Ensuring that Clients will only be getting IPs from authorized DHCP server

[heyyo]

Hi Team,

Wanted to work on protecting the network from DHCP snooping. FortiGate acts as DHCP server. The plan is to block DHCP request from malicious or unauthorized DHCP server. How can this be achieved?

Note that I do not have a FortiSwitch in place.

Will using a local in policy to block the traffic help?

Thank you in advance!

[sw2090]

Since DHCP is udp broadcasting that can only work within a subnet/Interface (except if you relay it) this is so called net-internal-traffic. That will not hit any policy. Your FGT will just receive the broadcasted DHCPDISCOVER and answers it with a DHCPOFFER. 

I don't think there is any way to filter that.

[AEK]

Hi Heyyo

You just need to enable and configure DHCP snooping on your access switch.