Security

Hi all.

I have deployed Clearpass in the network.

I want to collect fingerprinting but not all VLANs have a relay on the gateway.

Some of them get DHCP from the gateway (Fortigate).

What is the best solution for getting those fingerprints in my case?

you can have more than one DHCP relay for each VLANs, ClearPass just needs to see the DHCP request and it will not respond to it.

Hi all.

I have deployed Clearpass in the network.

I want to collect fingerprinting but not all VLANs have a relay on the gateway.

Some of them get DHCP from the gateway (Fortigate).

What is the best solution for getting those fingerprints in my case?

Hi,
Thank you for your response.

Yes, I know I can put more than 1 relay.
My problem is the VLANs where the FortiGate is operating as the DHCP server. meaning it doesn't have a relay configured at all.

As far as I know, You can't configure a VLAN on the FortiGate to get DHCP from the Fortifate and configure a relay on the same VLAN.

you can have more than one DHCP relay for each VLANs, ClearPass just needs to see the DHCP request and it will not respond to it.

Hi all.

I have deployed Clearpass in the network.

I want to collect fingerprinting but not all VLANs have a relay on the gateway.

Some of them get DHCP from the gateway (Fortigate).

What is the best solution for getting those fingerprints in my case?

Hi,
Thank you for your response.

Yes, I know I can put more than 1 relay.
My problem is the VLANs where the FortiGate is operating as the DHCP server. meaning it doesn't have a relay configured at all.

As far as I know, You can't configure a VLAN on the FortiGate to get DHCP from the Fortifate and configure a relay on the same VLAN.

you can have more than one DHCP relay for each VLANs, ClearPass just needs to see the DHCP request and it will not respond to it.

Hi all.

I have deployed Clearpass in the network.

I want to collect fingerprinting but not all VLANs have a relay on the gateway.

Some of them get DHCP from the gateway (Fortigate).

What is the best solution for getting those fingerprints in my case?

You can set up an additional DHCP relay for DHCP fingerprinting on any switch in this VLAN (assuming the switch supports this feature).
Then the clients get their IPs from the Fortigate, the switch relays the DHCP requests to ClearPass and then you have the fingerprints.

Hi,
Thank you for your response.

Yes, I know I can put more than 1 relay.
My problem is the VLANs where the FortiGate is operating as the DHCP server. meaning it doesn't have a relay configured at all.

As far as I know, You can't configure a VLAN on the FortiGate to get DHCP from the Fortifate and configure a relay on the same VLAN.

you can have more than one DHCP relay for each VLANs, ClearPass just needs to see the DHCP request and it will not respond to it.

Hi all.

I have deployed Clearpass in the network.

I want to collect fingerprinting but not all VLANs have a relay on the gateway.

Some of them get DHCP from the gateway (Fortigate).

What is the best solution for getting those fingerprints in my case?

Hi all.

I have deployed Clearpass in the network.

I want to collect fingerprinting but not all VLANs have a relay on the gateway.

Some of them get DHCP from the gateway (Fortigate).

What is the best solution for getting those fingerprints in my case?

On FortiOS 7.0 and newer, you can run a DHCP server and relay on the same VLAN.  This is a little tricky as you lose GUI support on the FortiGate interface but works well.  I've implemented this myself in a network with over 30 sites and the FGTs supporting DHCP across 8 VLANs at each site.

Here is the reference.

DHCP server | FortiGate / FortiOS 7.0.5 | Fortinet Document Library

Hi all.

I have deployed Clearpass in the network.

I want to collect fingerprinting but not all VLANs have a relay on the gateway.

Some of them get DHCP from the gateway (Fortigate).

What is the best solution for getting those fingerprints in my case?