How to allow traffic DHCP traffic in Fortigate transparent mode

 Thanks to: https://community.fortinet.com/

Technical Note: How to allow the flow of transit DHCP traffic in transparent mode

Description

By default, when the FortiGate firewall is in the transparent mode, it drops all broadcast traffic except ARP. This will result in the dropping of the DHCP broadcast traffic by default with the following entries being seen in the debugs:

(DMZ-MOBILE) # id=20085 trace_id=1738 func=print_pkt_detail line=4373 msg="vd-DMZ-MOBILE received a packet(proto=17, 0.0.0.0:68->255.255.255.255:67) from port3."
id=20085 trace_id=1738 func=init_ip_session_common line=4522 msg="allocate a new session-000476b2"
id=20085 trace_id=1738 func=__br_forward_check line=166 msg="drop broadcast: in: port3, out: port2"    

Solution

Diagram

Clients ---->---- Switch ---->---- port3 - FortiGate - port2 ---->---- DHCP server

To enable the flow of transit DHCP traffic in transparent mode it is necessary to:

1)  Enable broadcast-forward in the concerned interfaces from CLI.

config system interface
edit port2
set broadcast-forward enable
next
edit port3
set broadcast-forward enable
end

2)  Configure policies in both directions allowing the DHCP traffic.

The policies need to be in both directions because the OFFER packet will come in with different IP addressing (the source will be the server IP)

Note:
a)    If vlan interfaces are involved, the policies need to be setup between them.
b)    DHCP discover traffic does not hit multicast policies.

The document 'FortiOS Handbook - Transparent Mode' which is available in the Fortinet Document Library provides additional information on this subject.