DHCP Server Issues

[MontanaMike]

This should be a no brainer but I'm having issues with a Fortigate 220B running 5.2.9.   I have the "switch" interface set to DHCP on the same subnet as the "switch" interfaces IP address and yet it's not giving out addresses.  What am I missing??  I've set up a ton of these but for can't seem to make this one work.  I have the switch and laptop in an isolated environment, directly connected to each other so there is no external interference.  If I manually set the IP address on the workstation, it works normally.  Any help would be much appreciated.

Interface Config:

config system interface edit "switch" set vdom "root" set ip 192.168.1.1 255.255.255.0 set allowaccess ping https ssh set type physical set snmp-index 11 next end

DHCP Config:

config system dhcp server edit 1 set dns-service default set ntp-service default set default-gateway 192.168.1.1 set netmask 255.255.255.0 set interface "switch" config ip-range edit 1 set start-ip 192.168.1.10 set end-ip 192.168.1.254 next end set timezone-option default next end

[MikePruett]

The laptop is directly connected to the FortiGate or does it have a switch between it and the Gate?

[MontanaMike]

Directly connected.

[rwpatterson]

Silly question: Does the laptop with the same cable work successfully elsewhere? Also do other devices fail as well?

[MontanaMike]

I've swapped the cables with the same results.  Now I'm beginning to suspect the laptop because in the GUI on the Fortigate, I get this image (below) however the laptop is still reporting a Microsoft 169 address and cannot connect to the firewall or any other resource.  Windows Firewall is off btw.

[rwpatterson]

That's sort of where I was going. Test the laptop before your place blame to the 40Gate. Try something else perhaps.

[MontanaMike]

I wasn't trying to blame the Fortigate.  Anyway, all 3 of the laptops I tried get the same result.  No address give out by the firewall and an entry in the FGTs "DHCP Monitor" page.  I've also tried all 8 ports on the "switch" interface of the firewall.

Still looking for a solution...

[MontanaMike]

I've also tried turning up a DHCP server (in different subnets) on other interfaces (example: port9)  and I get the same results.

[Toshi_Esumi]

First I would run wireshark on one of laptops to make sure DHCP request is coming out (udp.port==67, or 68), Second run sniffer on the FG to see if it's sending something back. If it's receiving but not sending replies, I would run application debug for "dhcps".

[MikePruett]

yeah, do a packet capture and dig in. Doing a diag deb on dhcp too and see if the gate will tell you anything