nerdexam
Fortinet

NSE4 · Question #328

An administrator has configured two VLAN interfaces: A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a…

The correct answer is D. Both interfaces must belong to the same forward domain. For a DHCP client on one VLAN interface to receive an IP address from a DHCP server on another VLAN interface managed by the same FortiGate, both VLAN interfaces must belong to the same forward domain to allow Layer 2 broadcast communication if part of a virtual switch.

Submitted by hans_de· Apr 18, 2026FortiGate Deployment and System Configuration

Question

An administrator has configured two VLAN interfaces:

A DHCP server is connected to the VLAN10 interface. A DHCP client is connected to the VLAN5 interface. However, the DHCP client cannot get a dynamic IP address from the DHCP server. What is the cause of the problem?

Exhibit

NSE4 question #328 exhibit

Options

  • ABoth interfaces must be in different VDOMs
  • BBoth interfaces must have the same VLAN ID.
  • CThe role of the VLAN10 interface must be set to server.
  • DBoth interfaces must belong to the same forward domain.

How the community answered

(25 responses)
  • A
    4% (1)
  • B
    4% (1)
  • C
    12% (3)
  • D
    80% (20)

Why each option

For a DHCP client on one VLAN interface to receive an IP address from a DHCP server on another VLAN interface managed by the same FortiGate, both VLAN interfaces must belong to the same forward domain to allow Layer 2 broadcast communication if part of a virtual switch.

ABoth interfaces must be in different VDOMs

Both interfaces being in different VDOMs would further isolate them and prevent DHCP communication without specific inter-VDOM links or routing.

BBoth interfaces must have the same VLAN ID.

VLAN interfaces are typically distinct Layer 2 segments identified by their VLAN ID; having the same VLAN ID would not create two distinct VLAN interfaces as described.

CThe role of the VLAN10 interface must be set to server.

The role of a FortiGate interface (e.g., LAN, WAN) does not dictate its ability to function as a DHCP server or client; the issue is connectivity, not the interface's functional role.

DBoth interfaces must belong to the same forward domain.Correct

In a FortiGate, if VLAN interfaces are configured within a virtual switch, they must belong to the same forward domain to share the same Layer 2 broadcast domain. DHCP relies on Layer 2 broadcasts, so if the client and server's VLAN interfaces are in different forward domains within a virtual switch, DHCP broadcasts cannot cross, preventing the client from receiving an IP address.

Concept tested: FortiGate forward domains and DHCP communication

Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/526710/setting-the-interface-role

Topics

#DHCP#VLANs#Network Segmentation#Forward Domains

Community Discussion

No community discussion yet for this question.

Full NSE4 Practice