DHCP servers in VLANs

[jfernandz]

I'm curious ... if I create two VLANs interfaces (attached to a particular physical interface, of course) and I enable for them the DHCP server, how are IPs for connected devices issued? I mean, I just can connect a host/device/client to the physical interface, so ... which DHCP would issue the IP for this host recently connected?   

Thank you all.

[sw2090]

If you configure a DHCP Server on a FGT it is always tied to an interface - either physical,switch or vlan interface :)

THat means that DHCP will onl listen on the interface it is tied to.

So e.g. only a client that comes from out of vid1 via vlan vid1 interface will get an ip from a dhcp configured on vlan vid1 interface.

Annother DHCP for annother vlan will not see this request because it doesn't hit the interface it is listening on.

[jfernandz]

sw2090 wrote:

If you configure a DHCP Server on a FGT it is always tied to an interface - either physical,switch or vlan interface :)

THat means that DHCP will onl listen on the interface it is tied to.

So e.g. only a client that comes from out of vid1 via vlan vid1 interface will get an ip from a dhcp configured on vlan vid1 interface.

Annother DHCP for annother vlan will not see this request because it doesn't hit the interface it is listening on.

What's `vid1 interface`?  My point is these two client will be connected to the same physical interface, so how would each DHCP for each VLAN distinguish to which VLAN does the client want to connect to? 

   

[sw2090]

vid1 interface is an interface configured for vlan id 1. Just as example.

In fact if the clients are in different vlans they are connected to the same PHYSICAL interface, though the FortiGate threats a vlan as a virtual interface. So traffic will come in via the PHYSICAL interface but it will hit the corresponding VIRTUAL vlan interface accoarding to vlan id in the packet. Only traffic that does not have a vlan id will hit the PHYSICAL interface.

And your DHCP Servers on the FGT will be tied to the virtual vlan interfaces...

[jfernandz]

Oh, so apparently the key is the VLAN ID, so the thing is in the managed switches, I think now I can see the point. 

You connect a host/device/client to a particular port in a managed switch, which is tagged with a specific VLAN ID, so when packages go from this host to the fortigate through that port, the fortigate is able to recognize which VLAN interface are those packages owned by, right?

[sw2090]

that's the usual way. Except from the port on the managed switch should indeed be untagged in that specific vlan id. If it were tagged the client would have to append the vlan tag and the switch would just handle it. If the port is untagged the switch will rewrite (if there is) or append (if there is not) the vlan id.

Unfortunately most embedded devices e.g. don't support vlan tagging on their own. And even on on windows that's driver depedent and may require manufacturer tools.

Linux handles that from out of stock though.

[jfernandz]

Oh, so that's the point of Tagged/Untagged

- When a port is set as Tagged, it expects the packages are tagged for the clients/hosts themselves and the managed switch doesn't handle the tags

- When a port is set as Untagged, it doesn't expect the package are tagged but the managed switch tags the packages that are coming through, or in the case the package was tagged, it replaces the tag.

This is a good point because it's apparently a little counterintuitive. 

Anyway ... thank you very much, you helped me to understand more about networking.

[sw2090]

you got it and

yes it is counterintuitive :)

Took my own dumb self a while to get it too when I first got in touch with it :)

Btw vlan interfaces on ports of a FGT are always tagged!

The rest depends on the switch. They all support a port being tagged in more than one vlan but e.g. HP supports a port being untagged in only one vlan and also requires this! So if there is no vid the port is tagged in on a hp switch it will be tagged with the untagged vlan on that port! One should keep this in mind :)