Configuring specific dhcp options within same subnet

[razor]

Hi Fortinet Guru's,

I have a question regarding the DHCP functionality within the FortiOS.

We're asked to replace a CISCO device within a couple of weeks, so far so good. But the Cisco device used DHCP pools to distribute DHCP options for specific desk phone's, within the same subset.

A piece of the config file:

ip dhcp excluded-address 192.168.2.1 192.168.2.9
ip dhcp excluded-address 192.168.2.200 192.168.2.254
!
ip dhcp pool VLAN1
network 192.168.2.0 255.255.255.0 domain-name xxx.local default-router 192.168.2.254 dns-server 192.168.2.254
lease 0 8 !
ip dhcp pool phone1
host 192.168.2.5 255.255.255.0
hardware-address 0004.f269.39d5
default-router 192.168.2.254
dns-server 192.168.2.254 213.144.235.1
option 66 ascii "http://xxx100:xxhoofd75@xxx.nl/dms/polyucauth" lease 0 0 30
!
ip dhcp pool phone2
host 192.168.2.6 255.255.255.0
hardware-address 0004.f269.3d88
default-router 192.168.2.254
dns-server 192.168.2.254 213.144.235.1
option 66 ascii "http://xxx200:xxhoofd75@xxx.nl/dms/polyucauth" lease 0 0 30

It seems FortiOS doesn't have the capability to provide the same functionality; but I need someone to confirm. For instance, if I try to make multiple DHCP servers within the FortiOS config, it will complain about the subnet which cannot be used in multiple DHCP servers.

Who can help me out? Thanks in advance!

[sw2090]

hm yes,

FortiOS does only support one DHCP Server per Interface. It though does support multiple ip pools per dhcp server and also dhcp reservations/assignments. So far that would be no problem.

What kills it is your client specific dhcp option 66. You can set custom string as dhcp option on a dhcp server on a FGT Interface but you can not tag it to a specific client.

So you would have to multiply the interfaces instead of the dhcp servers. You could setup a vlan for each telephone with its own dhcp server - that would do the trick but will be somehow overkill....

[Toshi_Esumi]

Option 66 is regularly per phone type or vendor. We have multiple phone type/vendor environment at customer locations and each type might require different settings (like Cisco requires option 150), often a combination between  Cisco and Polycom. We separate them by vlans and set different DHCP scope and options, so that it makes our troubleshooting process much easier, especially for Cisco phones. Most phones can learn own vlan via CDP or LLDP. If not, we set it at phones manually.

[sw2090]

ok if you seperate them by vlans anyhow you are already multiplying interfaces in some way.

On a Fortigate a vlan is a virtual interface to which you can assign a dhcp server with reservations and options.

All packets that go through the fortigate and to that vlan interface will then be tagged by the FGT (i.e. the Interface will be untagged in that vlan). Vlan Interfaces must be attached to a physical interface on a FGT.

So that should do the trick for you and as you already use vlans should not be that much overkill then ;)

[sw2090]

You just in this case cannot use dhcp pools since you cannot have more then one interface (physical as well as virtual) in the same subnet on a FGT. You will have to divide you subnet into smaller subnets(/29 with 6 hosts or /30 with 2 hosts) to be able to handle this since each vlan interface must have its own ip and two cannot be on the same subnet. 

And you then will have to have policies for each vlan...

[irfansyah]

i have same problem before,

and i tried this command

config system settings set allow-subnet-overlap enable end

it works