Want to win a PS4? Go Premium and enter to win our High-Tech Treats giveaway. Enter to Win

x
?
Solved

Multiple DHCP-enabled VLAN's in Fortigate Switch Mode

Posted on 2016-09-06
4
Medium Priority
?
509 Views
Last Modified: 2016-09-11
I have one Fortigate 80C in switch mode (which means I have one "internal" group that holds all physical LAN ports)

I'm creating a couple of VLANS under the "internal" interface for different purposes (192.168.1.0 and 192.168.2.0) and I will enable DHCP for both VLANs.

Questions:

1) Every client will try to get an IP address, but there are actually two DHCP (one for 192.168.1.0 and another for 192.168.2.0), which makes me think it won't work. How should I implement multiple DHCP-enabled VLAN's?

2) Is it possible to instruct Fortigate to route all Internet traffic from one VLAN through wan1 and another VLAN through wan2?

3) In order to allow Inter-VLAN traffic... Do I need something in addition to create a static route o PBR (and its corresponding policies)?

Thanks!
0
Comment
Question by:Daniel Suárez
[X]
Welcome to Experts Exchange

Add your voice to the tech community where 5M+ people just like you are talking about what matters.

  • Help others & share knowledge
  • Earn cash & points
  • Learn & ask questions
  • 2
4 Comments
 
LVL 18

Accepted Solution

by:
Garry Glendown earned 1000 total points
ID: 41788527
1 - To serve two DHCP ranges, you will need to be in both broadcast domains with an active interface. Assuming you have created two VLAN interfaces, with IP-addresses, you should be ready to go, just add the ranges to the respective interfaces and it ought to work.

2 - you can do that either by adding a policy route, or by setting up VDOMs. The latter is a more stringent way to split the two VLANs, as it creates two virtual firewalls that have nothing to do with each other (unless you configure an Inter-VDOM-Link). Either way will work, you just need to see which one fits your overall requirements better.

3 - if the interfaces are in the same VDOM, no. The routes are there automatically, as they are both connected subnets. You will have to configure rules, though (unless you put both VLAN interfaces in the same zone with in-zone access open.

For more detailed information, you'd need to provide some more information on what you are actually setting up. Apart from that, the setup is pretty easy and could probably be finished within 15 minutes by remote session ;)
1
 
LVL 17

Assisted Solution

by:vivigatt
vivigatt earned 1000 total points
ID: 41788858
I am not familiar with Fortigate, but I know DHCP quite well.

You can have a single DHCP serving 2 different subnets if you use DHCP relaying :
https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol#DHCP_relaying

In Cisco-ish, the command is ip helper-address.
0
 
LVL 18

Expert Comment

by:Garry Glendown
ID: 41789055
Cisco commands don't really help much with Fortigate ... ;) We do both, and they are not very alike ... as the FG seems to be terminating both VLANs, DHCP relaying doesn't seem to be necessary in this case ... testing the config, it seems as if FGs do not support ranges outside of the interface broadcast domain... so adding a subnet 192.168.10.0/24 to an interface with an address in 192.168.0.0/24 e.g. is not permitted on the web interface (5.2.8) - on the CLI, it can be configured, but I did not test if the actual server is behaving correctly (if they are using some standard Linux DHCP server internally, it might)
0
 

Author Closing Comment

by:Daniel Suárez
ID: 41793574
Excellent, this was helpful. Thank you so much.
0

Featured Post

Tech or Treat! - Giveaway

Submit an article about your scariest tech experience—and the solution—and you’ll be automatically entered to win one of 4 fantastic tech gadgets.

Question has a verified solution.

If you are experiencing a similar issue, please ask a related question

Most of the applications these days are on Cloud. Cloud is ubiquitous with many service providers in the market. Since it has many benefits such as cost reduction, software updates, remote access, disaster recovery and much more.
This article explains the fundamentals of industrial networking which ultimately is the backbone network which is providing communications for process devices like robots and other not so interesting stuff.
This video gives you a great overview about bandwidth monitoring with SNMP and WMI with our network monitoring solution PRTG Network Monitor (https://www.paessler.com/prtg). If you're looking for how to monitor bandwidth using netflow or packet s…
If you're a developer or IT admin, you’re probably tasked with managing multiple websites, servers, applications, and levels of security on a daily basis. While this can be extremely time consuming, it can also be frustrating when systems aren't wor…

604 members asked questions and received personalized solutions in the past 7 days.

Join the community of 500,000 technology professionals and ask your questions.

Join & Ask a Question