DHCP not working with Fortiswitch in managed mode

[fl0at0xff]

Hello all, 

I installed a Fortiswitch 448D-POE running 3.5.4 in managed mode with a Fortigate 61E running 5.4.4 and I have some troubles with DHCP server that runs on my different VLANs. The Fortiswitch is configured to use Fortigate Fortilink interface as NTP server and the Fortigate correctly listen on Fortilink for NTP protocole. My clients are unable to get an IP address until there is not internet connection. It is very strange.

The DHCP is set on the VLAN interface of the Fortigate. I have vlan 200 which is a sub-interface of the dedicated link to fortiswitch. the subnet is 192.168.201.0/24.  For the moment we don't want to have a external DHCP server. It should work with Fortigate.  When we don't have internet access, the client are unable to get an IP address and receive a 169.254....

I made some debug and I can see the DHCP DISCOVER that reach the Fortigate, and then I can see the DHCP OFFER sent by the Fortigate but the client never receive it. In the fortigate, in the DHCP Monitor, I can see the leases... I really think that the problem is on the switch level.

Thanks for your help.

[johnlee_FTNT · Accepted solution]

Hi fl0at0xff

I hope it is not too late, but found this myself whilst working on a lab.

You need to go to the VLAN interface and disable dhcp snooping.

Example:

config system interfaceedit “xxxxxxx”set vdom "root"set allowaccess pingset role lanset snmp-index 54set switch-controller-dhcp-snooping disableset interface "fortilink"set vlanid 140nextEnd

[tanr]

Which FortiOS version are you referring to?  I don't see a switch-controller-dhcp-snooping field in 5.4.x.

[johnlee_FTNT]

Hi tanr

This was found with Bug ID 415380

DHCP snooping enabled on FortiSwitch VLAN interfaces may prevent clients from obtaining addresses through DHCP. Workaround: disable switch-controller-dhcp-snooping on FortiLink VLAN interfaces.

The above is available with the FortiOS 5.6.1 release notes.

https://docs.fortinet.com/uploaded/files/3879/fortios-v5.6.1-release-notes.pdf

It states that the bug was identified with switches running 3.5.3 build 271 where, with FortiLink configured with a FortiGate running 5.6.0 code found the DHCP request sent to the FortiGate was being received and FortiGate responded but the response never makes it back to the client.

This is fixed with FortiSwitch 3.5.4, 3.6.0 code I believe. Note that dhcp snooping is enabled by default and may need to configure this to be disabled to allow 

https://docs.fortinet.com/uploaded/files/3880/managed-fortiswitch-561.pdf

[fl0at0xff]

Hello and thank you for your answer.

It is a little to late because I already installed the devices but I keep your advice and will try to buy a fortiswitch for testing purpose and remake some test. maybe with new version, the problem is solved.

BR