Troubleshooting Tip: DHCP client cannot be enabled on the mgmt interface using the CLI

[zromano]

Description	This article describe why DHCP client can't be enabled on the dedicated management interface using the CLI and how to change the default behavior.
Scope	FortiGate models with mgmt/mgmt1/mgmt2 interfaces.
Solution	Some FortiGates have a dedicated out-of-band management interface (mgmt). Some high-end models have two (mgmt1 and mgmt1). This interface is usually used in the initial configuration, and a DHCP server is configured on the mgmt interface, so that connecting a laptop to the mgmt interface the PC can receive an IP and have quick access to the FortiGate. In certain cases, it might be required for the mgmt interface to receive an IP through DHCP. By default, the mgmt interface is dedicated to out-of-band management and has a DHCP server configured on it. show system interface mgmt config system interface    edit "mgmt"        set vdom "root"        set ip 192.168.1.99 255.255.255.0        set allowaccess ping https ssh        set type physical        set dedicated-to management    <- Dedicated to out-of-band management.        set role lan        set snmp-index 1    next end show system dhcp server config system dhcp server     edit 1         set dns-service default         set default-gateway 192.168.1.99         set netmask 255.255.255.0         set interface "mgmt"    <- DHCP configured on mgmgt interface.             config ip-range                 edit 1                     set start-ip 192.168.1.110                     set end-ip 192.168.1.210                 next             end         next     end With this default configuration, the DHCP client on the mgmt interface cannot be enabled using the CLI. Using the GUI to enable the mgmt interface to receive an IP through DHCP will automatically remove the above configuration. In order to use the DHCP client on the mgmt interface and receive an IP, the above configuration must be removed. Otherwise, trying to enable DHCP mode on the interface will return an error as shown below: conf sys interface FortiGate (interface) # edit mgmt FortiGate (mgmt) # set mode ? command parse error before 'mode' set mode dhcp command parse error before 'mode' Command fail. Return code -61 The DHCP Server and the dedicated out-of-band management can be removed with the following commands. In this example, the ID for the DHCP server is '1', as indicated in the 'show system dhcp server' output above, but it might be different in other configurations. conf sys dhcp server FortiGate (server) # delete 1 FortiGate (server) # end conf sys interface FortiGate (interface) # edit mgmt FortiGate (mgmt) # unset dedicated-to Warning: dedicated-to value is changed to none! FortiGate (mgmt) # end After, it will be possible to enable the DHCP client on the mgmt interface: conf sys interface FortiGate (interface) # edit mgmt FortiGate (mgmt) # set mode dhcp FortiGate (mgmt) # end The following command can be used to check that the interface received an IP in the correct subnet: diagnose ip address list | grep mgmt IP=192.168.0.10->192.168.0.10/255.255.255.0 index=4 devname=mgmt Note: Using the GUI to enable the DHCP client on the mgmt interface will automatically remove the DHCP server and the 'dedicated-to management' setting. For more information about the out-of-band management interface, see Technical Tip: FortiGate dedicated - mgmt feature - Out-of-band Management.