DHCP smart relay on interfaces with a secondary IP

DHCP relays can be configured on interfaces with secondary IP addresses. The FortiGate will track the number of unanswered DHCP requests for a client on the interface's primary IP. After three unanswered DHCP requests, the FortiGate will forward DHCP requests to DHCP relays configured under the secondary IP using the secondary IP address as the source. After three unanswered DHCP requests, the FortiGate will return to using the primary IP and restart the process.

config system interface
    edit <name>
        set dhcp-smart-relay {enable | disable}
        config secondaryip
            edit <id>
                set secip-relay-ip <secondary_dhcp_relay_IP_1> <secondary_dhcp_relay_IP_2>
            next
        end
    next
end

DHCP relay targets under both the primary and secondary IP may be the same or unique. If smart relay is not configured, all requests are forwarded using the primary IP address on the interface.

Example

In this example, DHCP smart relay is configured on port5 with a DHCP relay IP address of 10.2.2.1.

To configure DHCP smart relay on interfaces with a secondary IP:

1. Configure DHCP relay on the interfaces:

   config system interface
       edit "port3"
           set vdom "vdom1"
           set ip 10.2.2.2 255.255.255.0
           set allowaccess ping https ssh snmp http telnet
           set type physical
           set snmp-index 5
       next
       edit "port5"
           set vdom "vdom1"
           set dhcp-relay-service enable
           set dhcp-smart-relay enable
           set ip 5.2.2.1 255.255.255.0
           set allowaccess ping https ssh snmp http
           set type physical
           set snmp-index 7
           set secondary-IP enable
           set dhcp-relay-ip "10.2.2.1" 
           config secondaryip
               edit 1
                   set ip 11.2.2.1 255.255.255.0
                   set secip-relay-ip "10.2.2.1"
                   set allowaccess ping https ssh snmp http
               next
           end
       next
   end

2. Verify the debug messages to check that the DHCP relay is working. After three unanswered DHCP requests, the request is forwarded to the secondary IP DHCP relay target:

   # diagnose debug application dhcprelay -1
   Debug messages will be on for 30 minutes.
   
   (xid:7ea80e4b) received request message from 0.0.0.0:68 to 255.255.255.255 at port5
   (xid:7ea80e4b) got a DHCPDISCOVER
   (xid:7ea80e4b) Warning! can't get server id from client message
   Insert option(82), len(7)
   found route to 10.2.2.1 via 10.2.2.2 iif=11 oif=9/port3, mode=auto, ifname=
   (xid:7ea80e4b) forwarding dhcp request from 5.2.2.1:67 to 10.2.2.1:67
   (xid:7ea80e4b) received request message from 0.0.0.0:68 to 255.255.255.255 at port5
   (xid:7ea80e4b) got a DHCPDISCOVER
   (xid:7ea80e4b) Warning! can't get server id from client message
   Insert option(82), len(7)
   found route to 10.2.2.1 via 10.2.2.2 iif=11 oif=9/port3, mode=auto, ifname=
   (xid:7ea80e4b) forwarding dhcp request from 5.2.2.1:67 to 10.2.2.1:67
   (xid:7ea80e4b) received request message from 0.0.0.0:68 to 255.255.255.255 at port5
   (xid:7ea80e4b) got a DHCPDISCOVER
   (xid:7ea80e4b) Warning! can't get server id from client message
   Insert option(82), len(7)
   found route to 10.2.2.1 via 10.2.2.2 iif=11 oif=9/port3, mode=auto, ifname=
   (xid:7ea80e4b) forwarding dhcp request from 11.2.2.1:67 to 10.2.2.1:67
   (xid:7ea80e4b) received request message from 10.2.2.1:67 to 11.2.2.1 at port3
   (xid:7ea80e4b) got a DHCPOFFER
   (xid:7ea80e4b) from server 10.2.2.1
   (xid:7ea80e4b) sending dhcp reply from 11.2.2.1:67 to 255.255.255.255:68
   (xid:7ea80e4b) received request message from 0.0.0.0:68 to 255.255.255.255 at port5
   (xid:7ea80e4b) got a DHCPREQUEST
   Insert option(82), len(7)
   found route to 10.2.2.1 via 10.2.2.2 iif=11 oif=9/port3, mode=auto, ifname=
   (xid:7ea80e4b) forwarding dhcp request from 11.2.2.1:67 to 10.2.2.1:67
   (xid:7ea80e4b) received request message from 10.2.2.1:67 to 11.2.2.1 at port3
   (xid:7ea80e4b) got a DHCPACK
   (xid:7ea80e4b) from server 10.2.2.1
   (xid:7ea80e4b) sending dhcp reply from 11.2.2.1:67 to 255.255.255.255:68