The utility centralizes its DHCP server at the NOC, but a remote substation's device segment sits on the far side of a FortiGate interface and cannot reach that central server with its normal broadcast-based DHCP requests. The utility does not want to deploy a local DHCP server at the substation. What should be configured on the substation-facing interface?
Select an answer to reveal the explanation.
Short Explanation
DHCP requests are broadcasts, and broadcasts don't cross router boundaries on their own — that's the actual problem you're hitting here. Turn on DHCP relay and it picks up those local requests at the substation interface and forwards them, as a normal routed packet, straight to your NOC's real DHCP server.
Full Explanation
DHCP client requests are sent as Layer 2 broadcasts and normally do not cross a routed boundary, so a client at the substation cannot reach a DHCP server on the far side of the FortiGate without help. DHCP relay solves this by having the FortiGate interface listen for local DHCP broadcasts and forward them as unicast packets to a specified server address — here, the NOC's centralized server — then relay the response back to the client, all without a DHCP server at the substation itself. A local DHCP scope at the substation would work operationally but directly contradicts the requirement of not deploying a local server, and risks address-pool overlap with the NOC's scope. Manually assigning static addresses abandons automatic configuration and doesn't scale as devices are added. A policy route only affects where already-formed IP traffic is forwarded; it cannot deliver a Layer 2 broadcast across a routed boundary, so it doesn't touch the underlying problem. To confirm relay is working, check that a substation device receives a lease from the NOC's address pool rather than falling back to a self-assigned link-local address.