DHCP Relay for Multiple Dial-Up IPSEC Tunnels

[fcb]

Internal Interface of Fortigate: 10.10.10.10

Dial-Up Clients network: 10.20.20.20 - 100 Gateway: 10.20.20.5

DHCP Server: 10.10.1.7

I've got three different IPSEC VPN's published off of a single 500 series gate but because our AD DNS isn't registering the machines properly, I want to move this to so that the dial-up clients are getting their addy's from a member dhcp server... I've even got the 2FA working on these but when the dhcp request hits the server, it's using the LAN interface of the gate so dhcp is trying to assign addresses based off of the internal interface on the gate and not the network that the dial-up clients will be using. In the dhcp request I can see this happening:

corp500gw: diag app dhcp-relay
dhcprelay: checking if we need to reconfigure
dhcprelay: no changes detected
Proccessing RTM_NEWLINK event.
Relay client interface: vpn.segra2_0
netlink message!
Proccessing RTM_NEWLINK event.
Proccessing RTM_NEWLINK event.
dhcprelay: checking if we need to reconfigure
dhcprelay: no changes detected
proxy request vfid=0 type=0 id=29 client_id=64:77:74:75:67:67:6c:65
Add proxy request type=0 id=29 client_id=64:77:74:75:67:67:6c:65
make discover
make dhcp message, code=1
Insert option(53), len(1)
Insert max message len (1458)
Insert option(57), len(2)
Insert client ID
Insert option(61), len(8)
Insert requested options
Insert option(55), len(9)
Insert class ID option
Insert option(60), len(13)
Insert option(82), len(6)
found route to 10.10.1.7 via 10.10.10.10 iif=0 oif=19/port1, mode=auto, ifname=
(xid:3488b913) forwarding dhcp request from 10.10.10.10:67 to 10.10.1.7:67 (should be 10.20.20.20.5)
proxy request vfid=0 type=0 id=29 client_id=64:77:74:75:67:67:6c:65
Remove proxy request type=0 id=29 client_id=64:77:74:75:67:67:6c:65
Add proxy request type=0 id=29 client_id=64:77:74:75:67:67:6c:65
make discover
make dhcp message, code=1
Insert option(53), len(1)
Insert max message len (1458)
Insert option(57), len(2)
Insert client ID
Insert option(61), len(8)
Insert requested options
Insert option(55), len(9)
Insert class ID option
Insert option(60), len(13)

I know this to be the issue because if I create a scope on the DHCP server for 10.10.10.10 I get an IP when attempting the connection... Otherwise (when trying to use the 10.20.20.5) I see the packets hit the DHCP server but since they are looking for a non-present scope for router ID: 10.10.10.10, nothing happens.

I can't seem to locate how to tell the gate to send the request as the network associated with the VPN and not the Internal Interface of the gate

[BigLilFella]

To close the loop here, I was able to confirm with Forti support that there is not an alternative way to do DHCP relay for dial up tunnel clients outside of mode-cfg.