Last DCHP lease

[krizzy]

Does anyone know how I can see the last given DHCP lease?

I have a device that supposedly grabs a DHCP address but the vendor says he does not know a mac address nor hostname and trying to get the user to trace the cable and give me the switch info will be a nightmare.

So my question is, if I get the user to plug and unplug the device, is there a way to see the device getting a DHCP lease in the fortigate? Either Web or CLI would be fine.

[sagha]

Hi krizzy, 

I am not sure about last lease but you can run command 'execute dhcp lease-list' to look for all the clients having DHCP lease list. 

You can also run a packet capture on port67 and port68 via GUI that can help in generating DHCP packets.

Thanks, 

Shahan

[pminarik · Accepted solution]

System event log, filter for event ID 26001, Log description "DHCK Ack Log". This event is logged every time a DHCP ACK message is sent. It shows the MAC, IP assigned, and interface.

https://docs.fortinet.com/document/fortigate/7.0.6/fortios-log-message-reference/26001/26001-log-id-...