DHCP Relay IPSec

[patrick_z]

Hi @All,

I have a strange problem. We roll out new devices replacing Fortigates. Currently we are mainly using IPSec to connect from external to our corporate network. As we are now using FortiOS 5 this stops working. So DHCP over IPSec relay to internal DHCP Server is not working anymore. I tried with Forticlient V4 to V5.2 with different versions. As well I tried on Fortigate with FortiOS v5.0.X to v5.2.x - no joy. As far as I traced the packages it seems to me that the client (Forticlient) requests the DHCP and the server answers but the client didn't get the answer. I'm using policy based IPSec VPN. Anybody a good idea where to look at? With Fortigate on FortiOs v4.3.X no problem with none of the clients! I did some traces:

--- log --- id=13 trace_id=192 msg="vd-root received a packet(proto=17, 10.100.250.101:68->255.255.255.255:67) from wan2." id=13 trace_id=192 msg="allocate a new session-00e88ebd" id=13 trace_id=193 msg="vd-root received a packet(proto=17, 192.168.22.2:67->192.168.22.230:67) from local." id=13 trace_id=193 msg="allocate a new session-00e88ebf" id=13 trace_id=194 msg="vd-root received a packet(proto=17, 192.168.22.230:67->192.168.22.2:67) from internal." id=13 trace_id=194 msg="Find an existing session, id-00e88ebf, reply direction" id=13 trace_id=195 msg="vd-root received a packet(proto=17, 192.168.231.66:67->10.100.250.101:68) from local." id=13 trace_id=195 msg="Find an existing session, id-00e88496, original direction" id=13 trace_id=196 msg="vd-root received a packet(proto=17, 10.100.250.101:68->255.255.255.255:67) from wan2." id=13 trace_id=196 msg="Find an existing session, id-00e88ebd, original direction" id=13 trace_id=197 msg="vd-root received a packet(proto=17, 192.168.22.2:67->192.168.22.230:67) from local." id=13 trace_id=197 msg="Find an existing session, id-00e88ebf, original direction" id=13 trace_id=198 msg="vd-root received a packet(proto=17, 192.168.22.230:67->192.168.22.2:67) from internal." id=13 trace_id=198 msg="Find an existing session, id-00e88ebf, reply direction" id=13 trace_id=199 msg="vd-root received a packet(proto=17, 192.168.231.66:67->10.100.250.101:68) from local." id=13 trace_id=199 msg="Find an existing session, id-00e88496, original direction" id=13 trace_id=200 msg="vd-root received a packet(proto=17, 10.100.250.101:68->255.255.255.255:67) from wan2." id=13 trace_id=200 msg="Find an existing session, id-00e88ebd, original direction" -- log end --- 

WAN2 is public interface of Fortigate - WAN1 interface for MPLS on the same device.

Here we see that client 10.100.250.101 is requesting DHCP but that is the internal IP of the client behind the NAT! It's not the public IP of the Nat device where the client is behind! That is the reason why the client don't get the answer because the 10.X range will be routed out to different interface of the firewall where the client tries to connect with IPsec VPN.

Same setup but version 4.3.X on the target VPN the client can connect without any problem.

If I create a DHCP Server on the interface and hand out there IPs via DHCP it is working. Relay is NOT working.

Any ideas? Have somebody a working example where DHCP-Relay with VPN-IPsec is working?

Cheers, Patrick

[jb_kalm]

Hi Patrick,

Maybe the commands below are worth a try? My bad if I'm not understanding the issue correctly.

config system interface

    edit "wan2"

        set vdom "root"

        set dhcp-relay-service enable

        set dhcp-relay-ip "10.x.x.x" 

    next

end

Thanks,

jb

[patrick_z]

Hi jb,

I did that already - didn't help

Thanks anyhow.

Nobody any idea?

Does somebody have a working config where DHCP relay is used? So DHCP server is not the firewall it self?

Cheers, Patrick