100D assigning wrong DHPC

[wseaton]

Dealing with an odd issue with a customer's 100D (v5.4.1) . Their network is fairly simple with production and business running on one interface and guest wifi and things that don't need to to see internal production on another interface. If anything the 100D is severe over kill for their environment. 

Both interfaces assign DHCP, and the scopes are quite different. Makes it easy to see when the owner doesn't follow instructions and doesn't put devices on the appropriate LAN via just looking at it's IP.

They also have been having a problem with intermittent power outages, and while I have the 100D on a UPS a couple times it's had a hard shut down after the UPS battery runs out. Twice when it's done this I've found devices on the internal network assigned DHCP addresses from the public / DMZ side. These are hard wired desktops that can't see anything other than the 100D and the two networks are physically separate aside from the 100D.

Not a big deal since rebooting the client system or refreshing via IPCONFIG fixes it instantly, but I ate a lot of crow getting these guys off static IP and would like to know what's going on.

[sw2090]

have you checked your subnets for itf there is annother dhcp server active somewhere with th same scope? Maybe this then answers dhcp requests when your FGT is down?

[wseaton]

Nevermind - found it. 

What threw me was the rogue DHCP reservation was on the Fortigate....so naturally you blame the Fortigate, right?

The problem turned out to be wifi. These guys have Ubiquiti AP's on both sides of the split networks, and Ubiquiti has a 'feature' called wireless uplink that allows their APs to share mgmt data to downstream APs not wired, and by default it's enabled.  And, as I found out....it also broadcasts DHCP across networks. The interfaces on the Fortigate just by coincedence likely spin up from restart with their public interface and DHCP service just a bit sooner than the internal interface, so all the internal clients get DHCP passed from the wrong interface because the APs are passing it across the network. Disabled the feature on the Ubiquiti's and it went away. Going to have a nice little post on their forums about this.