Configure FortiGate as a DHCP Server via GUI and CLI

FortiGate as a DHCP Server

Configuring FortiGate as a DHCP server allows network administrators to easily manage IP address distribution within their network. In this article, we will explore how to configure FortiGate as a DHCP server both via the GUI and CLI, including some advanced configuration options.

A DHCP (Dynamic Host Configuration Protocol) server is used to dynamically assign IP addresses to devices on a network. FortiGate firewalls, aside from their security capabilities, can also act as DHCP servers.

DHCP GUI Configuration

To configure FortiGate as a DHCP server through the graphical user interface (GUI), follow these steps:

Step 1: Access the FortiGate Web Interface

Open a web browser and enter the IP address of the FortiGate device.
Log in using your administrator credentials.

Step 2: Navigate to DHCP Server Settings:

Go to Network > Interfaces.
Select the interface where you want to enable the DHCP server (e.g., internal interface or LAN interface).
Click on the Edit button for that interface.

Step 3: Enable DHCP Server

In the Edit Interface window, scroll down to the DHCP Server section.
Check the Enable DHCP Server box to activate the DHCP server on that interface.

Step 4: Configure DHCP Server Settings:

DHCP Range: Specify the range of IP addresses that the server will assign to clients (e.g., 192.168.20.110 to 192.168.20.210).
Subnet Mask: Set the subnet mask for the DHCP clients (e.g., 255.255.255.0).
Gateway IP: Define the default gateway IP address for the clients (usually the IP address of the FortiGate interface).
DNS Server: Optionally, configure the DNS servers that the clients should use. In my case I am using Google DNS Servers.

If you need to make IP ADress Reservation you can add MAC Adress of device and IP Adress in the “MAC Reservatrion” Table:

Step 5: Save the Configuration:

After entering the necessary information, click OK to save the settings.

DHCP CLI Configuration

For administrators who prefer the command-line interface (CLI) or need to automate the configuration, setting up a DHCP server via CLI is also straightforward.

Step 1: Access the FortiGate CLI

You can access the CLI through the console or SSH by connecting to the FortiGate device.

Step 2: Enable the DHCP Server on an Interface

Use the following command to configure the DHCP server on a specific interface (e.g., internal):

fgt-remote1 # config system dhcp server
fgt-remote1 (server) # edit 1
fgt-remote1 (1) # get
id                  : 1
status              : enable
lease-time          : 604800
mac-acl-default-action: assign
forticlient-on-net-status: enable
dns-service         : specify
wifi-ac1            : 0.0.0.0
wifi-ac2            : 0.0.0.0
wifi-ac3            : 0.0.0.0
ntp-service         : specify
domain              :
wins-server1        : 0.0.0.0
wins-server2        : 0.0.0.0
default-gateway     : 192.168.20.1
next-server         : 0.0.0.0
netmask             : 255.255.255.0
interface           : internal
ip-range:
    == [ 1 ]
    id:     1
timezone-option     : default
tftp-server         :
filename            :
options:
server-type         : regular
conflicted-ip-timeout: 1800
auto-configuration  : enable
ddns-update         : disable
vci-match           : disable
exclude-range:
reserved-address:
dns-server1         : 8.8.8.8
dns-server2         : 8.8.4.4
dns-server3         : 0.0.0.0
ntp-server1         : 0.0.0.0
ntp-server2         : 0.0.0.0
ntp-server3         : 0.0.0.0


fgt-remote1 (1) #

In this configuration:

interface: The network interface where the DHCP server is enabled (e.g., internal).
lease-time: The lease time for IP addresses.
subnet: The network address and subnet mask.
range-start and range-end: The start and end of the IP address range that the DHCP server will assign to clients.
default-gateway: The default gateway for clients.
dns-server1 and dns-server2: DNS server addresses for clients.

Step 3: Verify DHCP Server Configuration

After configuring the DHCP server, you can verify the settings with the following command: show system dhcp server

fgt-remote1 # show system dhcp server
config system dhcp server
    edit 1
        set default-gateway 192.168.20.1
        set netmask 255.255.255.0
        set interface "internal"
        config ip-range
            edit 1
                set start-ip 192.168.20.110
                set end-ip 192.168.20.210
            next
        end
        set timezone-option default
        set dns-server1 8.8.8.8
        set dns-server2 8.8.4.4
    next
end

Conclusion

Configuring FortiGate as a DHCP server, either via the GUI or CLI, is a simple yet powerful way to manage IP address allocation for your network devices. By following the steps outlined above, you can easily set up a DHCP server, customize the IP address range, and apply advanced options like static IP mapping, TFTP server configuration, and DHCP relay. The flexibility offered by FortiGate allows you to fine-tune your DHCP settings to meet the specific needs of your network.