A second-hand FortiGate for the Kestrel Dental clinic
Kestrel Dental Group, a fictional practice, is replacing an old ISP router that also handed out addresses on the clinic LAN. A FortiGate taken from a closed branch becomes FGT1. Before it goes in, it must be wiped of the old branch's policies and VPNs. After that, it takes over DHCP on port2 (10.0.1.0/24), with three requirements: clients must use the domain controller DC1 (10.0.1.5) as their DNS server, the reception label printer must keep 10.0.1.50, and nothing in the range may clash with the clinic's fixed addresses below 10.0.1.100.
What FGT1 does the moment it powers on with defaults
A factory-default FortiGate is not inert. Depending on the model, it already has an address, a management service and often a DHCP server running:
| Setting | Factory default |
|---|---|
| Administrator | User admin, no password; a new password is required at first login |
| Management port | MGMT (or MGMT1/MGMT2); models without one use port1, sometimes inside a virtual switch |
| Management network | 192.168.1.0/24; the internal interface answers on 192.168.1.99 |
| DHCP server (entry-level models) | On the internal interface: 192.168.1.110–192.168.1.210, gateway and DNS 192.168.1.99, lease seven days |
| WAN | On models that ship this way, addressing mode DHCP, so Internet access works if the upstream network hands out an address |
| Firmware and definitions | Not changed by a reset |
The exact port names and roles depend on the model; its QuickStart guide is the reference. The DHCP server row is the one that causes trouble. In practice, the classic outage after a reset is a factory-default FortiGate patched into a production switch for "just a quick config": its internal port starts offering 192.168.1.x addresses with itself as gateway, and every client that renews early gets an address that goes nowhere. Configure a reset unit on an isolated cable or a lab switch.
Learn more: FortiGate Ports and InterfacesFirst Login and Basic Setup
From 7.6.5 the administrator password policy is enabled and enforced by default, so the new password set at first login must meet it. Also new in 7.6.5: models with two WAN ports ship with both in DHCP mode, members of an SD-WAN zone named sd-wan, with a health check (Default_Ping) to 1.1.1.1 and 9.9.9.9, and the default firewall policy uses that zone. FortiOS 7.4 defaults have not yet been reviewed for this lesson.
Four reset commands and what each one keeps
FortiOS has more than one way back to defaults. The choice depends on whether you can still reach the FortiGate afterwards, and from where:
| Command | Resets | Keeps | Typical use |
|---|---|---|---|
execute factoryreset | The whole configuration | Firmware, AV and IPS definitions | Redeploying a unit, with console access |
execute factoryreset2 | Everything else | VDOM mode and VDOMs, virtual switches, interfaces, system settings, static routes | Starting the policy set again over a remote connection |
execute factoryreset-for-central-management | Everything else | Central management serial number and FortiManager address | Rebuilding a unit that FortiManager will configure again |
execute factoryreset-shutdown | The whole configuration, then powers off | Same as factoryreset | Wiping a unit and powering it off, e.g. before shipping or disposal |
For FGT1, the old branch configuration has to go entirely, and the engineer is on the console, so plain factoryreset is right. Had FGT1 been 200 km away with only SSH over port1, factoryreset2 would be the one that leaves port1's address, administrative access and default route in place.
A reset is immediate and erases the configuration
The FortiGate reboots with the new configuration and every session through it is dropped. Take a backup first, and run the plain reset only from the console or a network you can reach the default management address from. After factoryreset the old interface addresses are gone, so an SSH session over the WAN ends for good.
execute backup config usb fgt1-before-reset.conf
execute factoryresetThe backup goes to a USB drive in the FortiGate (FTP, SFTP and TFTP also work). In the GUI the backup is under the user name menu › Configuration › Backup. The reset asks for confirmation, then reboots.
Learn more: Administrators, Backups and Firmware
How a DHCP server on a FortiGate interface works
A FortiGate DHCP server belongs to one interface. It answers DHCP requests that arrive on that interface (directly, or relayed by a router) and hands out an address from its ranges, together with options such as the subnet mask, default gateway, DNS servers and lease time. Each server can have up to ten address ranges and up to 30 extra options. Leases are backed up every 60 seconds by default (dhcp-lease-backup-interval under config system global), so unexpired leases survive a power cycle.
An interface can also be in relay mode instead, forwarding requests to a DHCP server elsewhere, such as a Windows server on another subnet. That server needs a route back to the FortiGate's interface address for its replies.
Learn more: DHCP
The DHCP server for the clinic LAN on port2
Edit Interface: port2
- Alias
- LAN
- IP/Netmask
- 10.0.1.1/255.255.255.0
- DHCP Server
- On
- Address Range
- 10.0.1.100-10.0.1.199The default range covers the whole subnet above the interface address; narrow it.
- Netmask
- 255.255.255.0
- Default Gateway
- Same as Interface IP Specify
- DNS Server
- Same as System DNS Same as Interface IP Specify10.0.1.5, so domain members find DC1.
- Mode
- Server Relay
DHCP Server
config system dhcp server
edit 1
set interface "port2"
set default-gateway 10.0.1.1
set netmask 255.255.255.0
set dns-service specify
set dns-server1 10.0.1.5
set domain "kestrel.example"
set ntp-service local
set lease-time 86400
config ip-range
edit 1
set start-ip 10.0.1.100
set end-ip 10.0.1.199
next
end
next
endWhat each line does is explained below. The server ID (1) is only a number; the interface setting ties it to port2.
default-gatewayis option 3, FGT1's own address on port2.dns-service specifywithdns-server1hands out DC1. The alternatives aredefault(the FortiGate's own configured DNS servers) andlocal(the interface address, for when the FortiGate is the DNS server).domaingives clients their DNS suffix.ntp-service local(option 42) points clients at FGT1's port2 address for time;defaultpasses on the FortiGate's own NTP servers instead.lease-time 86400is one day instead of the default seven. A per-rangelease-timeof 0 (its default) means "use the server's lease time"; a serverlease-timeof 0 means unlimited.- The range 10.0.1.100–199 leaves the fixed addresses below .100 alone. For a large range with a few fixed addresses inside it,
config exclude-rangedoes the same job.
Pointing clients at DC1 matters more than it looks. Domain members find domain controllers through DNS records that only the internal DNS server holds. With a public resolver, browsing works but domain logons and group policy fail, and the ticket usually says "the new firewall broke Windows".
Keeping 10.0.1.50 for the reception printer
A reservation ties an address to a MAC address. The printer still uses DHCP, but receives the same address, so it is managed in one place rather than on the printer's small screen:
config system dhcp server
edit 1
config reserved-address
edit 1
set ip 10.0.1.50
set mac 02:00:5e:10:00:50
set description "Reception label printer"
next
end
next
endtype defaults to mac and action to reserved, so these three lines are enough. The address can sit outside the range, as here, as long as it is in port2's subnet.
In the GUI there are two shortcuts. If the printer already holds a lease, Add from DHCP Client List in the interface's DHCP section turns it into a reservation. Or open Dashboard › Network, expand the DHCP widget, select the client and choose Create DHCP Reservation. A reservation can also block a MAC address (set action block), which stops the server answering that device at all.
Options beyond address, gateway and DNS
The interface page has fields for the common options; anything else goes in Additional DHCP Options.
| Option | Carries | Where on FGT1 |
|---|---|---|
| 1, 3 | Subnet mask, default gateway | netmask, default-gateway |
| 42 | NTP servers | ntp-service, ntp-server1–3 |
| 51 | Lease time | lease-time |
| 138 | Wireless controller (CAPWAP) addresses | wifi-ac-service, wifi-ac1–3 |
| 150 | TFTP servers, e.g. for VoIP phone configuration | tftp-server |
| Any other (1–255) | Whatever the application expects | config options with code, type (hex, string, ip, fqdn) and value |
The vendor of the device decides what a custom option must contain; take the code and format from its documentation. DHCP server options are not available when the FortiGate is in transparent mode.
Checking leases and watching DHCP on the wire
FGT1 # execute dhcp lease-list port2 port2 IP MAC-Address Hostname VCI SSID AP SERVER-ID Expiry 10.0.1.50 02:00:5e:10:00:50 RCP-PRN1 1 Wed Oct 14 09:12:40 2026 10.0.1.100 02:00:5e:10:01:0a SURG1-PC 1 Wed Oct 14 08:55:02 2026 10.0.1.101 02:00:5e:10:01:0b SURG2-PC 1 Wed Oct 14 08:57:19 2026
To take an address back, use Revoke in the DHCP monitor or execute dhcp lease-clear 10.0.1.101. execute dhcp lease-clear all clears every lease in the VDOM; clients keep using their addresses until they renew, which can cause duplicates, so keep it for labs.
When a client gets nothing at all, check whether its requests reach FGT1:
diagnose sniffer packet port2 'udp and (port 67 or port 68)' 4 20Prints up to 20 DHCP packets on port2 with the interface name. A healthy exchange shows the client's broadcast from 0.0.0.0 and FGT1's reply. Stop it early with Ctrl+C.
FGT1 # diagnose sniffer packet port2 'udp and (port 67 or port 68)' 4 20 interfaces=[port2] filters=[udp and (port 67 or port 68)] 2.114203 port2 in 0.0.0.0.68 -> 255.255.255.255.67: udp 300 2.115870 port2 out 10.0.1.1.67 -> 10.0.1.102.68: udp 300 2.131552 port2 in 0.0.0.0.68 -> 255.255.255.255.67: udp 300 2.132907 port2 out 10.0.1.1.67 -> 10.0.1.102.68: udp 300
For the server's own view, diagnose debug application dhcps -1 followed by diagnose debug enable prints its decisions. Turn it off with diagnose debug disable and diagnose debug reset.
When clients get no address, or the wrong one
New laptops receive 192.168.1.x addresses
PC1 shows 192.168.1.112 with gateway 192.168.1.99, not an address from 10.0.1.100–199.
Show the cause and fix
Another DHCP server is answering on the LAN, here a factory-default FortiGate (its default range and gateway give it away). The old ISP router does the same if its DHCP server was left on. Find the MAC address of the server in the client's DHCP details or in a sniffer trace, unplug it or turn its DHCP server off, then renew the clients.
Clients connect but domain logons fail
Web browsing works. Windows reports that no domain controller could be contacted.
Show the cause and fix
The DHCP server hands out the wrong DNS server, typically dns-service default passing on FGT1's public resolvers. Set dns-service specify with dns-server1 10.0.1.5 and renew the clients (ipconfig /renew on Windows).
The range is full
The lease list shows all 100 addresses in use, many by phones that visited once.
Show the cause and fix
Long leases hold addresses for devices that left days ago. Shorten lease-time, widen the range if the subnet allows it, and clear stale leases. Guest networks usually need a lease of hours, not the seven-day default.
A subnet behind an internal router gets nothing
A new 10.0.4.0/24 behind a router on the LAN has no DHCP, although FGT1 is configured.
Show the cause and fix
DHCP broadcasts don't cross a router on their own. The router needs DHCP relay pointing at 10.0.1.1, and FGT1 needs a second DHCP server on port2 with a range in 10.0.4.0/24, its own gateway (the router) and netmask. FGT1 also needs a route to 10.0.4.0/24 to send its replies.
Design choices for DHCP on a FortiGate
- Run one DHCP server per network. Two servers for one subnet only works with carefully split ranges, and is easy to get wrong.
- Keep infrastructure (switches, servers, the domain controller) on static addresses outside the range; use reservations for printers, phones and cameras that you want to manage centrally.
- Match lease time to how long devices stay: a day or more for staff, hours for guests.
- In Active Directory networks, hand out the domain controllers as DNS servers, even when DHCP runs on the FortiGate.
- Record the DHCP settings with the rest of the configuration backup; a factory reset on an entry-level unit brings back the 192.168.1.x server.
Try it: reset a lab FortiGate and rebuild its LAN DHCP
On a lab FortiGate or FortiGate VM, back up the configuration, then run execute factoryreset2 and confirm that you can still log in on the same address. Note which settings survived. Next, configure a DHCP server on the LAN interface with a range of 50 addresses, a one-day lease and a specific DNS server. Connect a client, find its lease in execute dhcp lease-list, then turn the lease into a reservation from the DHCP monitor and renew the client. Finally, run the sniffer for UDP ports 67 and 68 while the client renews and identify the request and the acknowledgement.
- A factory-default entry-level FortiGate runs a DHCP server on 192.168.1.0/24; keep it off production switches.
factoryreseterases everything;factoryreset2keeps interfaces, routes and system settings for remote access.- Back up first; a reset keeps firmware and definitions but not the configuration.
- A DHCP server belongs to one interface, with ranges, options and reservations; check leases with
execute dhcp lease-list.
Test yourself on factory defaults and DHCP
You manage a remote FortiGate only over SSH on port1. You must remove all its policies and objects but keep reaching it. Which command?
After an engineer configures a factory-reset FortiGate on the office switch, some PCs get 192.168.1.130 with gateway 192.168.1.99. Why?
PCs on port2 get addresses and browse the web, but domain logons fail. The DHCP server has dns-service default. What is the fix?
A DHCP sniffer on port2 shows repeated 'port2 in 0.0.0.0.68 -> 255.255.255.255.67' lines and no 'out' lines. The lease list shows 100 of 100 addresses used. What next?
Which of these is kept by execute factoryreset?
With the unit clean and the LAN served, the next module builds FGT1's rule base, starting with How firewall policies work.