DHCP Failure due to BOOTP Broadcast

[jdconti]

Is there any way to set the Fortigate DHCP client on wan1 to use the Unicast BOOTP flag?  I'm using an 80F (7.x firmware) on Optimum Fiber and due to their network configuration, they're ignoring DHCPDISCOVER's with the Broadcast flag set.  This is identical to Re: Fortigates incompatibility with Telenet DOCSIS... - Fortinet Community

[Jean-Philippe_P]

Hello jdconti,

Thanks for posting on the Fortinet Community Forum!

I found documents that can help you :

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Diagnosing-DHCP-on-a-FortiGate/ta-p/192960

or

https://community.fortinet.com/t5/FortiGate/Technical-Tip-DHCP-address-leases-on-a-FortiGate-unit/ta...

Can you tell me if it solved your problem or if you need more assistance please?

Kindest regards,

[jdconti]

Hey Jean-Philippe,

That was useful but only confirms my suspicion regarding the broadcast BOOTP flag.  In many ISP deployments that utilize DHCP relaying they often discard DHCPDISCOVER packets with the broadcast flag set.  Is there any to toggle the BOOTP flag on the wan1 DHCP client to unicast?  If not, there should be... I'm also wondering how the issue was fixed in 6.x firmware for the previously mentioned Telenet issue, could you provide details?  

Thanks!

[distillednetwork]

looks like the older issue was fixed via code:

https://docs.fortinet.com/document/fortigate/6.0.5/fortios-release-notes/565064/resolved-issues

find bug ID 536817

If you run a flow filter debug on wan1 do you see any response at all from the ISP?

[distillednetwork]

on second thought, that bug is when the fortigate is the server.  Maybe a similar issue with you are getting an offer but no ACK?  

[jdconti]

I have a packet capture from wan1 (below) and I'm simply getting no response from the next hop / dhcp server.  If I hook up any other device that sends DHCPDISCOVER with the Bootp flag set to unicast instead of broadcast I immediately get a DHCPOFFER from the ISP.  

While setting the Bootp flag to Broadcast doesn't necessarily violate the RFC[1] the client shouldn't be setting the broadcast flag unless there are specific DHCP client limitations... most modern DHCP clients set the flag to unicast.  

Fortinet, if you're listening, please provide a toggle for the Bootp flag! =)

[1] RFC 1542: Clarifications and Extensions for the Bootstrap Protocol (rfc-editor.org)

[Charlez79]

Has this been resolved in the meanwhile.