosting the installation file (know the file name).
2) PXE-capable/enabled NIC (Network Interface Card) on the client (PXE Booting Client), and that broadcast originating from the PXE Booting Client can reach the FortiGate which is acting as a DHCP server in this scenario:
Ensure that there is IP reachability between FortiGate and TFTP PXE server (the PXE server can be on the same subnet or a different subnet than the PXE client).
Use case:
1) To deploy an OS on VMs/PCs during the bootup process.
2) If a machine has been required to boot using PXE.
Solution
Under DHCP configuration on FortiGate, provide the TFTP server IP address and file name on the server
# config system dhcp server
edit 1
set next-server <IP address of a server>
set filename "Boot\\x64\\Images\\boot.win"
end
next-server = example 192.168.10.1 - default type - string
set filename = some implementations might require the filename converted to HEX, some others does require the file to be in the root directory as the application can't grab inside folders. Please check the proper format on the vendor's documentation.
Verifying / Troubleshooting :
On FortiGate's SSH, use 'diag debug application dhcps -1' to collect more details about the DHCP transaction.
Look for the DHCPDISCOVER coming from the client and let's make sure the client is requesting the DHCP options necessary for each implementation. Usually, options 60, 66 and 67 are pretty common.
Make sure the FortiGate is sending out a DHCPOFFER
Use the packet sniffer to collect the DHCP transaction and open it on Wireshark
filter on ports 67 and 68 UDP.
The DHCPDISCOVERY should look like this, and make sure it includes option 53 .
The DHCPOFFER coming from the Fortigate should look like this:
Make sure:
- The DHCP Server Identifier is the FortiGate IP.
- It contains the Boot file name.
- It contains option 53.
- It contains the desired options like 60, 66, 67 or 150 ( It has been added for illustration purposes).
If the option is not visible in the DHCPOFFER, double-check if the client has included it in the DHCDISCOVERY.
The PXE Client would also provide a nice indication that the DHCP options were received and processed correctly.
Related articles:
