DHCP relay not forwarding DORA messages

[adramelech]

Hi, we have a Fortigate 60C 4.0 MR3 with remote locations connected via VPN through wan2 interface. On site where is the Fortigate, we have multiple VLANs configured with the unit used for inter-VLAN routing. In one of the VLANs there is a DHCP server. All VLANs are connected via trunks to the internal interface. DHCP relay is configured for internal interface, where is a user VLAN, and it works perfectly. On the other hand, the same DHCP relay settings are configured for wan2 interface and it doesn' t work. By sniffing traffic I realised that DHCP Discovery packages come into the Fortigate via wan2, but they don' t enter the DHCP server VLAN. The only DHCP traffic that goes egress or ingress to the DHCP server VLAN is from the user VLAN connected locally. I have to add that all traffic is allowed, with DHCP traffic been given high priority. All other traffic normally travels from one end to the other, it just looks like DHCP relaying isn' t even turned on for that interface. Anyone have any clues on this situation? I would really appreciate any thoughts on the subject :)

[rwpatterson]

Welcome to the forums. On the unit where the DHCP traffic needs to go to another VLAN, enable the DHCP helper. It' s in the same location as the DHCP server, just on that particular VLAN.

[adramelech]

Thanks for the welcome and replay. By DHCP helper do you mean DHCP relay agent? It already is enabled like in the following example: edit wan2 (interface from where DHCP Discovery messages originate) set dhcp-relay-service enable set dhcp-relay-ip 1.2.3.4 (DHCP server address)

[rwpatterson]

That is indeed what I was referring to. When I had to set up DHCP relay through my FGTs, I pointed to the next hop device (and not the end server, which was just beyond that router) and had to build a policy in that router to forward DHCP requests onto the server on the LAN. Your mileage may vary.

[adramelech]

In my case, on the remote side (there' s a MikroTik router) the router is statically routed via MPLS (about two hops away) to the FGT and has a DHCP helper configured for the actual DHCP server. Should the MikroTik maybe be configured differently? I have a feeling that something is wrong with the FGT configuration because as I said, ingress traffic from wan2 holds DHCP Discovery messages...they just don' t go to the DHCP server VLAN.

[rwpatterson]

Not sure. Not a pro with DHCP... Just know that when I pointed the helper to my server, it didn' t work. I had to point to the layer 3 router and add an ACL to redirect the packets to the LAN server. *** CORRECTION *** I just re-looked... I did point to the server, but I had to enable DHCP packet relay on the layer 3 router.

[adramelech]

Well all of that is enabled as it should be. Everything is set up as it should be. So you can see my dilemma...it should work , but it doesn' t. DHCP messages come on the wan2 ingress but don' t pass to the server VLAN egress. All other traffic normally flows from wan2 to server VLAN interface...even have a policy for DHCP to pass with high priority. But locally, for a user VLAN it works like a charm, with literally identical settings.

[rwpatterson]

Are you sniffing the traffic on the FGT or the next device down the line?

[adramelech]

On the FGT

[adramelech]

Just an update, it finally worked. The problem was in the 4.0 MR3 firmware. After upgrading to v5.0 GA patch 4, it worked from the very first moment. Also, the firmware fixed some other bugs such as not seeing some logs, etc. But that' s another topic.