Wifi often not receiving IP address

[Kryptonite]

Hi guys
I need some help. I recently upgraded. I recently upgraded my Fortigate 100F to the 7.2.4 version. At the same time I also upgraded my FP431F to the latest version (7.2)
I currently run a setup with two different wifi networks both in tunnel mode. We have a guest network that is running fine without any issues, but there is also a corporate network that is having some weird issues. Sometimes when you try to connect you do not receive an ip address at all and sometimes you do, but after a few minutes it is gone again. I checked the dhcp scope and there should be plenty of IP addresses left.
My thinking is that it has something to do with the ipsec tunnel the corporate network has access to. That's about the only difference between the two. Is there someone who can assist ?

[AlexC-FTNT]

Generally you should check if DHCP functions correctly (meaning that the DHCP exchange of messages is done, and ACK received from client). This will also show you where/if the packet is lost.

Start with a packet capture:

diag sniffer packet interface_name/any "port 67 or port 68" 6 0 l

then, if still inconclusive, look into what FortiGate does.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Diagnosing-DHCP-on-a-FortiGate/ta-p/192960 (you are looking at the server daemon)

[Kryptonite]

Hi @AlexC-FTNT  

I thought it was solved, since it worked stable for about two days. Yesterday however we had an internet outage and this morning the problem started appearing again. Could this be related ? 

[AlexC-FTNT]

I don't see any relation between them. Unless the DHCP server is not Fortigate, but a remote server over VPN. In which case the internet outage will also prevent local machines to get IPs. 

[lior]

I have a dhcp situation too, next time you don't get an ip address try executing clear dhcp lease all, then try to connect again to the wifi, i found that clears my connection error but yet to find what causes it...

[gfleming]

Can you provide more info? What is acting as the DHCP server? Is it the FortiGate? Is it a different device? Is it located on the other end of the IPSec tunnel? Please provide all releveant details so we can assist properly.

[Kryptonite]

I'll eleborate a bit more. We have an office site with a fortigate 100F with  8 FortiAP FP431F. We currently use an HP switch (don't exactly know the model). The switch is configured as a hub (I know this is bad) because we're waiting on delivery of new switches and we don't have an HP console cable.

I use two wifi networks which both are in tunnel mode (because of no configurable switches) because of this I'm still able to seperate traffic between the wifi networks. 

The guest network which goes straight to the internet has no problem at all.

The private network which has access to an IPsec tunnel to a datacenter often loose its dhcp lease and gets the message "no internet, secured"

Both networks use the fortigate as DHCP server. The only difference I see is the DNS server that is configured in the private network. This one is located on the other side of the IP sec tunnel.  However with LAN this server is perfectly pingable while the wifi has issues

[gfleming]

OK still need more details:

1. How is your switch configured as a "hub"? I think you mean to say something else? Do you just mean every switch port is in the same VLAN?
2. Have you absolutely confirmed that the device is losing DHCP and not just internet connectivity? How are you confirming this? "no internet, secured" could mean that it has DHCP lease but can't reach internet—perhaps due to DNS issue or something else.
3. Is this affecting only one type of device or multiple?

[Kryptonite]

Hi Graham 

Thanks for the response.

1. I assume every port is indeed on the same VLAN, but unfortunately I can't check. 

2. I did confirm it is the DHCP server, because if I run an ipconfig I get a 169 address.

3. It is affecting multiple devices on multiple access points, however not all devices at once. 

[gfleming]

OK next up we should grab some packet captures. Can you please run a packet capture on a problematic device and attach here?

At the same time please run the following commands during problematic device lease acquisition and attach the output:

diagnose debug application dhcps -1