DHCP service in Fortigate

[unknown1020]

Good afternoon friends, could you help me with this query:

In the events of my FG I am visualizing at all times the following related to DHCP:

*DHCP server sends a DHCPACK
*DHCP server 3 has used up all of its leases
*DHCP server 3 has used up over 80% of its leases

I would like to know what those 3 events mean?

Since today some users in the office were reporting that they did not have internet service, this was generated because the DHCP server of the Fortinet equipment did not deliver ip addresses.

I would like to know if these 3 events are related to the loss of internet connection reported.

[AndyNZ]

Hi,

"DHCP server sends a DHCPACK" is simple acknowledgement that a DHCP request has been received and a response sent. That is normal and what you should expect to see during normal DHCP operation.

"DHCP server 3 has used up over 80% of its leases" is a warning that the pool of IP addresses the DHCP server can allocate from is nearly exhausted.

"DHCP server 3 has used up all of its leases" is confirming that no more IP addresses are available so a DHCP request cannot be responded to with an IP address.

"DHCP server 3 has used up all of its leases" will likely correlate with the start of your internet access problems.

You need to look at the DHCP server configuration (either from the GUI or CLI). There are two variables:-

- the number of IP addresses in your DHCP pool (specified as a range of addresses in the DHCP server settings

- the lease time of your IP addresses.

The IP Pool range for the DHCP server is specified in the configuration. The range needs to be big enough to allow one IP address for each concurrent device on your network (laptops, phones etc).

If you are using an address pool limited to 8 bits (eg something line 192.168.0.1/24) then you have 252 IP addresses maximum (depending how you set the IP range for the DHCP server). If you are likely to have more concurrent devices then you need to use a bigger IP pool (perhaps a /16?).

The lease time is also critical. If you have long lease times (eg the default DHCP server value for Fortigates is 604800 seconds or 7 days) then that IP address is allocated to the device for the lifetime of that lease). Once an IP address is allocated even if the device leaves the network that IP address is not available to be reused.

Typically a lease time of something like 7200 seconds (2 hours) is usually fine. DHCP renewal does not impact network traffic that much. A lease time around the two hour mark is sensible and allows IP addresses to be reused as people come and go. This is particularly important in businesses like cafes where guest users stay a while and then leave. If lease times are long that IP address is blocked until it expires.

Hope that helps.

Andy.