DHCP server does not provide IP

[FransUrbo]

I've setup a DHCP server pool to provide 10.0.1/24 and 10.0.4/24 on one of my interfaces. But I can't get an IP on one of my hosts! I see that the requests leaves the host and (something) is received by my Fortigate running "FortiOS v5.6.6 build1630 (GA)" on a "FortiGate 50E" running in NAT mode. But it won't hand out an ip.

The config is just a snippet from my real config, not the whole thing. But I've checked and double checked all MAC addresses etc and they are correct. Not sure what more I should include, but ask and I'll provide.

 

[Toshi_Esumi]

The secondary subnets are all on the same broadcast domain with the primary. I wouldn't expect the FGT looks up the second DHCP scope. (I'm waiting somebody says "you're wrong" :)

[emnoc]

I don't believe that's the issue. Is the DHCP-server status enabled? Typically if the DHCP-request comes in and nothing given is a sign the dhcp-server is not enabled.

find the pid and  kickstart it and if no pid, than set the status for the dhcp server to "enable"

http://socpuppet.blogspot...on-or-any-daemons.html

Ken Felix

[ede_pfau]

I would also suspect that all 4 DHCP servers are seeing the request from the same MAC address and are withholding an offer because of that. You can easily test this by removing 3 of the 4 DHCP servers.

Instead of secondary addresses you could configure VLANs to avoid using the same broadcast domain.

[FransUrbo]

Setting up VLANs on Linux is always such a pain! But even if I did that, I "only" need it to do PXE boots, and there's no way to setup VLANs in the firmware of my ancient HP machines.

[FransUrbo]

Was running and HUPping it didn't help...

[FransUrbo]

What do you mean by "the same broadcast domain with the primary"?

But even if I delete all but the 10.0.4/24 server entry, still doesn't work. Same as before - dhclient asks and FGT still receives the request but doesn't respond to it.

[Dave_Hall]

@OP Is your test machine connected directly to the fgt or going through a switch?  If through a switch could the switch ports have DHCP snooping enable?

[emnoc]

One other  items. The use of secondary is bad and just for this reason. With a slight change of the layer3 interfaces and design you could eliminate the big mess with  secondaries.

e.g 

config system interface [...] edit "cluster" set vdom "root" set ip 10.0.7.254 255.255.253.0 set allowaccess ping set type hard-switch set scan-botnet-connections block set explicit-web-proxy enable set explicit-ftp-proxy enable set description "OpenStack Cluster" set stp enable set device-identification enable set role lan set snmp-index 6 set secondary-IP enable config secondaryip edit 1 set ip 10.0.1.254 255.255.255.0 set allowaccess ping next end

config system dhcp server edit 1 set mac-acl-default-action block set dns-service local set ntp-service local set domain "openstack.bayour.com" set default-gateway 10.0.8.254 set netmask 255.255.253.0 set interface "cluster" config ip-range edit 1 set start-ip 10.0.4.1 set end-ip 10.0.6.254 next end set timezone-option default set tftp-server "10.0.4.253" set filename "pxelinux"

Just my  two cents, but again check that the  dhcp server is  enabled in your config

     set status enable iirc

Ken Felix