Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
RolandBaumgaertner72
Contributor

Routing Problem to DHCP Relay

Hi,

 

we would like to use a DHCP Relay server in our data center for all offices and we tried in office A and it is not working.

 

In office A we configured SSIDs > DHCP Server ON, mode Relay, Type Regular, DHCP Server IP 128.1.98.66. Now trying in this network I should get 100.100.1.0/24 from the Relay Server but the client gets no IP. The IP of the SSID on this FG is 100.100.1.1/24

 

So when I try to connect and check with Sniffer on the FG office A for the IP 128.1.98.66 I get:

808.308257 wan1 out 100.100.1.1.67 -> 128.1.98.66.67: udp 363
812.686235 wan1 out 100.100.1.1.67 -> 128.1.98.66.67: udp 363
821.055159 wan1 out 100.100.1.1.67 -> 128.1.98.66.67: udp 363

 

The FortiAPs in this Office A are connected to Wifi Network with 128.1.150.1/24 and the APs have .5/6/7/8.

 

I route the 100.100.1.0 traffic via the MPLS connection. The same on the FG in the data center. Also policies whould be fine.

 

Any ideas, maybe we just dont understand the scenario.

 

Thanks!!

 

 

8 REPLIES 8
AEK
SuperUser
SuperUser

Hi Roland

Is there NAT between FG and DHCP server?

Or is there a public IP on WAN1 interface as secondary IP address?

AEK
AEK
ozkanaltas
Valued Contributor II

Hello @RolandBaumgaertner72 ,

 

As far as I remember, if you wanted to pass DHCP relay packets through L3 router devices, you had to configure a helper on all devices on the route. Maybe that's why relay packets are not reaching through your MPLS network.

 

If you have a chance to try it, can you set up an ipsec tunnel between two sites and try it?

If you have found a solution, please like and accept it to make it easily accessible to others.
NSE 4-5-6-7 OT Sec - ENT FW
If you have found a solution, please like and accept it to make it easily accessible to others.NSE 4-5-6-7 OT Sec - ENT FW
RolandBaumgaertner72

Hi,

 

from Office A to data center we have a MPLS connection and in both polices we have activated NAT.

 

Any suggestions?

 

Thanks!

AEK

Hello

So if I understand well the NAT is at FG level, not at another device between FG and DHCP server, right?

In this case I think there should be a solution if you can source the DHCP relay packets with the public IP. Let me try find if FG can do that.

AEK
AEK
ebilcari

As I know you can't use NAT with DHCP helper. The DHCP request should be sourced by the Gateway of the hosts. That source IP is used by the DHCP server to find the right pool of addresses to offer the lease.

The DHCP helper role need to be configured only on the gateway that will transform the broadcast request to unicast request that can be routed (multi hop) until they reach the DHCP server.

- Emirjon
If you have found a solution, please like and accept it to make it easily accessible for others.
RolandBaumgaertner72
Contributor

I am wondering how this should work. APs connected to network WIFI with 128.1.150.1. The SSID from this WIFI has 100.100.1.1/24 and should get DHCP from server 128.1.98.66 which is connected via WAN1 (MPLS) to our data center.

 

 

sw2090
SuperUser
SuperUser

you could do packet capturing on the client (or the interface of the FGT) and filter that by dhcp to see wether the client gets answers from your relay or not.

-- 

"It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams

-- "It is a mistake to think you can solve any major problems just with potatoes." - Douglas Adams
fricci_FTNT
Staff
Staff

Hi @RolandBaumgaertner72 ,

 

Is the server 128.1.98.66 receiving the requests from the Fortigate and replying?
Is there any DCHP snooping configured somewhere in your network that could drop unauthorised DHCP packets?
You can run a packet capture on the DHCP server 128.1.98.66 (or a switch attached to that server) and the FortiGate at the same time.

Best regards,

---
If you have found a useful article or a solution, please like and accept it to make it easily accessible to others.
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors