Usage of external DHCP on SSL VPN

[ChristianK]

Hello all,

I want to use external DHCP on my SSL VPN.

I found the following on the internet:

config system interface 
edit ssl.root
set dhcp-relay-service [enable|disable]
set dhcp-relay-ip next
end

Only with these settings, it's not working.

I think there is also a configuration need on VPN SSL web portal or VPN SSL setting or I have to assign an IP on the interface ssl.root

Does anyone here know about this? Can someone give me the winning tip?

[Yurisk]

This is a frequent trap - dhcp configs under ssl.root interface are there ... but they do not work.

May be in 7.0 it is different but for 6.x train it is possible for VPN SSL only if you use RADIUS for authentication and then your RADIUS server will allocate each user own IP address. Any other case - it is only VPN SSL pools on Fortigate or IPSec VPN (also part of FortiClient) - there you CAN use external DHCP server.

[Anonymous · Accepted solution]

Hello,

As per your query Fortinet now has this feature of having an external DHCP server for SSL VPN.

Please check the link below:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215...

Thanks,

[esalija]

 At web SSL portal should add GW too.

# config vpn ssl web portal

edit "full-access"

set tunnel-mode enable

set web-mode enable

set ip-mode dhcp

set dhcp-ra-giaddr y.y.y.y  ( y.y.y.y is the IP of the FGT port that is connected with the DHCP Server)

end

[Faiza_Emam_Delhi]

To use external DHCP on your SSL VPN, you need to configure the FortiGate to act as a DHCP relay for the SSL VPN interface. The configuration you found is a good starting point, but there are a few additional steps you need to take to make it work.

Here's an example configuration that should work:

1. Configure the external DHCP server to provide IP addresses for the SSL VPN clients.

2. In the FortiGate GUI, go to "System" > "Network" > "Interfaces" and select the SSL VPN interface ("ssl.root").

3. In the interface settings, enable the "DHCP Relay" option and specify the IP address of the DHCP server.

4. Go to "VPN" > "SSL-VPN Settings" and select the "Listen on Interface(s)" option.

5. Under "Listen on Interface(s)", select the SSL VPN interface ("ssl.root").

6. Under "Tunnel Mode", select "Split Tunnel" or "Full Tunnel" depending on your needs.

7. Save the SSL-VPN Settings and restart the SSL VPN service.

With these settings, the FortiGate should act as a DHCP relay for the SSL VPN clients and forward DHCP requests to the external DHCP server. The clients should receive IP addresses from the external DHCP server and be able to access the SSL VPN network.

[esalija]

Dear Faizal Emam,

Thank you for the answer.

Yes, that work also for me without enabling the DHCP at ssl.root interface.

config system settings
set dhcp-proxy enable
set dhcp-server-ip "x.x.x.x"
end
+ Enabling the dhcp-proxy option at global level ensures that the Fortigate can act as dhcp proxy only for ssl vpn and ipsec VPN.

Related to the command set dhcp-ra-giaddr <gateway_IP_address> this is a new feature that is added at FortiOS v7.2.4.

Best Regards,

E. Salija