Couldn't get IP address

[efelledi]

I have FG 100 E, and I have it setup
DHCP Server
Address range 192.168.2.2-192.168.2.254
Netmask 255.255.255.0
is there something missing so that some devices sometimes can't get the IP address

Thanks.

[AlexC-FTNT]

"Couldn't get IP address" in most cases it means that the pool of IPs is exhausted. The clients are probably not releasing the IPs, so this can happen even if you don't see 253 active users at the same time.

You can start by increasing the range of IPs that FortiGate can hand out to clients (starting with a /23), or lower the time these IPs are assigned.

If you want to troubleshoot the DHCP message exchange on the fortigate, you can run a packet capture filtered to ports 67 and 68 and/or a debug:
diag debug app dhcpd -1

diag debug enable

[efelledi]

Hi AlexC
Thanks, please notice this IP what should i add.

[AlexC-FTNT]

Hi Efel, 

Right now, your Address range in DHCP server has 253 IPs (.2 > .254)

If you change the IP mask to 255.255.254.0 you will double the number of available IPs in the DHCP range: 192.168.2.2 - 192.168.3.254 
Make sure that this network doesn't overlap any other networks you may have on the FortiGate.

[efelledi]

Dear AlexC

Is the change like this?

[AlexC-FTNT]

The answer is yes, but you should get the confidence to make these changes without asking on a public forum for such basic changes ;) In the worst case, you break something, then you will have to fix it and learn a lesson in the process.

[efelledi]

I'm throwing this on the forum because on the ticket the response is slow and on the forum it's faster, that's normal with service

[andrewbailey · Accepted solution]

Hi efelledi,

The key question is how many users and devices will access this interface over the course of 1 week?

At the moment you have set the “Lease Time” to 604800 seconds (7 days). That means that every device attaching to the interface will have an IP address reserved for the next 7 days.

So in your original config (subnet 255.255.255.0) you had 252 IP addresses available to be leased out.

If device number 253 tries connect to this interface over the course of a week (eg your phone) no addresses will be available to be leased out.

So Alex is right- you can make the subnet bigger if you need to allow for more devices.

Or if you only ever have a few guest devices that come and go each day with new devices the next make the lease time shorter to allow the IP addresses to be reused. 

I would typically use a 4 hour lease time (14400 seconds). That’s enough for devices coming and going and the DHCP protocol doesn’t generate a lot of traffic.

If you don’t have a clear idea how many devices will use this interface I would make the lease time shorter anyway. 7 days is unusually long I think.

Hope that helps you.

Kind Regards,

Andy.

[efelledi]

Hi Andy,
Thank you, your advice really helped me.

[vak0]

Hi Guys,

I recently enrolled in this course but i am have a problem with my DHCP i think its full and how do i manage my firewall remotely?

Regards