This is a frequent trap - dhcp configs under ssl.root interface are there ... but they do not work.
May be in 7.0 it is different but for 6.x train it is possible for VPN SSL only if you use RADIUS for authentication and then your RADIUS server will allocate each user own IP address. Any other case - it is only VPN SSL pools on Fortigate or IPSec VPN (also part of FortiClient) - there you CAN use external DHCP server.
To use external DHCP on your SSL VPN, you need to configure the FortiGate to act as a DHCP relay for the SSL VPN interface. The configuration you found is a good starting point, but there are a few additional steps you need to take to make it work.
Here's an example configuration that should work:
1. Configure the external DHCP server to provide IP addresses for the SSL VPN clients.
2. In the FortiGate GUI, go to "System" > "Network" > "Interfaces" and select the SSL VPN interface ("ssl.root").
3. In the interface settings, enable the "DHCP Relay" option and specify the IP address of the DHCP server.
4. Go to "VPN" > "SSL-VPN Settings" and select the "Listen on Interface(s)" option.
5. Under "Listen on Interface(s)", select the SSL VPN interface ("ssl.root").
6. Under "Tunnel Mode", select "Split Tunnel" or "Full Tunnel" depending on your needs.
7. Save the SSL-VPN Settings and restart the SSL VPN service.
With these settings, the FortiGate should act as a DHCP relay for the SSL VPN clients and forward DHCP requests to the external DHCP server. The clients should receive IP addresses from the external DHCP server and be able to access the SSL VPN network.
Yes, that work also for me without enabling the DHCP at ssl.root interface.
config system settings set dhcp-proxy enable set dhcp-server-ip "x.x.x.x" end + Enabling the dhcp-proxy option at global level ensures that the Fortigate can act as dhcp proxy only for ssl vpn and ipsec VPN.
Related to the command set dhcp-ra-giaddr <gateway_IP_address> this is a new feature that is added at FortiOS v7.2.4.
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.