FortiGate Default Password: Login, Reset and Recovery

You typed admin, left the password blank, hit enter, and got rejected. Again.

The credentials aren’t wrong. Your firmware is newer than the guide you’re reading. That’s the single most common reason the FortiGate default password “doesn’t work” in 2026, and almost nothing on page one of Google mentions it.

Here’s what you’ll get in the next five minutes: the actual default credentials, the default IP and which port it lives on, why FortiOS 7.6.5 broke every older tutorial, and the recovery path that works on your specific firmware version. That last part matters more than you’d think. The famous console back door was removed in FortiOS 7.2.4, and plenty of pages still tell you to use it.

We build FortiGate lab workbooks for a living, so we reset these boxes constantly. This guide reflects what actually happens on current firmware, checked against Fortinet’s own documentation on 2026-09-08.

What’s the FortiGate default password?

Straight answer:

Setting	Value
Username	admin
Password	None. Leave it blank
Management IP	192.168.1.99/24
Management port	port1 or the dedicated MGMT port
Web UI	https://192.168.1.99

Every FortiGate ships this way, from a 40F on a shelf to a 4400F in a data centre. There’s no per-model password and no sticker code. If you’re searching for a “FortiGate 100F default password”, it’s the same blank password as everything else.

Fortinet documents it plainly in the default administrator password page of the admin guide: username admin, no password.

The empty field is the answer. Username admin, password nothing at all.

So why does it fail so often? Three reasons, in order of how often we see them:

1. The box isn’t factory fresh. Somebody configured it. A blank password was never going to work.
2. You’re on FortiOS 7.6.5 or newer, where the password policy is now enforced and the login flow changed.
3. You’re on the wrong port. On bigger models, 192.168.1.99 lives on MGMT, not port1.

Sort out which one applies before you reach for a paperclip.

Building a FortiGate lab instead of fixing a live one? Practise on a VM first. Our guide to adding a FortiGate VM to EVE-NG walks through image naming and the VT-x requirement, and you can break a virtual firewall as many times as you like.

What’s the FortiGate default IP address?

192.168.1.99, subnet mask 255.255.255.0.

That address sits in the 192.168.0.0/16 block, one of the private IP ranges reserved by RFC 1918, so it’ll never clash with anything routable on the internet. It will absolutely clash with your home router though, which hands out addresses in the same range on plenty of consumer kit.

Set your laptop to a static address in the same subnet. Something like 192.168.1.50/24. Then browse to https://192.168.1.99.

Two things trip people up here:

Which port? Entry and mid-range models (40F, 60F, 80F, 100F) put the default address on port1. Larger models have a dedicated out-of-band MGMT interface, and that’s where the address lives. Plugging into port5 and wondering why nothing answers is a rite of passage.

Same address on every model. Different port depending on how big the box is.

HTTPS, not HTTP. The FortiGate serves the admin GUI over HTTPS and your browser will complain about the self-signed certificate. Click through the warning. That’s expected on a factory box.

If the address still doesn’t answer, get a console cable on it. Serial console at 9600 baud, 8-N-1, no flow control. Console access bypasses every IP-level problem and you’re going to need it for recovery anyway.

How to log in to a FortiGate for the first time

Four steps on a genuinely factory-default unit:

1. Connect your laptop to port1 (or MGMT on larger models).
2. Give your laptop a static IP in 192.168.1.0/24.
3. Browse to https://192.168.1.99 and accept the certificate warning.
4. Log in as admin, leave the password empty.

On FortiOS 7.6.5 and later, you won’t reach the dashboard yet. The firewall stops you and demands a new password that satisfies its policy. Set it, write it down somewhere real, and carry on.

That prompt isn’t a bug. It’s the change that broke half the tutorials on the internet.

Why the FortiGate default password stopped working in FortiOS 7.6.5

Here’s the shift. Starting in FortiOS 7.6.5, the password policy is enabled and enforced by default, and any admin account that doesn’t meet it gets forced into a password change at next login. Fortinet spells this out in the 7.6.5 password policy documentation.

Before 7.6.5, a blank password logged you straight in and nagged you later. You could ignore the nag for years. Many shops did.

After 7.6.5, the blank password still authenticates, but the session immediately pivots to a mandatory change. If you’re scripting against a fresh box or following a video from 2023, that extra step looks exactly like a failed login.

The password still authenticates on 7.6.5. You just don’t get to the dashboard until you change it.

Picture this. Say you’re Dan, and you’ve just racked a 60F that shipped with 7.6.7 on it. You’ve done this a dozen times on 7.2 boxes.

You SSH in, send admin and an empty password from your provisioning script, and the script dies. You spend forty minutes convinced the unit is faulty or pre-configured, then you finally plug in a console cable and see the password-change prompt sitting there waiting for a human. Forty minutes, one prompt.

The lesson is boring but it saves real time: check the firmware version before you trust any FortiGate guide, including this one. From the CLI, get system status prints it. Fortinet’s own CLI syntax shifts between major releases, so a 6.4 walkthrough will mislead you on 7.6.

Locked out? FortiGate password recovery depends on your FortiOS version

This is where most articles are actively harmful, so read the version boundary carefully.

Your FortiOS version	Recovery path	Do you keep your config?
Before 7.2.4	maintainer account over console	Yes
7.2.4 and later	Config file edit plus TFTP firmware restore	Only if you hold a backup
Any version, maintainer disabled	TFTP firmware restore	Only if you hold a backup

One firmware number decides whether you keep your config or rebuild it. Check before you need to know.

Before FortiOS 7.2.4: the maintainer account

Older FortiGates carry a hidden console-only account. Credentials:

• Username: maintainer
• Password: bcpb followed by the unit’s serial number in uppercase

So a box with serial FGT60FTK1234ABCD takes the password bcpbFGT60FTK1234ABCD.

You need a console cable and you need to be quick. Power cycle the unit, and as it boots you get roughly 14 seconds to type the username and password. Some models give you a little longer, some less. Type it wrong and you power cycle and try again.

Two practical tips. Paste from a text editor rather than typing, because you won’t finish bcpbFGT60FTK1234ABCD by hand in 14 seconds. And if the console prints PASSWORD RECOVERY FUNCTIONALITY IS DISABLED, somebody turned the account off with set admin-maintainer disable under config system global. That path is closed.

FortiOS 7.2.4 and later: config edit plus TFTP restore

Fortinet removed the maintainer account. Their 7.2.4 change note says it directly: the maintainer account, which allowed console login after a hard reboot, has been removed.

There’s no console back door on modern firmware. What’s left:

1. Take your most recent unencrypted config backup.
2. Open it in a text editor and delete the password hash line for the admin account.
3. Console into the unit, interrupt the boot sequence, and format the flash.
4. Load firmware over TFTP.
5. The unit comes up factory default. Restore your edited config.
6. Log in and set a new password.

Notice step 1. Without a backup, you don’t recover your configuration at all. You get a working firewall with an empty config and you rebuild every policy, route, VPN tunnel and security profile by hand.

Say you’re Priya, inheriting a 70F from an engineer who left in March with the credentials in their head. The unit runs 7.4.5. She finds a 2019 blog post, buys a console cable, and spends an afternoon power cycling and typing bcpb plus the serial into a 14-second window that was never going to accept it.

The account hasn’t existed on that firmware since 7.2.4. There was no clever trick available. There was only the question of whether anyone had a config backup, and the answer decided whether the job took twenty minutes or two days.

Back up your configs. Encrypted for storage, and keep one unencrypted copy somewhere controlled, because an encrypted backup can’t be hand-edited during a recovery. That’s the whole insurance policy for this failure mode.

How to find your FortiGate serial number

You need the serial for maintainer recovery on older units, for warranty and FortiCare entitlement checks, and for any RMA conversation. Four ways to get it:

From the GUI. Dashboard > Status > System Information widget. The serial number is listed there.

From the CLI. Run get system status. It returns the serial number along with the firmware version, which is the other thing you need. One command, both answers.

From the chassis. Printed on a label on the underside or the rear of the unit. Handy when you can’t log in at all, which is exactly when you need it for recovery.

Over SNMP. Fortinet exposes the serial through the fnSysSerial object in its core MIB, documented in this Fortinet community article alongside the firmware version OIDs. Useful for pulling an inventory across a fleet rather than clicking through 40 dashboards.

Serials follow a readable pattern. FGT60F plus a string tells you it’s a 60F. The model is encoded in the first characters, which is a quick sanity check when someone sends you a serial and claims it’s something else.

Ready to actually learn this box properly? Our FortiGate NSE4 lab workbook runs 70 hands-on labs on EVE-NG, from first login and admin hardening through to SD-WAN with security profiles. Every topology boots. That’s the point of it.

How to factory reset a FortiGate

A FortiGate factory reset wipes the configuration and returns the unit to the defaults at the top of this page. Two methods. Pick based on whether you can log in.

Logged in? Use the CLI. Locked out? Find a paperclip and watch the LED.

If you can log in: the CLI

execute factoryreset

One word. No space, no hyphen. Worth being fussy about, because Google’s own AI answer for this query currently prints it as execute factory reset with a space, and that returns a parse error on a real box. Fortinet’s CLI reference for execute factoryreset is the authority.

Confirm with y. The unit wipes its configuration and reboots to factory defaults, which means 192.168.1.99, admin, and a blank password again.

Two variants worth knowing:

• execute factoryreset2 resets everything except system and global settings, interfaces, VDOMs and static routes. This is the one that keeps you connected, so it’s what you want when the box is in another building and losing management access means a site visit. Fortinet covers the use case in their note on resetting a FortiGate without losing management access.
• execute factoryreset-shutdown resets and then powers the unit off, rather than rebooting it. Useful when you’re wiping a box before it leaves the building.

If you’re locked out: the pinhole button

1. Unplug the power. Wait 10 seconds or so.
2. Plug it back in and watch the STATUS LED.
3. When STATUS begins blinking slowly, press and hold the recessed RESET button with a paperclip.
4. Hold until the blinking speeds up, then release.
5. The unit resets and reboots.

The timing window is the fiddly part, and published figures disagree. Some sources say press within 20 seconds of boot, others say 40 to 80 seconds, and it genuinely varies by model and firmware. Don’t run a stopwatch. Watch the LED and react to the slow blink. That’s the signal the button is listening for.

The button is labelled RESET or BLE/RESET, and it’s on the back near the power connector on most models, the front on some. Fortinet’s external button reset article has the per-model detail.

One warning worth repeating: a factory reset destroys your configuration. It doesn’t recover it. If you’re resetting because you lost the password, you’re choosing a working firewall with no config over a configured firewall you can’t administer. Make sure that’s the trade you want.

Change the FortiGate default password before the box sees the internet

A blank admin password on a firewall is the security equivalent of a screen door on a vault.

This isn’t theoretical. Changing the default admin password is control 2.4.1 in the CIS Benchmark for FortiGate, and Tenable’s audit item for that control exists precisely because auditors keep finding it unchanged. Fortinet has also shipped a long run of critical SSL VPN advisories over the years, tracked on their PSIRT page, and every one of those is worse on a box with weak admin credentials.

Five things to do in your first ten minutes on a new FortiGate:

• Set a strong admin password. On 7.6.5 and later the firewall makes you. On older firmware, do it anyway.
• Rename or replace the admin account. Create a named super-admin and disable the default one. Attackers guess admin first.
• Restrict admin access to specific interfaces and trusted source IPs. Never leave the GUI reachable from the WAN side.
• Turn on MFA for administrative logins.
• Take a config backup and store it somewhere you’ll find it in a crisis. Then read the recovery section above and understand what you’d actually do.

On the maintainer account: if you’re running pre-7.2.4 firmware, it’s a genuine back door for anyone with physical access and your serial number. Disabling it with set admin-maintainer disable hardens the box. It also means a lost password becomes a full rebuild. Make that call deliberately, and write down which way you chose.

Say you’re Marcus, and a 60F at a branch office dies on a Friday. You’ve got the serial off the chassis label, so the RMA goes in quickly. What you don’t have is a config backup, because the box was set up by a contractor in 2023 and nobody asked.

The replacement unit arrives Monday as a blank firewall. The outage wasn’t the hardware failure. The outage was the missing backup, and it cost three days of rebuilding policies from memory.

Serial number on file, config backup on file. Both take two minutes and both only matter on the worst day.

The bottom line

The FortiGate default password is no password at all, paired with the username admin, on 192.168.1.99. That part hasn’t changed in years.

What has changed is everything around it:

• FortiOS 7.6.5 enforces the password policy by default and forces a change at first login, which is why older guides look broken.
• FortiOS 7.2.4 removed the maintainer console account. On current firmware there’s no back door, only a TFTP restore.
• Your config backup is the difference between a twenty-minute recovery and a two-day rebuild.
• Check get system status first. Version drift is the root cause of most FortiGate access problems, and it’s one command away.

If you’re doing this on a production firewall at 6pm, you have our sympathy. If you’re doing it to learn, do it in a lab where the stakes are zero.

That’s what we build. The FortiGate NSE4 lab workbook gives you 70 tested labs on EVE-NG with topology files that boot, mapped to the current NSE 4 FortiOS 7.6 Administrator blueprint. Start with what FortiGate actually is if you’re new to the platform, or browse the full set of Fortinet workbooks.

Want an instructor answering your questions the same day? SMEnode Academy runs a live NSE 4 FortiGate course over 16 weeks with unlimited lab time.

Either way, get your hands on a FortiGate and reset it a few times before you have to do it under pressure.

FAQ