highlights and lowlights of the daily business of network engineers

Download als PDF File

Fortinet has changed the first-boot experience on newer FortiGate G-series appliances: before the firewall can be fully configured, it must be registered with FortiCare. On paper that sounds harmless. In the rack, with a fresh FortiGate-200G and no predefined WAN port, it is one of those small changes that can cost real setup time.

This note documents the new behavior, what still works before registration, and the practical workaround I used to bring a FortiGate-200G online on FortiOS v7.4.9.

Source reference: Fortinet Technical Tip: Enforcing FortiCare registration starting from v7.2.11, v7.4.8, v7.6.5, v8.0.0

The New First Login

After the initial admin login, FortiGate forces a password change as usual. The difference comes right after that:

FortiGate-200G login: admin
Password:
Verifying password...

You are forced to change your password. Please input a new password.
New Password:
Confirm Password:
Verifying password...
Welcome!

The device is not registered with Forticare.
any configuration change is not allowed.

The important part is the last line. The appliance is not just reminding you to register; it actively blocks most configuration until the serial number is linked to a FortiCare account and the device can validate that state.

Which Versions Are Affected?

Fortinet documents the enforcement for FortiOS v7.2.11, v7.4.8, v7.6.5, v8.0.0 and later on newer FortiGate G-series platforms.

The behavior depends on the exact FortiOS version:

Check the installed version from the CLI:

diagnose sys device
get system status

Example:

FortiGate-200G # get system status
Version: FortiGate-200G v7.4.9,build2829,250924 (GA.M)
First GA patch build date: 230509

What Still Works Before Registration

The warning says that configuration changes are not allowed, but Fortinet still permits a limited set of CLI locations. The intent is simple: you must be able to give the box internet access so it can register.

Allowed before registration according to the Fortinet article:

config firewall policy
config router static
config router static6
config system arp-table
config system dhcp
config system dhcp6
config system evpn
config system geneve
config system gre-tunnel
config system interface
config system ipip-tunnel
config system ipsec-aggregate
config system ipv6-neighbor-cache
config system link-monitor
config system mobile-tunnel
config system nd-proxy
config system pppoe-interface
config system proxy-arp
config system sdwan
config system speed-test-schedule
config system vdom-link
config system virtual-wire-pair
config system vne-interface
config system vxlan
config system zone

On FortiOS v7.4.12, v7.6.7 and later, Fortinet adds more editable paths before FortiCare registration:

config system admin
config system central-management
config system dns
config system interface
config system pppoe-interface
config system settings

An allowed command still opens normally:

FortiGate-200G # config system zone

FortiGate-200G (zone) #

A blocked command fails immediately:

FortiGate-200G # config system global

command parse error before 'global'
Command fail. Return code 1

The 200G Catch: No Predefined WAN Port

Small FortiGate models usually have a predefined wan interface. Plug in a cable, get DHCP, receive a default route, and the registration flow can continue.

The FortiGate-200G I tested did not have that convenience. Its default interface list included mgmt, many numbered ports, x1 to x8, fortilink, and a lan hard-switch. There was no ready-to-use WAN interface pulling DHCP.

The mgmt interface was statically configured, and on this v7.4.9 system the virtual switch could not be changed before registration:

FortiGate-200G # config system virtual-switch

command parse error before 'virtual-switch'
Command fail. Return code 1

That leaves the practical path: use the existing lan hard-switch as the temporary internet-facing interface, switch it to DHCP, let it receive a default route, and then let FortiCare validation complete.

Step 1: Register the Serial Number First

The cleanest start is to register the serial number directly in the Fortinet support portal before fighting the CLI.

Portal: https://support.fortinet.com

Use the serial number from the device label, invoice, or CLI output. If the device is part of a bundle, no separate registration code may be required.

Step 2: Remove the DHCP Server Reference on lan

On the tested 200G, changing lan to DHCP failed because the interface was still used by a built-in DHCP server:

FortiGate-200G (lan) # set mode dhcp
FortiGate-200G (lan) # end
This interface is being used by one or more dhcp servers.
attribute set operator error, -236, discard the setting
Command fail. Return code -236

Inspect the DHCP server table:

config system dhcp server
show

Example default entries:

config system dhcp server
    edit 1
        set default-gateway 192.168.100.99
        set netmask 255.255.255.0
        set interface "lan"
        config ip-range
            edit 1
                set start-ip 192.168.100.110
                set end-ip 192.168.100.210
            next
        end
    next
    edit 2
        set default-gateway 192.168.1.99
        set netmask 255.255.255.0
        set interface "mgmt"
    next
    edit 3
        set default-gateway 10.255.1.1
        set netmask 255.255.255.0
        set interface "fortilink"
    next
end

Delete the DHCP server entry that references lan. In my fresh lab setup I removed the default entries because I did not need them at this stage:

config system dhcp server
delete 1
delete 2
delete 3
end

Step 3: Turn lan Into the Temporary WAN

Now set the lan hard-switch to DHCP and mark its role as WAN:

config system interface
    edit "lan"
        set mode dhcp
        set role wan
    next
end

Connect the upstream network to a port that belongs to the lan hard-switch. If DHCP works, the FortiGate should receive an address and a default route.

Step 4: Verify IP, Default Route, and Internet Access

Check the interface state:

get system interface

Example:

== [ lan ]
name: lan   mode: dhcp    ip: 172.30.15.239 255.255.255.0   status: up    type: hard-switch

Check the routing table:

get router info routing-table all

Example:

S*      0.0.0.0/0 [5/0] via 172.30.15.1, lan, [1/0]
C       172.30.15.0/24 is directly connected, lan

Test internet reachability:

execute ping 8.8.8.8

Example:

PING 8.8.8.8 (8.8.8.8): 56 data bytes
64 bytes from 8.8.8.8: icmp_seq=0 ttl=112 time=7.6 ms
64 bytes from 8.8.8.8: icmp_seq=1 ttl=112 time=7.5 ms

Step 5: Trigger FortiCare Validation

Once the serial number is registered and the FortiGate has internet access, trigger an update check:

execute update-now

Then reboot:

execute reboot

After reboot, log in again and test a previously blocked configuration path:

FortiGate-200G # config system global

FortiGate-200G (global) #

If config system global opens, the appliance is no longer blocked by the pre-registration restriction.

Quick Runbook

For a fresh FortiGate-200G on v7.4.9, the shortest path was:

1. Register the serial number on support.fortinet.com.
2. Log in on the CLI and change the admin password.
3. Check FortiOS version with get system status.
4. Remove the DHCP server reference that blocks changing lan to DHCP.
5. Set lan to DHCP and role wan.
6. Verify DHCP address, default route, and internet reachability.
7. Run execute update-now.
8. Reboot.
9. Confirm that blocked config paths such as config system global now work.

Final Thought

The registration requirement is understandable from a licensing and support perspective. The operational friction appears when a model like the 200G ships without a predefined DHCP WAN interface and with default references that block the obvious workaround.

The useful mental model is: before registration, do not try to fully configure the firewall. Configure only enough networking to let FortiCare see the device. Once that state is validated, the FortiGate behaves like a normal configurable appliance again.

Samuel Heinrich

Senior Network Engineer at Selution AG (Switzerland)

Arbeitet in Raum Basel (Switzerland) als Senior Network Engineer mit über 15 Jahren Erfahrung im Bereich Netzwerk