Obtaining new DHCP leases over a Fortigate InterVDOM link - is it possible ?

[championc1]

I have created an InterVDOM link on my firewall (7.4.7), and it can renew existing leases, but I canot seem to be able to get any config which will enable new leases to be obtained / given

The topology is a remote site has a VPN back to HQ.  The remote site has DHCP Relays configured, pointing to DHCP servers on the LAN.  The setup works perfectly when routing the traffic from our VPN vdom to our LAN vdom over the internal switching.  But once I try and route the traffic over an InterVDOM link, all traffic other than new DHCP leases work.  As soon as I disable the policy routes, the DHCP and everything else works.

[Toshi_Esumi]

You just told the cause yourself. Why do you have the policy routes and what are the policy routes doing?

Toshi

[championc1]

I can't have all traffic using the link.  I only want to initially test with just one site out of maybe 20 sites

[AdaCasper]

It sounds like the issue lies in how DHCP broadcasts are handled across the InterVDOM link. While your existing leases can be renewed—likely using unicast—new DHCP lease requests rely on broadcast traffic, which is typically not forwarded across VDOMs unless explicitly configured.

[championc1]

So how can I explicitly configure forwarding these broadcasts please ?  Any suggestions ?

[AdaCasper · Accepted solution]

1. Use DHCP Relay Across the VDOMs
   On the VDOM that’s receiving the DHCP requests (e.g., VPN VDOM), configure a DHCP relay that points to the DHCP server in the other VDOM (e.g., LAN VDOM). However, since the VDOMs are separated, this requires allowing the DHCP relay packets to traverse the InterVDOM link.

   Create Firewall Policies for UDP Port 67/68
   Make sure you've created firewall policies between the VDOMs that allow UDP traffic on ports 67 and 68 (used by DHCP). Without this, relay traffic might be blocked even if it looks like it's passing.

   Use a VLAN or Interface with DHCP Relay at the Border
   If possible, create a dedicated interface or VLAN that acts as a border between VDOMs and runs the DHCP relay agent there, so it can bridge the requests cleanly.

   Alternative: Use IP Helper on L3 Device
   If your FortiGate allows CLI configuration of DHCP relay at the system level (not just interface level), you might be able to use the config system dhcp relay CLI command and assign the source interface/IP accordingly.

[championc1]

I'm getting an error when trying to save the Vlan Interface

Value parse error before 'vdom-link1'.