Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
ChristianK
New Contributor

Usage of external DHCP on SSL VPN

Hello all,

I want to use external DHCP on my SSL VPN.

I found the following on the internet:

config system interface 
edit ssl.root
set dhcp-relay-service [enable|disable]
set dhcp-relay-ip next
end

 

Only with these settings, it's not working.

I think there is also a configuration need on VPN SSL web portal or VPN SSL setting or I have to assign an IP on the interface ssl.root

 

Does anyone here know about this? Can someone give me the winning tip?

1 Solution
Anonymous
Not applicable

Hello,

 

As per your query Fortinet now has this feature of having an external DHCP server for SSL VPN.

Please check the link below:

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215...

 

Thanks,

View solution in original post

5 REPLIES 5
Yurisk
Valued Contributor

This is a frequent trap - dhcp configs under ssl.root interface are there ... but they do not work.

May be in 7.0 it is different but for 6.x train it is possible for VPN SSL only if you use RADIUS for authentication and then your RADIUS server will allocate each user own IP address. Any other case - it is only VPN SSL pools on Fortigate or IPSec VPN (also part of FortiClient) - there you CAN use external DHCP server.

 

 

Yuri https://yurisk.info/  blog: All things Fortinet, no ads.
Yuri https://yurisk.info/ blog: All things Fortinet, no ads.
Anonymous
Not applicable

Hello,

 

As per your query Fortinet now has this feature of having an external DHCP server for SSL VPN.

Please check the link below:

 

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215...

 

Thanks,

esalija
Staff
Staff

 At web SSL portal should add GW too.

# config vpn ssl web portal

edit "full-access"

set tunnel-mode enable

set web-mode enable

set ip-mode dhcp

set dhcp-ra-giaddr y.y.y.y  ( y.y.y.y is the IP of the FGT port that is connected with the DHCP Server)

end

Faiza_Emam_Delhi
Contributor II

To use external DHCP on your SSL VPN, you need to configure the FortiGate to act as a DHCP relay for the SSL VPN interface. The configuration you found is a good starting point, but there are a few additional steps you need to take to make it work.

Here's an example configuration that should work:

1. Configure the external DHCP server to provide IP addresses for the SSL VPN clients.

2. In the FortiGate GUI, go to "System" > "Network" > "Interfaces" and select the SSL VPN interface ("ssl.root").

3. In the interface settings, enable the "DHCP Relay" option and specify the IP address of the DHCP server.

4. Go to "VPN" > "SSL-VPN Settings" and select the "Listen on Interface(s)" option.

5. Under "Listen on Interface(s)", select the SSL VPN interface ("ssl.root").

6. Under "Tunnel Mode", select "Split Tunnel" or "Full Tunnel" depending on your needs.

7. Save the SSL-VPN Settings and restart the SSL VPN service.

With these settings, the FortiGate should act as a DHCP relay for the SSL VPN clients and forward DHCP requests to the external DHCP server. The clients should receive IP addresses from the external DHCP server and be able to access the SSL VPN network.

Thanks & Regards,
Faizal Emam
Thanks & Regards,Faizal Emam
esalija
Staff
Staff

Dear Faizal Emam,

 

Thank you for the answer.

 

Yes, that work also for me without enabling the DHCP at ssl.root interface.

config system settings
set dhcp-proxy enable
set dhcp-server-ip "x.x.x.x"
end
+ Enabling the dhcp-proxy option at global level ensures that the Fortigate can act as dhcp proxy only for ssl vpn and ipsec VPN.

 

Related to the command set dhcp-ra-giaddr <gateway_IP_address> this is a new feature that is added at FortiOS v7.2.4.

 

Best Regards,

E. Salija

 

Labels
Top Kudoed Authors