Hello all,
I want to use external DHCP on my SSL VPN.
I found the following on the internet:
config system interface
edit ssl.root
set dhcp-relay-service [enable|disable]
set dhcp-relay-ip next
end
Only with these settings, it's not working.
I think there is also a configuration need on VPN SSL web portal or VPN SSL setting or I have to assign an IP on the interface ssl.root
Does anyone here know about this? Can someone give me the winning tip?
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Created on 06-23-2022 12:23 PM
Hello,
As per your query Fortinet now has this feature of having an external DHCP server for SSL VPN.
Please check the link below:
Thanks,
This is a frequent trap - dhcp configs under ssl.root interface are there ... but they do not work.
May be in 7.0 it is different but for 6.x train it is possible for VPN SSL only if you use RADIUS for authentication and then your RADIUS server will allocate each user own IP address. Any other case - it is only VPN SSL pools on Fortigate or IPSec VPN (also part of FortiClient) - there you CAN use external DHCP server.
Created on 06-23-2022 12:23 PM
Hello,
As per your query Fortinet now has this feature of having an external DHCP server for SSL VPN.
Please check the link below:
Thanks,
At web SSL portal should add GW too.
# config vpn ssl web portal
edit "full-access"
set tunnel-mode enable
set web-mode enable
set ip-mode dhcp
set dhcp-ra-giaddr y.y.y.y ( y.y.y.y is the IP of the FGT port that is connected with the DHCP Server)
end
To use external DHCP on your SSL VPN, you need to configure the FortiGate to act as a DHCP relay for the SSL VPN interface. The configuration you found is a good starting point, but there are a few additional steps you need to take to make it work.
Here's an example configuration that should work:
1. Configure the external DHCP server to provide IP addresses for the SSL VPN clients.
2. In the FortiGate GUI, go to "System" > "Network" > "Interfaces" and select the SSL VPN interface ("ssl.root").
3. In the interface settings, enable the "DHCP Relay" option and specify the IP address of the DHCP server.
4. Go to "VPN" > "SSL-VPN Settings" and select the "Listen on Interface(s)" option.
5. Under "Listen on Interface(s)", select the SSL VPN interface ("ssl.root").
6. Under "Tunnel Mode", select "Split Tunnel" or "Full Tunnel" depending on your needs.
7. Save the SSL-VPN Settings and restart the SSL VPN service.
With these settings, the FortiGate should act as a DHCP relay for the SSL VPN clients and forward DHCP requests to the external DHCP server. The clients should receive IP addresses from the external DHCP server and be able to access the SSL VPN network.
Dear Faizal Emam,
Thank you for the answer.
Yes, that work also for me without enabling the DHCP at ssl.root interface.
config system settings
set dhcp-proxy enable
set dhcp-server-ip "x.x.x.x"
end
+ Enabling the dhcp-proxy option at global level ensures that the Fortigate can act as dhcp proxy only for ssl vpn and ipsec VPN.
Related to the command set dhcp-ra-giaddr <gateway_IP_address> this is a new feature that is added at FortiOS v7.2.4.
Best Regards,
E. Salija
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1517 | |
1013 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.