DHCP relay in SD-WAN deployment

[Jirka1]

Hello,

1x HQ and 15x branch.
Each branch has 2x SD-WAN Zones (one for wan1 a wan2 and second for IPsec1 and IPsec2 to the HQ). All traffic is sent through HQ.
AD server, DHCP and DNS is running at the HQ and a DHCP relay is set up at each branch. Unfortunately, I do not know how to achieve that the DHCP relay can use both IPsec tunnels (e.g. when the primary line/tunnel fails).

I tried all the settings according to the KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-DHCP-relay-traffic-to-use-SD-WAN... but the only working solution was 100% work that I defined the interface manually (either primary or backup tunnel).

If I use the set dhcp-relay-interface-select-method sdwan option, the requests are sent randomly to the SD-WAN interface where the WAN lines are.

If I use the set dhcp-relay-interface-select-method auto option, requests are sent randomly to all SD-WAN interfaces, resulting in sometimes it works and sometimes it doesn't.

How to solve this (and define) which SD-WAN zone should be used for these requirements?

FortiOS 7.0.11

Thank you.

Jirka

[srajeswaran · Accepted solution]

This is being tracked under 864626. Fix is already available from 7.2.0 and is expected in upcoming 7.0 releases.

864626

FortiGate local traffic does not follow SD-WAN rules.

https://docs.fortinet.com/document/fortigate/7.2.0/fortios-release-notes/289806