DHCP Leases Not Reaching Some AP's

[ahheyor]

Howdy,

I'm hoping someone can give some help and pointers.

I'm not an expert at networking, however am decent enough to know the basics and find it easy to learn as I go, and also NSE4 certified. I'm an InfoSec guy, so not too hands-on.

Basically, the problem I have is that some F-AP 221B's are not receiving DHCP leases.

I have a virtual switch with a few Vlans set up; 2 wireless.

Both Vlans have the same configuration settings, except for the IP range and that the one that is not causing any problems is WPA-2 protected.

There are 20 x 221B AP's.

6 of those in one building only, going through 2 FortiSwitches are not allowing guests to connect to the Internet.

There is another building with the exact same AP's and profile, DHCP settings, etc., that is able to allow guests to successfully connect.

I cannot ping the FortiSwitches in the "problem building", but can ping the AP's straight through that switch.

I've checked the DHCP leases and set them to one week and there's only ever around 20-22 connected, but are connected through the other building into the same Vlan but on another vendors switches.

I'm thinking that the FortiSwitches are the problem here.

Any ideas or is more information needed?

Thanks for reading.

[ChubbsPeterson]

Is the SSID tunneled or bridged? If bridged, make sure your uplink to your DHCP server on the FortiSwitch has DHCP snooping trusted. You're going to need to get access to the switch to really troubleshoot it. 

[ahheyor]

Hi ChubbsPeterson,

I've been reading about what you mentioned, and it would appear that this feature can cause this problem.

I can see that there is a Cli command to configure DHCP snooping:

config switch-controller manage-switch

edit <switch-id>

config ports

edit port1

set dhcp-snooping (trusted | untrusted)

end

How would I go about finding the switch ID? I've tried the Vlan ID as per the documentation from previous FortiOS version, but with no luck.

If not, I'll just pay a visit to the site.

Thanks for your help so far.