DHCP reservation

[ITadm]

Hello, 

 I've got a Fortigate 30E Firewall and I need to create some reservations on one of my VLANS. The idea is to use DHCP reservations as a sort of ACL so only hosts with known MAC addresses can get access to this VLAN.

Previously I was using watchguard and I could set DHCP range to for exapmle: 192.168.1.200 - 192.168.1.200 and make reservations up to 192.168.1.254.

In FortiOS I can't do it this way and the IP range of DHCP has to be exactly the same as number of reserved addresses, it creates some issues, because in my network it looks like this:

192.168.1.129/25

192.168.1.130-140 - warehouse workstations

192.168.1.141-150 - warehouse printers

192.168.1.151-160 - office workstations

192.168.1.161-170 - office printers 

and so on

So, when I was adding for example an office workstation I could make a reservation for address 192.168.1.155 and I didn't have to block unused addresses. Now I can't split it nicely, but I have to make a stack of addresses with all connected devices like 192.168.130-160 and when I add an office printer I need to extend DHCP range to 192.168.161 and it's a little bit too messy for me. 

I hope I didn't overcomplicate it and you get my point. My question is: do you have any ideas how I can keep the IP addressing structure of my network without leaving empty addresses in DHCP?

[ede_pfau · Accepted solution]

hi,

all addresses, assigned and reserved, need to be contained within the DHCP range.

I suggest the following:

- in Network>Interface>(internal)>DHCP>Advanced, you've got a table called 'MAC Reservation + Access Control'. The last line is for all DHCP requests which are not listed as reserved. By default, these are assigned an IP address. You can toggle that to 'block' requests from unknown MAC addresses. Double click the line to edit.

[ede_pfau · Accepted solution]

hi,

all addresses, assigned and reserved, need to be contained within the DHCP range.

I suggest the following:

- in Network>Interface>(internal)>DHCP>Advanced, you've got a table called 'MAC Reservation + Access Control'. The last line is for all DHCP requests which are not listed as reserved. By default, these are assigned an IP address. You can toggle that to 'block' requests from unknown MAC addresses. Double click the line to edit.

[ITadm]

Thanks, I didn't spot this option :) ! How about static IP addresses? It should block only DHCP requests and static should work fine, right?

[ede_pfau]

Correct, this does only relate to DHCP dynamic assignment. If you use static addresses as well it's up to you to avoid address conflicts. DHCP will test if an address is already active on the network and will not offer it a second time. If that was (by incident) a reserved address you'd be out of luck.

[lobstercreed · Accepted solution]

I have run into almost exactly the OP's issue, and while Ede's solution works great if *all* addresses are specifically reserved or static, it doesn't work if you want to just carve some space at the end of your range for guests and such. In this case what I did (somewhat tediously, but through CLI because it was easier) was to reserve every single address in my specific ranges with fake MAC addresses.  Like AA:AA:AA:AA:AA:AB for one, AA:AA:AA:AA:AA:BB for the next, etc.  Then when I needed to actually assign the address, I edited it to the right MAC.

- Daniel