Issues with DHCP Relay following upgrade to 7.4.3 on 40F and 7.4.2 on Fortiswitch 124F

[Martin_Hancock]

Hello

I have recently upgraded my Fortigate 40F unit to 7.4.3 and associated Fortiswitch 124F connected with Fortilink to version 7.4.2

Ever since i have done this my DHCP relay no longer works.  DHCP from the Fortigate interfaces work fine but when i enable DHCP relay there is no DHCP response and i cannot see any DHCP traffic being forwarded to my DHCP server.  I can ping my server with no issue.

Any assistance would be helpful.

[AEK]

Hello Martin

Do you have on your FortiGate any IP pool that includes the DHCP server's IP in its range? (check under Policy & Objects > IP Pools).

E.g.:

• DHCP server's IP: 10.0.0.5
• IP pool: 10.0.0.1-10.0.0.8

If this is the case then you may need to disable the "ARP Reply" in that IP pool.

[hbac]

Hi @Martin_Hancock,

Please refer to this article https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-DHCP-relay-issue/ta-p/215535

Regards, 

[Martin_Hancock]

hi @hbac

I have also followed those instructions with no success.  I have also logged a support ticket with Fortinet as well as everything was working perfectly prior to upgrading the firmware on both the fortiswitch and the Fortigate

I have also checked the IP pools - none exist.

[hbac]

@Martin_Hancock,

Did you find anything from the debugs? We need to make sure FortiGate is receiving DHCP requests and forwarding it to the DHCP server. 

Regards, 

[Martin_Hancock]

Hi @hbac

I have the following logs and this is where it stops

2024-02-21 10:56:05 Insert option(82), len(14)
2024-02-21 10:56:05 found route to 192.168.1.2 via 192.168.6.254 iif=20 oif=17/PlanB-WAN, mode=auto, ifname=
2024-02-21 10:56:05 (xid:d206fe7a) forwarding dhcp request from 192.168.6.254:67 to 192.168.1.2:67
2024-02-21 10:56:09 (xid:d206fe7a) received request message from 192.168.6.116:68 to 255.255.255.255 at FS_WintonLAN
2024-02-21 10:56:09 (xid:d206fe7a) got a DHCPREQUEST
2024-02-21 10:56:09 (xid:d206fe7a) Warning! can't get server id from client message
2024-02-21 10:56:09 Insert option(82), len(14)
2024-02-21 10:56:09 found route to 192.168.1.2 via 192.168.6.254 iif=20 oif=17/PlanB-WAN, mode=auto, ifname=
2024-02-21 10:56:09 (xid:d206fe7a) forwarding dhcp request from 192.168.6.254:67 to 192.168.1.2:67

When i run a packet capture on the PC the DHCP request is sent to my Fortigate and then nothing else happens.

[AEK]

Hi Martin

Can you sniff traffic on DHCP server 192.168.1.2 to see if it receives DHCP requests forwarded from FG?

Also this command from FG will show if packets are really forwarded to DHCP server from the right interface.

diag sniffer packet any "port 67 or port 68" 4 

[Martin_Hancock]

I ran the packet sniffer and the DHCP traffic is definitely going out the correct interface - it is going out my WAN interface

AWS-WINTON # diagnose sniffer packet any "port 67 or 68" 4
interfaces=[any]
filters=[port 67 or 68]
80.874356 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
80.874618 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
80.874627 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
83.878144 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
83.878343 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
83.878353 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
85.886799 FS_WintonLAN in 192.168.6.116.68 -> 192.168.6.254.67: udp 334
85.886979 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
85.886987 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
89.889325 FS_WintonLAN in 192.168.6.116.68 -> 255.255.255.255.67: udp 334
89.889580 PlanB-WAN out 192.168.6.254.67 -> 192.168.1.2.67: udp 350
89.889590 wan out 192.168.6.254.67 -> 192.168.1.2.67: udp 350

[AEK]

@Martin_Hancock 

But I see there is no response from server. Then I think there must be some troubleshooting from DHCP server side.

• First I'd sniff on DHCP server too see if the DHCP queries are reaching the interface and if response is leaving the interface 
• I'd enable more DHCP service debug on DHCP server to see what's happening there

So far I suspect that there is something in FOS 7.4.3's forwarded queries that your DHCP server doesn't like. But we need some log evidence.

On the other hand can you share your DHCP relay config on FortiGate?

[Martin_Hancock]

Hi @AEK 

I have already carried out a packet sniff on the DHCP server and it seems that the packets are not reaching it.  The strange thing is that i have other sites that are running Fortigate 40F models and they get their IP address via DHCP relay over the WAN with no issue but these sites do not have Fortiswitches in them.

This is the config of my DHCP relay

set vdom "root"
set dhcp-relay-service enable
set ip 192.168.6.254 255.255.255.0
set allowaccess ping https http
set alias "AWS Winton LAN"
set role lan
set snmp-index 8
set dhcp-relay-ip "192.168.1.2"
set interface "fortilink"
set vlanid 6