FortiGate
FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
sdebnath
Staff
Staff
Article Id 394204
Description This article describes why FortiGate does not allow DHCP clients on one interface to receive IP addresses from a DHCP pool configured on another local interface of the same FortiGate device.
Scope All FortiGates
Solution

FortiGate cannot relay DHCP requests to its own local DHCP server because DHCP relay is designed to forward requests to a remote DHCP server—not back to itself.

 

Why:

  • When FortiGate acts as a DHCP server, it listens for DHCP DISCOVER broadcasts on its interfaces.

  • If it's also configured to be a DHCP relay on the same interface, it would be forwarding those same requests away from itself, effectively bypassing its own DHCP service.

  • The DHCP relay agent is meant for environments where:

    • DHCP clients are on one subnet, and

    • The DHCP server is on a different subnet (i.e., not local to the client).

  • FortiGate does not support relaying DHCP requests to itself because it's not a valid use case under the DHCP protocol specification.

The following example will be used to explain this scenario in detail:

 

DHCP Relay.jpg

 

  • Client Network (Internal1).

    • Subnet: 192.168.60.0/24.

    • Role: DHCP client.

    • Configuration: DHCP relay enabled.

    • Relay Target: 192.168.40.99 (SmartHomeWifi interface IP).

  • DHCP Server Network (SmartHomeWifi).

    • Subnet: 192.168.40.0/24.

    • DHCP Pool: Managed directly by FortiGate.

    • Role: DHCP server.

  • FortiGate Device

    • Provides both relay and DHCP server functionalities.
       

The expected output would be 'FortiGate will not act as both a DHCP relay agent and the target DHCP server for its own relay requests'.

Therefore, the expected outcome is as follows:

  1. Clients connected to Internal1 will not receive any IP addresses.
  2. DHCP relay requests will forward, but the FortiGate will not respond to its own relayed traffic.
  3. The DHCP server running on the SmartHomeWifi interface will ignore these requests relayed to its own IP.


Related articles
Technical Tip: DHCP relay not working while forwarding the request to other DHCP server 

Troubleshooting Tip: DHCP relay issue

Contributors