Configuring Network Interface (Network Setting)
How to set up your FortiWAN
The DHCP server (10.10.10.10) recognizes the relay agent (the LAN 2 port) that relayed the DHCP message through
the "DHCP Relay Agent IP" contained in the relayed message. Then according to the DHCP addressing policy, it
selects an IP belongs to subnet 192.168.11.x from its IP pool and responds to the relay agent on LAN 2 port.
DMZ 1
As the previous description, DHCP relay agent enabled on a DMZ port forwards the DHCP messages between DMZ
and a DHCP server. In FortiWAN, a DMZ can be deployed according the following WAN types:
l
Routing Mode - IPv4 Basic Subnet:
Subnet in DMZ
l
Routing Mode - IPv4 Basic Subnet:
Subnet in WAN and DMZ
l
Bridge Mode - Multiple Static IP:
IPv4 IP(s) in DMZ
No matter which WAN type a DMZ is deployed, it is necessary to configure the "IP(s) on Localhost" field to the DMZ
port via Web UI. From the example above, we have configured the localhost of DMZ 1 port with three IP addresses
20.20.20.1 and 20.20.20.2. To enable DHCP Relay on this port, you need to check the check-box "Enable DHCP
Relay" on the Web UI and configure the settings as follows:
DHCP Relay Server
10.10.10.10
DHCP Relay Agent IP
20.20.20.1 or 20.20.20.2
The DHCP server (10.10.10.10) recognizes the relay agent (the DMZ 1 port) that relayed the DHCP message through
the "DHCP Relay Agent IP" contained in the relayed message. Then according to the DHCP addressing policy, it
selects an IP belongs to subnet 20.20.20.x from its IP pool and responds to the relay agent on DMZ 1 port.
Note that the DHCP server working with FortiWAN's DHCP Replay must be a standalone server.
FortiWAN's DHCP function is not supported to work with DHCP Relay; a port with DHCP being enabled can not
cooperate with the ports that DHCP Relay is enabled on. The centralized DHCP server working in a DHCP Relay
deployment must be well-configured in the IP pools for the multiple IP subnets it is managing.
DHCP Relay over FortiWAN Tunnel Routing network
FortiWAN's DHCP Relay is capable of forwarding DHCP messages through Tunnel Routing (See "
") so
that the centralized IP addressing over a FortiWAN Tunnel Routing network can be implemented. This is useful for the
application that a headquarters centrally manages IP allocation to its regional branches. The following shows the
example that a DHCP server located in the headquarters site (deployed in the LAN subnet) manages the IP addressing
to its branches through Internet.
With Tunnel Routing connectivity, a VPN network is established among networks of the two sites. DHCP relay in the
VPN network serves for the subnets just as normal. FortiWAN A (the branch) delivers the relayed DHCP requests from
its private subnet 192.168.10.0/24 to the DHCP server located in remote private subnet 192.168.100.0/24 over
Internet; conversely, FortiWAN B (the headquarters) delivers the DHCP responses to the branch site over Internet and
FortiWAN A will forward the response to its LAN to allocate a host the IP address. DHCP messages are delivered by
Tunnel Routing encapsulation and decapsulation, just like normal Tunnel Routing transmission. The localhost of LAN
port on FortWAN A is configured to 192.168.10.254. Configuration of IP pool for subnet 192.168.10.0/24 is required
on the DHCP server. The related configurations on the two FortiWAN units are as follows:
FortiWAN Handbook
Fortinet Technologies Inc.
59
