We have the following setup:
A FortiGate router in the middle of the network with few cisco switches, which host several VLAns.
Also we have a MS SCCM server in vlan 10 and a bunch of workstations in vlan 20, which should be booted trough PXE/SCCM and network install the OS.
So far we installed IP and DHCP on vlan 20, the PCs go till getting an IP address, but the SCCM boot and install is failing with "no boot device detected". How may I setup an working environment - the DHCP should stay on FortiGate. I tried to put ip helper-address on cisco in vlan 20, but that did not helped.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Is the FortiGate doing the inter-VLAN routing? Or is the Cisco?
If the FortiGate is doing the routing you need to ensure there is a FW policy allowing the PXE Boot traffic.
Do you know what protocol/ports the PXE boot is using? DO you need to make any special DHCP server configurations to make it work? Have you done that?
Yes, the FortiGate is doing the routing and there is a rule, allowing the traffic.
And the rest of my questions?
Do you know what protocol/ports the PXE boot is using? DO you need to make any special DHCP server configurations to make it work? Have you done that?
To be honest I have no idea - this is a standard laptop, which uses PXE boot from the boot menu. I believe it is using DHCP and then TFTP to download the files needed.
But this is completely different to the previous setup, where we have a IP Helper targeting the DHCP and SCCM server, which worked without problems. We have replaced the CISCO inter-vlan routing with the Fortigate device.
Given this is a Fortinet support forum we can't really help you with your SCCM and PXE boot configs. You'll need to know what the requirements are for those to work before we can help you on the FortiGate side—if it even is a FortiGate issue.
Has your DHCP server changed? Was it on the Cisco before? What was/is the DHCP config options?
Have you confirmed TFTP is being used? Have you seen policy hits on the FortiGate? Have you looked at packet caps/sniffers?
Hi Graham,
For PXE to work with SCCM we need a SECOND IP helper, next to the DHCP IP helper.
This is because the DHCP scope options are officially not support by Microsoft.
(I know it works, but running unsupported configs is never a good idea)
PXE clients don't start - Windows Server | Microsoft Learn
You can set an EXTRA IP helper on Cisco with cli: Router(config-if)# ip helper-address 172.16.1.2
On a Checkpoint with: set iphelper 172.16.1.2
What is the Fortinet equivalent of these commands?
Kind regards,
Wietse van Assema
Can you tell us how the above is done on a Fortinet
It is very simple to do the same on FortiGate:
The only solution I have found is to use the CISCO switch and define ip helper addresses.
The drawback - you have to define IP address of the switch in the same VLan, which is a security issue and we cannot use the FortiGate itself to do the ip helper, which is NOT OK!
You can absolutely use FortiGate to do DHCP relay (helper):
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.