top of page

FortiGate DHCP Relay Silent: diagnose debug application dhcprelay

  • 4 days ago
  • 2 min read
FortiGate network security troubleshooting lab
FortiGate · Techclick CLI troubleshooting lab
New VLAN gets no addresses. The core DHCP server is healthy. FortiGate is the relay.

This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.

What you will be able to do

  • Name the first CLI command to run on FortiGate for this ticket

  • Separate the layer that is actually broken from the layer people blame

  • Apply one scoped fix instead of a global disable

  • Prove the ticket closed with a session, log, or counter

Quick answer

Relay must see the discover on the client VLAN and forward to the helper IP. dhcprelay debug shows which side is silent.

Why this ticket shows up

Wrong helper IP, missing local-in, or helper in another VDOM drops DHCP without a dramatic log.

Symptoms operators actually see

  • Clients stay APIPA

  • Server has no discovers

  • Other VLANs work

  • Helper IP recently changed

CLI first — copy this block

Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.

show system dhcp server
diagnose debug application dhcprelay -1
diagnose debug enable
diagnose ip address list
execute ping <dhcp-server>
get system interface physical

How to read that output

You must see a discover in and a relayed packet out. If only the in-side appears, helper IP or routing is wrong.

Triage order

  1. Confirm the client VLAN interface has the relay

  2. Ping the helper sourced from that interface

  3. Run dhcprelay debug and renew one client

  4. Fix helper IP or policy

  5. Disable debug

Classic traps

What you see

Real cause

Fix

Rebuild the DHCP server

Relay never forwarded

Fix helper

Allow UDP 67 only one way

Relay is bidirectional

Allow return

Add a local DHCP pool

Design is central DHCP

Do not hide the real fault

Proof the ticket is closed

  • Client gets the correct scope

  • Debug shows discover and offer

  • Lease appears on the server

Say this in an interview

APIPA on one VLAN with a healthy DHCP server is a relay problem until dhcprelay proves otherwise.

Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/

Comments


bottom of page