Hello
I have recently upgraded my Fortigate 40F unit to 7.4.3 and associated Fortiswitch 124F connected with Fortilink to version 7.4.2
Ever since i have done this my DHCP relay no longer works. DHCP from the Fortigate interfaces work fine but when i enable DHCP relay there is no DHCP response and i cannot see any DHCP traffic being forwarded to my DHCP server. I can ping my server with no issue.
Any assistance would be helpful.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hello Martin
Do you have on your FortiGate any IP pool that includes the DHCP server's IP in its range? (check under Policy & Objects > IP Pools).
E.g.:
If this is the case then you may need to disable the "ARP Reply" in that IP pool.
Hi @Martin_Hancock,
Please refer to this article https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-DHCP-relay-issue/ta-p/215535
Regards,
hi @hbac
I have also followed those instructions with no success. I have also logged a support ticket with Fortinet as well as everything was working perfectly prior to upgrading the firmware on both the fortiswitch and the Fortigate
I have also checked the IP pools - none exist.
Did you find anything from the debugs? We need to make sure FortiGate is receiving DHCP requests and forwarding it to the DHCP server.
Regards,
Hi @hbac
I have the following logs and this is where it stops
2024-02-21 10:56:05 Insert option(82), len(14)
2024-02-21 10:56:05 found route to 192.168.1.2 via 192.168.6.254 iif=20 oif=17/PlanB-WAN, mode=auto, ifname=
2024-02-21 10:56:05 (xid:d206fe7a) forwarding dhcp request from 192.168.6.254:67 to 192.168.1.2:67
2024-02-21 10:56:09 (xid:d206fe7a) received request message from 192.168.6.116:68 to 255.255.255.255 at FS_WintonLAN
2024-02-21 10:56:09 (xid:d206fe7a) got a DHCPREQUEST
2024-02-21 10:56:09 (xid:d206fe7a) Warning! can't get server id from client message
2024-02-21 10:56:09 Insert option(82), len(14)
2024-02-21 10:56:09 found route to 192.168.1.2 via 192.168.6.254 iif=20 oif=17/PlanB-WAN, mode=auto, ifname=
2024-02-21 10:56:09 (xid:d206fe7a) forwarding dhcp request from 192.168.6.254:67 to 192.168.1.2:67
When i run a packet capture on the PC the DHCP request is sent to my Fortigate and then nothing else happens.
Hi Martin
Can you sniff traffic on DHCP server 192.168.1.2 to see if it receives DHCP requests forwarded from FG?
Also this command from FG will show if packets are really forwarded to DHCP server from the right interface.
diag sniffer packet any "port 67 or port 68" 4
I ran the packet sniffer and the DHCP traffic is definitely going out the correct interface - it is going out my WAN interface
AWS-WINTON # diagnose sniffer packet any "port 67 or 68" 4
interfaces=[any]
filters=[port 67 or 68]
80.874356 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
80.874618 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
80.874627 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
83.878144 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
83.878343 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
83.878353 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
85.886799 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
85.886979 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
85.886987 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
89.889325 FS_WintonLAN in 192.168.6.116.68 -> 255.255.255.255.67: udp 334
89.889580 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
89.889590 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
But I see there is no response from server. Then I think there must be some troubleshooting from DHCP server side.
So far I suspect that there is something in FOS 7.4.3's forwarded queries that your DHCP server doesn't like. But we need some log evidence.
On the other hand can you share your DHCP relay config on FortiGate?
Hi @AEK
I have already carried out a packet sniff on the DHCP server and it seems that the packets are not reaching it. The strange thing is that i have other sites that are running Fortigate 40F models and they get their IP address via DHCP relay over the WAN with no issue but these sites do not have Fortiswitches in them.
This is the config of my DHCP relay
set vdom "root"
set dhcp-relay-service enable
set ip 192.168.6.254 255.255.255.0
set allowaccess ping https http
set alias "AWS Winton LAN"
set role lan
set snmp-index 8
set dhcp-relay-ip "192.168.1.2"
set interface "fortilink"
set vlanid 6
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1688 | |
1087 | |
752 | |
446 | |
227 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.