
FortiGate DHCP Relay Silent: diagnose debug application dhcprelay
- 4 days ago
- 2 min read

New VLAN gets no addresses. The core DHCP server is healthy. FortiGate is the relay.
This is a live-ticket style lesson from Techclick Infosec. You will isolate the fault with CLI first, then prove the fix with one clean packet or log.
What you will be able to do
Name the first CLI command to run on FortiGate for this ticket
Separate the layer that is actually broken from the layer people blame
Apply one scoped fix instead of a global disable
Prove the ticket closed with a session, log, or counter
Quick answer
Relay must see the discover on the client VLAN and forward to the helper IP. dhcprelay debug shows which side is silent.
Why this ticket shows up
Wrong helper IP, missing local-in, or helper in another VDOM drops DHCP without a dramatic log.
Symptoms operators actually see
Clients stay APIPA
Server has no discovers
Other VLANs work
Helper IP recently changed
CLI first — copy this block
Run these on the FortiGate device or console named in the ticket. Do not skip the first show command — it tells you which later command matters.
show system dhcp server
diagnose debug application dhcprelay -1
diagnose debug enable
diagnose ip address list
execute ping <dhcp-server>
get system interface physicalHow to read that output
You must see a discover in and a relayed packet out. If only the in-side appears, helper IP or routing is wrong.
Triage order
Confirm the client VLAN interface has the relay
Ping the helper sourced from that interface
Run dhcprelay debug and renew one client
Fix helper IP or policy
Disable debug
Classic traps
What you see | Real cause | Fix |
Rebuild the DHCP server | Relay never forwarded | Fix helper |
Allow UDP 67 only one way | Relay is bidirectional | Allow return |
Add a local DHCP pool | Design is central DHCP | Do not hide the real fault |
Proof the ticket is closed
Client gets the correct scope
Debug shows discover and offer
Lease appears on the server
Say this in an interview
APIPA on one VLAN with a healthy DHCP server is a relay problem until dhcprelay proves otherwise.
Need the full vendor lab, mock interview, and production runbooks? Techclick trains Palo Alto, Zscaler, F5, FortiGate, Check Point, Cisco ISE, Azure and routing with live CLI — start at https://www.techclick.in/



Comments