Fortinet black logo

Administration Guide

Basic configuration

Basic configuration

The following contains information on basic configurations.

Configure a DHCP server on an interface

A DHCP server can be configured on an interface in the GUI from Network > Interfaces.

To configure a DHCP server in the GUI:
  1. Go to Network > Interfaces.

  2. Edit an interface.

  3. Enable the DHCP Server option and configure the settings.

  4. Click OK.

Field

Description

Address Range

By default, the FortiGate unit assigns an address range based on the address of the interface for the complete scope of the address.

For example, if the interface address is 172.20.120.230, the default range created is 172.20.120.231 to 172.20.120.254.

Select the range and select Edit to adjust the range or select Create New to add a different range.

Netmask

Enter the netmask of the addresses that the DHCP server assigns.

Default Gateway

Select this to use either Same as Interface IP or select Specify and enter the IP address of the default gateway that the DHCP server assigns to DHCP clients.

DNS Server

Select this to use Same as system DNS, Same as Interface IP or select Specify and enter the IP address of the DNS server.

Mode

Select the type of DHCP server FortiGate will be. By default, it is a Server. Select Relay if needed. When Relay is selected, the above configuration is replaced by a field to enter the DHCP Server IP address.

DHCP Server IP

This appears only when Mode is Relay. Enter the IP address of the DHCP server where FortiGate obtains the requested IP address.

Type

Select this to use the DHCP in Regular or IPsec mode.

Additional DHCP Options

Use this to create new DHCP options.

Add from DHCP Client List

If the client is currently connected and using an IP address from the DHCP server, you can select this option to select the client from the list.

To configure a DHCP server in the CLI:
config system dhcp server
    edit 1
        set dns-service default
        set default-gateway 192.168.1.2
        set netmask 255.255.255.0
        set interface "port1"
        config ip-range
            edit 1
                set start-ip 192.168.1.1
                set end-ip 192.168.1.1
            next
            edit 2
                set start-ip 192.168.1.3
                set end-ip 192.168.1.254
            next
        end
        set timezone-option default
        set tftp-server "172.16.1.2"
    next
end

Configure a DHCP relay on an interface

To configure a DHCP relay in the GUI:
  1. Go to Network > Interfaces.

  2. Edit an interface.

  3. Expand the Advanced section and set Mode to Relay.

  4. Enter the DHCP Server IP.

  5. Click OK.

To configure a DHCP relay in the CLI:
  1. Configure the interface, making sure to configure set dhcp-relay-ip:

    config system interface
        edit "port2"
            set vdom "root"
            set dhcp-relay-service enable
            set ip 10.1.1.5 255.255.255.0
            set allowaccess ping https ssh fabric
            set type physical
            set snmp-index 4
            set dhcp-relay-ip "192.168.20.10"
        next
    end
    

Configure a DHCP server and relay on an interface

A FortiGate interface can be configured to work in DHCP server mode to lease out addresses, and at the same time relay the DHCP packets to another device, such as a FortiNAC to perform device profiling.

The DHCP message to be forwarded to the relay server under the following conditions:

  • dhcp-relay-request-all-server is enabled

  • Message type is either DHCPDISCOVER or DHCPINFORM

  • Client IP address in client message is 0

  • Server ID is NULL in the client message

  • Server address is a broadcast address (255.255.255.255)

  • Server address is 0

Note

Configuring a DHCP server and relay on the same interface is currently only supported in the CLI.

To configure a DHCP server and relay in the CLI:
  1. Configure the interface:

    config system interface
        edit "port2"
            set vdom "root"
            set dhcp-relay-service enable
            set ip 10.1.1.5 255.255.255.0
            set allowaccess ping https ssh fabric
            set type physical
            set snmp-index 4
            set dhcp-relay-ip "192.168.20.10"
            set dhcp-relay-request-all-server enable
        next
    end
  2. Configure the DHCP server settings:

    config system dhcp server
        edit 17
            set status enable
            set dns-service default
            set default-gateway 10.1.1.5
            set netmask 255.255.255.0
            set interface "port2"
            config ip-range
                edit 1
                    set start-ip 10.1.1.6
                    set end-ip 10.1.1.254
                next
            end
        next
    end

Excluding addresses in DHCP

If you have a large address range for the DHCP server, you can block a range of addresses that will not be included in the available addresses for the connecting users using the config exclude-range subcommand.

To exclude addresses in DHCP:
config system dhcp server
    edit <id>
        config exclude-range
            edit <sequence_number>
                set start-ip <address>
                set end-ip <address>
            next
        end
    next
end

Viewing information about DHCP server connections

To view information about DHCP server connections, go to Dashboard > Network and expand the DHCP monitor widget. On this page, you can also add IP addresses to the reserved IP address list.

Basic configuration

Basic configuration

The following contains information on basic configurations.

Configure a DHCP server on an interface

A DHCP server can be configured on an interface in the GUI from Network > Interfaces.

To configure a DHCP server in the GUI:
  1. Go to Network > Interfaces.

  2. Edit an interface.

  3. Enable the DHCP Server option and configure the settings.

  4. Click OK.

Field

Description

Address Range

By default, the FortiGate unit assigns an address range based on the address of the interface for the complete scope of the address.

For example, if the interface address is 172.20.120.230, the default range created is 172.20.120.231 to 172.20.120.254.

Select the range and select Edit to adjust the range or select Create New to add a different range.

Netmask

Enter the netmask of the addresses that the DHCP server assigns.

Default Gateway

Select this to use either Same as Interface IP or select Specify and enter the IP address of the default gateway that the DHCP server assigns to DHCP clients.

DNS Server

Select this to use Same as system DNS, Same as Interface IP or select Specify and enter the IP address of the DNS server.

Mode

Select the type of DHCP server FortiGate will be. By default, it is a Server. Select Relay if needed. When Relay is selected, the above configuration is replaced by a field to enter the DHCP Server IP address.

DHCP Server IP

This appears only when Mode is Relay. Enter the IP address of the DHCP server where FortiGate obtains the requested IP address.

Type

Select this to use the DHCP in Regular or IPsec mode.

Additional DHCP Options

Use this to create new DHCP options.

Add from DHCP Client List

If the client is currently connected and using an IP address from the DHCP server, you can select this option to select the client from the list.

To configure a DHCP server in the CLI:
config system dhcp server
    edit 1
        set dns-service default
        set default-gateway 192.168.1.2
        set netmask 255.255.255.0
        set interface "port1"
        config ip-range
            edit 1
                set start-ip 192.168.1.1
                set end-ip 192.168.1.1
            next
            edit 2
                set start-ip 192.168.1.3
                set end-ip 192.168.1.254
            next
        end
        set timezone-option default
        set tftp-server "172.16.1.2"
    next
end

Configure a DHCP relay on an interface

To configure a DHCP relay in the GUI:
  1. Go to Network > Interfaces.

  2. Edit an interface.

  3. Expand the Advanced section and set Mode to Relay.

  4. Enter the DHCP Server IP.

  5. Click OK.

To configure a DHCP relay in the CLI:
  1. Configure the interface, making sure to configure set dhcp-relay-ip:

    config system interface
        edit "port2"
            set vdom "root"
            set dhcp-relay-service enable
            set ip 10.1.1.5 255.255.255.0
            set allowaccess ping https ssh fabric
            set type physical
            set snmp-index 4
            set dhcp-relay-ip "192.168.20.10"
        next
    end
    

Configure a DHCP server and relay on an interface

A FortiGate interface can be configured to work in DHCP server mode to lease out addresses, and at the same time relay the DHCP packets to another device, such as a FortiNAC to perform device profiling.

The DHCP message to be forwarded to the relay server under the following conditions:

  • dhcp-relay-request-all-server is enabled

  • Message type is either DHCPDISCOVER or DHCPINFORM

  • Client IP address in client message is 0

  • Server ID is NULL in the client message

  • Server address is a broadcast address (255.255.255.255)

  • Server address is 0

Note

Configuring a DHCP server and relay on the same interface is currently only supported in the CLI.

To configure a DHCP server and relay in the CLI:
  1. Configure the interface:

    config system interface
        edit "port2"
            set vdom "root"
            set dhcp-relay-service enable
            set ip 10.1.1.5 255.255.255.0
            set allowaccess ping https ssh fabric
            set type physical
            set snmp-index 4
            set dhcp-relay-ip "192.168.20.10"
            set dhcp-relay-request-all-server enable
        next
    end
  2. Configure the DHCP server settings:

    config system dhcp server
        edit 17
            set status enable
            set dns-service default
            set default-gateway 10.1.1.5
            set netmask 255.255.255.0
            set interface "port2"
            config ip-range
                edit 1
                    set start-ip 10.1.1.6
                    set end-ip 10.1.1.254
                next
            end
        next
    end

Excluding addresses in DHCP

If you have a large address range for the DHCP server, you can block a range of addresses that will not be included in the available addresses for the connecting users using the config exclude-range subcommand.

To exclude addresses in DHCP:
config system dhcp server
    edit <id>
        config exclude-range
            edit <sequence_number>
                set start-ip <address>
                set end-ip <address>
            next
        end
    next
end

Viewing information about DHCP server connections

To view information about DHCP server connections, go to Dashboard > Network and expand the DHCP monitor widget. On this page, you can also add IP addresses to the reserved IP address list.