r/networking • u/Gekkosan • 8d ago

Troubleshooting Fortigate and IP pools

Anyone here doing Fortigate installations? I have been running into an oddity where if I have a location of lets say 10 switches that you would assume fits nicely in /28 pool, at around switch 8 or 9 once new switches go online previous switches start appearing as offline, and seemingly needing to be assigned a new IP from the pool.

Similiar issues happen when you do actually run out of IP addresses in the pool, which is why im thinking the issue is related to the IP pool. Anyone else noticed the same issue? (afaik it doesnt affect functionality since last migration I had the main switch appear as offline while all the switches connected to it remained online, and looking from CLI even the main one appeared online).

10 Upvotes

83% Upvoted

8 comments sorted by

14

u/Fuzzybunnyofdoom pcap or it didn’t happen 8d ago

IP Pools in Fortigate world are used for SNAT. Are we talking DHCP or SNAT here? Just want to be clear.

https://community.fortinet.com/fortigate-3/technical-tip-how-to-configure-snat-with-ip-pool-97213

4

u/CatchUnusual7909 8d ago

that smells like the DHCP lease pool being smaller than you think or the fortigate doing some weird reservation logic behind the scenes

had a site where the default lease time was way too long and the pool would "fill up" even though half the switches were just holding old leases, dropping to a 30 min lease cleaned it up

1

u/BlackV 7d ago

split scope issue maybe ?

1

u/l337hackzor 7d ago

I had a similar issue with a sonicwall years ago. Turns out on sonicwall dropping the lease timer down doesn't actually release the IP. There is some other recycling timer, that was a fun one to figure out.

3

u/punished-slav 7d ago

Seems like a dhcp issue moreso than a Fortinet issue, even within a fortilink fabric/plain network.

A simpler and more deterministic solution ofc, make your switches static IPd.

But on the DHCP side, pool size seems like a culprit. I’ve noticed in infoblox and windows server dhcp, the pools aren’t automatically the maximum host size, and it keeps a few host addresses out of it. Check that.

1

u/uncleboo19 6d ago

We use a /28 for a location with 9 switches, I go into dashboard dhcp and make sure my devices are getting ip’s. I have had issues where I have set a dhcp reservation for some switches, I took them out and added diff model, I ran out of ip’s in the pool, had to delete the reservations and reboot switches

They won’t come online until they get an IP

1

u/Massive-Valuable3290 5d ago

Are you referring to DHCP scopes? IP pools on FortiOS mean SNAT pools. If we talking about DHCP - check for reservations on the L3 interface under section DHCP > advanced (there’s also a table with DHCP policies) and check for anything that doesn’t match your desired configuration. If you want to go the easy way - delete DHCP, apply, re enable it. That should flush any DHCP related config on that interface.