MX Routing behaviour for LAN traffic - DHCP issues

[Pwellion]

Hello All

I have inherited a poorly designed non Meraki LAN and a failed migration attempt from a FortiGate Firewall to an MX 85 Appliance. The Failure was due to DHCP clients (VLAN10) were were no longer getting IP addresses from the DHCP server on VLAN 30.

The attached diagram displays the LAN setup. The MX essentially replaced the FortiGate with equivalent configuration in terms of routing, and LAN IP address fw rules etc.

As per diagram an IP-Helper is set up on vlan10, directing the DHCP requests to the server on VLAN30, 192.168.30.250. I believe the Issue is related to the poorly implemented routing, whereby the return DHCP traffic from the server routes via the Firewall (192.168.30.1) instead of the L3 Switch.

The question I have is that this setup worked with the FortiGate, albeit sub-optimal. Does anyone know how the MX would handle the traffic. Unfortunately this migration was carried out before my time and there is no info in terms of packet captures/troubleshooting info. For info there are no firewall rules configured on MX, just the default Any to Any and there is a route for the 192.168.10.0/24 subnet on the MX via L3 switch address 192.168.30.254

Can anyone confirm/suggest if this setup should work as per diagram?

Obviously I intend to fix the routing issue and have the L3 switch as GW for all local VLANs and create a transit vlan for WAN egress/ingress traffic. 

Any help appreciated

Thanks

[PhilipDAth · Accepted solution]

This is not likely to work.

Two solutions come to mind:

1. Update the DHCP server so it is giving out the L3 switch as the default gateway.  Also make sure the server is using the L3 switch as its default gateway.
2. Move all L3 processing to the MX85, and remove all L3 interfaces from the switch.

[Pwellion]

Thanks.

I believe it works using the FortiGate as it also acts more like a traditional router. Not sure the MX can route between the LAN in the same manner. As stated will ensure internal LAN (east>west) routing occurs on the L3 switch and any North/South traffic is routed to the Meraki.