• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 754
  • Last Modified:

Multiple DHCP-enabled VLAN's in Fortigate Switch Mode

I have one Fortigate 80C in switch mode (which means I have one "internal" group that holds all physical LAN ports)

I'm creating a couple of VLANS under the "internal" interface for different purposes (192.168.1.0 and 192.168.2.0) and I will enable DHCP for both VLANs.

Questions:

1) Every client will try to get an IP address, but there are actually two DHCP (one for 192.168.1.0 and another for 192.168.2.0), which makes me think it won't work. How should I implement multiple DHCP-enabled VLAN's?

2) Is it possible to instruct Fortigate to route all Internet traffic from one VLAN through wan1 and another VLAN through wan2?

3) In order to allow Inter-VLAN traffic... Do I need something in addition to create a static route o PBR (and its corresponding policies)?

Thanks!
0
Daniel Suárez
Asked:
Daniel Suárez
  • 2
2 Solutions
 
Garry GlendownConsulting and Network/Security SpecialistCommented:
1 - To serve two DHCP ranges, you will need to be in both broadcast domains with an active interface. Assuming you have created two VLAN interfaces, with IP-addresses, you should be ready to go, just add the ranges to the respective interfaces and it ought to work.

2 - you can do that either by adding a policy route, or by setting up VDOMs. The latter is a more stringent way to split the two VLANs, as it creates two virtual firewalls that have nothing to do with each other (unless you configure an Inter-VDOM-Link). Either way will work, you just need to see which one fits your overall requirements better.

3 - if the interfaces are in the same VDOM, no. The routes are there automatically, as they are both connected subnets. You will have to configure rules, though (unless you put both VLAN interfaces in the same zone with in-zone access open.

For more detailed information, you'd need to provide some more information on what you are actually setting up. Apart from that, the setup is pretty easy and could probably be finished within 15 minutes by remote session ;)
1
 
vivigattCommented:
I am not familiar with Fortigate, but I know DHCP quite well.

You can have a single DHCP serving 2 different subnets if you use DHCP relaying :
https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#DHCP_relaying

In Cisco-ish, the command is ip helper-address.
0
 
Garry GlendownConsulting and Network/Security SpecialistCommented:
Cisco commands don't really help much with Fortigate ... ;) We do both, and they are not very alike ... as the FG seems to be terminating both VLANs, DHCP relaying doesn't seem to be necessary in this case ... testing the config, it seems as if FGs do not support ranges outside of the interface broadcast domain... so adding a subnet 192.168.10.0/24 to an interface with an address in 192.168.0.0/24 e.g. is not permitted on the web interface (5.2.8) - on the CLI, it can be configured, but I did not test if the actual server is behaving correctly (if they are using some standard Linux DHCP server internally, it might)
0
 
Daniel SuárezSQL Server ConsultantAuthor Commented:
Excellent, this was helpful. Thank you so much.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now