Troubleshooting Tip: Check DHCP Messages with VLAN Tag using Wireshark Packet Capture

[rbernal]

Description	This article describes how to check a VLAN tag on DHCP Messages of devices that request a DHCP IP from FortiGate configured as a DHCP Server.
Scope	FortiGate.
Solution	There are cases that which the FortiGate is set up as a DHCP server for a certain VLAN ID and devices are unable to get the IP address for that VLAN. One of the troubleshooting steps is to check if the DHCP Messages is received by the FortiGate and if it is correctly tagged by a VLAN ID. Here is another helpful article to explain the DHCP Process: Technical-Tip-Understanding-DHCP-Process The example below will provide steps to capture DHCP Messages and check the VLAN tag if correct. Diagram: FortiGate is configured as DHCP Server Physical Interface 'port2' and VLAN interface 'IntVLAN-20' with VLAN ID of 20. FortiGate's Interfaces:   Setup Putty to capture all logs, then SSH or console to FortiGate. Follow this link: Technical Tip: How to create a log file of a session using PuTTY Initiate the packet capture command on CLI: diag sniff packet port2 "none" 6 0 l <----- This command will capture all traffic on port2. While packet capture on step2 is running, connect the PC on e0/2 of the switch that is tagged with VLAN ID 20. FortiGate will capture all the traffic on port2 that includes DHCP Messages. When the PC gets an IP, stop the packet capture on step2 by pressing 'CTRL+C' and convert the capture file into Wireshark pcap file by following this link: Technical Tip: How to import 'diagnose sniffer packet' data to WireShark Attached an example file of Packet capture that have a VLAN 20 tag for reference: Raw file saved by Putty using sniffer command: VLAN20-PCAP-RAW.zip Converted file to Wireshark PCAP: VLAN20-PCAP.zip Open the pcap file VLAN20-PCAP.pcap and set the filter as the Physical address of the PC. Example filter: eth.addr == 50:00:00:09:00:00  It shows on the image the DHCP Messages. More importantly, the DHCP Discovery sent by the PC with transaction ID 0x79543bd Another filter related to transaction ID can also be added: bootp.id == 0x79543bd On the image above, it shows the VLAN tag ID 20 on the DHCP Messages. This tag should be visible on the DHCP Messages so that the FortiGate could provide an IP address that is configured on DHCP Server for VLAN 20. Below is another example if the DHCP Messages are untagged. FortiGate will provide an IP address within the range of the DHCP Server in Physical Interface instead. Note that image below is not related on the network setup for the DHCP Messages that has a VLAN tagging: Related articles: Technical Tip: Diagnosing DHCP on a FortiGate Troubleshooting Tip: Client receives the wrong DHCP scope