Routing Problem to DHCP Relay

[RolandBaumgaertner72]

Hi,

we would like to use a DHCP Relay server in our data center for all offices and we tried in office A and it is not working.

In office A we configured SSIDs > DHCP Server ON, mode Relay, Type Regular, DHCP Server IP 128.1.98.66. Now trying in this network I should get 100.100.1.0/24 from the Relay Server but the client gets no IP. The IP of the SSID on this FG is 100.100.1.1/24

So when I try to connect and check with Sniffer on the FG office A for the IP 128.1.98.66 I get:

808.308257 wan1 out 100.100.1.1.67 -> 128.1.98.66.67: udp 363
812.686235 wan1 out 100.100.1.1.67 -> 128.1.98.66.67: udp 363
821.055159 wan1 out 100.100.1.1.67 -> 128.1.98.66.67: udp 363

The FortiAPs in this Office A are connected to Wifi Network with 128.1.150.1/24 and the APs have .5/6/7/8.

I route the 100.100.1.0 traffic via the MPLS connection. The same on the FG in the data center. Also policies whould be fine.

Any ideas, maybe we just dont understand the scenario.

Thanks!!

[AEK]

Hi Roland

Is there NAT between FG and DHCP server?

Or is there a public IP on WAN1 interface as secondary IP address?

[ozkanaltas]

Hello @RolandBaumgaertner72 ,

As far as I remember, if you wanted to pass DHCP relay packets through L3 router devices, you had to configure a helper on all devices on the route. Maybe that's why relay packets are not reaching through your MPLS network.

If you have a chance to try it, can you set up an ipsec tunnel between two sites and try it?

[RolandBaumgaertner72]

Hi,

from Office A to data center we have a MPLS connection and in both polices we have activated NAT.

Any suggestions?

Thanks!

[AEK]

Hello

So if I understand well the NAT is at FG level, not at another device between FG and DHCP server, right?

In this case I think there should be a solution if you can source the DHCP relay packets with the public IP. Let me try find if FG can do that.

[ebilcari]

As I know you can't use NAT with DHCP helper. The DHCP request should be sourced by the Gateway of the hosts. That source IP is used by the DHCP server to find the right pool of addresses to offer the lease.

The DHCP helper role need to be configured only on the gateway that will transform the broadcast request to unicast request that can be routed (multi hop) until they reach the DHCP server.

[RolandBaumgaertner72]

I am wondering how this should work. APs connected to network WIFI with 128.1.150.1. The SSID from this WIFI has 100.100.1.1/24 and should get DHCP from server 128.1.98.66 which is connected via WAN1 (MPLS) to our data center.

[sw2090]

you could do packet capturing on the client (or the interface of the FGT) and filter that by dhcp to see wether the client gets answers from your relay or not.

[fricci_FTNT]

Hi @RolandBaumgaertner72 ,

Is the server 128.1.98.66 receiving the requests from the Fortigate and replying?
Is there any DCHP snooping configured somewhere in your network that could drop unauthorised DHCP packets?
You can run a packet capture on the DHCP server 128.1.98.66 (or a switch attached to that server) and the FortiGate at the same time.

Best regards,