Skip to main content

Search

How can we help ?

How to Enable Cloudi-Fi DHCP with a FortiGate Firewall

Mahfoud
  • Updated

This article will guide you through the process of enabling DHCP relay over IPsec using a Fortigate firewall, ensuring that clients on remote networks can receive IP addresses.

 

Table of contents

Prerequisites

Step 1: Get DHCP and IPsec Info from Cloudi-DHCP Admin Console

Step 2: IPsec tunnel configuration

Step 3: Static Routes

Step 4: Create or update your SSID or VLAN

Step 5: Firewall Policy

Summary

Troubleshooting

 

Prerequisites

Before you begin, ensure you have the following prerequisites in place:

  1. Access to Cloudi-Fi Admin Console: You must have access to the Cloudi-Fi admin console to obtain DHCP and IPsec-related information.

  2. Create Cloudi-Fi Locations and Subnets: Within the Cloudi-Fi admin console, create the necessary locations and subnets that correspond to your network setup. 

  3. Understanding of Your Network, Subnets, and Firewall Configuration: Clearly understand your network topology, subnets, and your FortiGate firewall's configuration.

  4. FortiGate Firewall: Access to your FortiGate dashboard.

Step 1: Get DHCP and IPsec Info from Cloudi-DHCP Admin Console

  1. Log in to your Cloudi-Fi dashboard 

  2. Navigate to Networks > DHCP

  3. Select your desired location, which should correspond to the network where you want to enable DHCP relay over IPsec.
  4. IPsec tunnel information
    • FQDN, IPv4 or user FQDN
    • Pre-shared key

  5. Under Cloudi-Fi, find and note down the following information:

    • Service Subnet
    • DHCP Relay IP

  6. Additionally, locate the IPsec endpoint within Cloudi-Fi:

    • Under IPsec servers, identify the IPsec endpoint that corresponds to your FortiGate firewall.

Step 2: IPsec tunnel configuration

  1. Log in to your FortiGate firewall 
  2. Navigate to VPN > IPsec Tunnels
  3. Create a new IPsec Tunnel with 
    1. Name: Give it a name
    2. Template type: Custom
  4. Next
  5. Network Configuration
    1. Remote Gateway: Static IP Address
    2. IP address: Terminator 1 or Terminator 2
    3. Interface: Your WAN Interface
    4. NAT Traversal: Enable
  6. Authentication
    1. Method: Pre-shared Key 
    2. Pre-shared Key: Your Pre-shared key (identical to the one configured on the Cloudi-Fi side)
    3. IKE version: 2
  7. Phase 1 Proposal: Recommended settings
  8. Phase 2 Selectors
    1. Local Address: addr_subnet - 0.0.0.0/0
    2. Remote Address: addr_subnet - Your Service subnet (in this example 172.24.46.64/28)
    3. Encryption & Authentication

Step 3: Static Routes

  1. Navigate to Network > Static Routes
  2. Create a new one 
  3. Destination: Your Service subnet (in this example 172.24.46.64/28)
  4. Interface: IPsec tunnel you’ve created in the previous step

Step 4: Create or update your SSID or VLAN

  1. Navigate to your SSID or VLAN configuration 
  2. Under the Address section, set your IP Address, which will be the default gateway for your SSID or VLAN
  3. Enable the DHCP Server and configure it as follows
    1. Mode: Relay
    2. Type: IPsec
    3. DHCP Server IP: One of the Service Addresses

Step 5: Firewall Policy

  1. Navigate to Policy & Objects > Firewall Policy 
  2. Add a new IPv4 Policy and configure it as follows 
    1. Incoming Interface: Your SSID or VLAN
    2. Outgoing Interface: Your IPsec tunnel 
    3. Source: Your Subnet
    4. Destination: All 
    5. Service: DHCP
    6. Action: ACCEPT

Summary

By following the steps outlined in this guide and using the information obtained from the Cloudi-Fi admin console, you can make sure that DHCP requests from remote networks are correctly relayed to the DHCP server, allowing clients to receive IP addresses and network configurations seamlessly.

Troubleshooting

If you encounter issues with DHCP relay over IPsec, consider the following troubleshooting steps:

  • Double-check the configuration settings, including interface selection, DHCP server IP address, and source IP address.
  • Verify that the IPsec tunnel is operational and correctly configured.
  • Ensure that firewall policies and routing rules allow traffic between the source and destination networks.
  • Check the DHCP server logs for any incoming requests or issues on the server side.