DHCP relay question

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.

DHCP relay question

This thread has been locked for further replies. You can start a new thread to share your ideas or ask questions.
DHCP relay question
DHCP relay question
2023-11-18 01:08:14 - last edited 2023-11-20 17:36:43
Model: TL-SG3428MP  
Hardware Version: V2
Firmware Version:

I'm setting up a test environment for feasibility testing before deployment, and have the following configuration:

 

FortiGate 60F > DHCP scope 10.50.1.x on port 1, DHCP scope 192.168.80.x on port 2
 

TL-SG3428MP > port 1 connected to FortiGate port 1, port 2 connected to FortiGate port 2

 

Ruckus R710 in "Unleashed", connected to port 23 on the TP-Link switch

 

 

Tagged port 1, untagged 3-20, tagged port 21-24 as VLAN 1400 for "internal" traffic

Tagged port 2, 21-24 as VLAN 1500 for "guest" traffic

 

Enabled DHCP L2 relay for VLANs 1400 and 1500, with the gateway IPs

 

I've managed to get DHCP working from the FortiGate to the TP-Link - system connected on port 3 gets DHCP, and can talk to everything on the network, also confirmed the Ruckus is getting two IP addresses from the FortiGate.

I configured two wifi networks on the Ruckus, with the VLANs for each.

 

When I connect to either wifi network, it shows the client but never receives an IP address to complete the connection.

 

Is my failure at the FortiGate side, not knowing what the VLAN is requesting (which I thought the relay would resolve), configuration of the switch (I'm used to tagging/untagging on Brocade switches, and PVID is really not making sense), or the Ruckus side (which I can open a support ticket)?

 

Thanks in advance!

  0      
  0      
#1
Options
1 Accepted Solution
Re:DHCP relay question-Solution
2023-11-20 17:14:41 - last edited 2023-11-20 17:36:43

  @JFrisbee 

 

You connect FortiGate to the switch using two separate links and you have single subnets there. This makes me think that FortiGate sends untagged frames to the switch. If that's the case, making the corresponding ports on the switch untagged in their VLANs and setting their PVIDs to the VLAN IDs should be the right setting for those switchports.

Kris K
Recommended Solution
  0  
  0  
#4
Options
4 Reply
Re:DHCP relay question
2023-11-19 20:44:14

  @JFrisbee 

 

The configuration of your TP-Link switch may be right, but it all depends on the configurations on the other side of the links. I can’t figure it out from your description. I’m not familiar with either FortiGate or Ruckus.

 

There is also one aspect of your configuration that makes me wonder.

 

“Enabled DHCP L2 relay for VLANs 1400 and 1500, with the gateway IPs.”

 

Where do you have that defined? Is that on the switch? The switch doesn’t seem to be doing any routing so, if the relay is set up there, the relay does not do anything. If a DHCP relay is needed (not sure if you really need it), it should be set up on the device that does routing.

Kris K
  0  
  0  
#2
Options
Re:DHCP relay question
2023-11-20 16:04:28

  @KJK Thanks, I think that points me in the right direction - the FortiGate is doing the routing in this config, so I'll need to figure out how to get the VLANs identified on there. Otherwise I need to determine (if it can) how to route via the switch.

  0  
  0  
#3
Options
Re:DHCP relay question-Solution
2023-11-20 17:14:41 - last edited 2023-11-20 17:36:43

  @JFrisbee 

 

You connect FortiGate to the switch using two separate links and you have single subnets there. This makes me think that FortiGate sends untagged frames to the switch. If that's the case, making the corresponding ports on the switch untagged in their VLANs and setting their PVIDs to the VLAN IDs should be the right setting for those switchports.

Kris K
Recommended Solution
  0  
  0  
#4
Options
Re:DHCP relay question
2023-11-20 17:37:48

  @KJK Spot on - doing research before your reply, in Fortigate's cookbook:

A VLAN interface is attached to a physical interface. 
When the FortiGate sends out traffic to the physical interface level, the egress packets are untagged, whereas the packets sent on a VLAN level are tagged.
 
If on a particular VLAN there are destination devices in the network that do not accept tagged packets, it will be required to connect the FortiGate to an intermediate L2 unit (a switch for example) configured with the same VLAN(s).
 
Also, as a reply, your suggestion worked 100% first try!
 
Thank you so much!
 
Jason
  0  
  0  
#5
Options