Fortinet

Fortinet FortiGate 40F Password Recovery

Step-by-step password recovery for the Fortinet FortiGate 40F (FortiGate 40/60/80 (FortiOS)). Console access required.

Overview

This guide provides step-by-step instructions for resetting lost or forgotten administrative passwords on enterprise networking hardware. Follow the procedure below carefully to regain access while preserving your device configuration.

Prerequisites

Before proceeding with password recovery, ensure you have a console cable, terminal emulation software configured to 9600 baud, and physical access to the device.

Step 1: Establish Console Connection

Connect your terminal cable to the console port of the device and open your serial terminal session.

Step 2: Interrupt the Boot Sequence

Power cycle the hardware and issue a Break key sequence during initial system startup to enter ROMMON mode.

Step 3: Reset Password & Configuration

Bypass startup configuration loading, boot into system software, set your new credentials, and save changes back to non-volatile memory.

Overview

This procedure recovers administrator access to the Fortinet FortiGate 40F running FortiOS when the admin password is lost. The FortiGate's built-in configuration menu (reached during boot) resets the admin password or formats the device — the config-preserving option keeps your configuration.

Prerequisites

Console cable (RJ-45 on 40F/60F/70F/80F/100F; USB on some desktop models) with a terminal session at 9600 baud, 8N1. Physical or remote power access to reboot the FortiGate.

Recovery Procedure — Boot Configuration Menu (password reset, config preserved)

Connect the console cable and open a terminal session (9600 8N1).
Reboot the FortiGate (power-cycle or execute reboot if you have access).
During boot, when the message "Press any key to display configuration menu" appears (shown for a few seconds, typically after the FortiOS banner), press any key.
The configuration menu appears with options like:
[1] Check system file
[2] Format system file
[3] Get firmware version
[4] Run maintenance
[5] Config console
(the numbering varies by FortiOS version)
Select the "Config console" option (typically option 5 on older FortiOS, option 1 on FortiOS 7.x).
From the config console menu, select "Reset Administrator password" (often 'R' or option 1).
Follow the prompts — the FortiGate confirms the admin password reset and reboots.
After reboot, log in via console or web as admin with a blank password (or the temporary password shown on some versions), then set a new admin password: config system admin → edit admin → set password <new-password> → next → end.

Recovery Procedure — Factory Reset (destructive, last resort)

Reboot and enter the configuration menu as above.
Select the "Format system file" option (option 2 on most versions). This wipes the configuration and resets the FortiGate to factory defaults.
The FortiGate formats and reboots with factory settings — log in as admin with no password and complete initial setup.
Restore your configuration from a backup: execute restore config tftp://<server>/<backup-file> (from CLI) or via the web UI (System → Advanced → Restore).

Important Notes

FortiOS version differences: on FortiOS 7.x the menu options are numbered differently ([1] Config console, [2] Format, [3] Maintainer...). Read the menu carefully before selecting — "Format" wipes everything, "Config console → Reset Administrator password" preserves the config.
The maintainer/backup firmware option boots the previous firmware version — useful if the current firmware is corrupt, not for password recovery.
Desktop models (40F/60F/80F) use a micro-USB or RJ45 console; the boot menu appears only during the first seconds of boot — if you miss the window, reboot and try again.
If the FortiGate is managed by FortiManager or FortiCloud, restoring from the manager may overwrite the local admin password — re-register the device after recovery.
Baud rate is 9600 on FortiGate models.

Protecting Your Configuration

Before recovery, back up the config: execute backup config tftp://<server>/<filename> or via the web UI (System → Advanced → Backup). Keep a copy off-device — the config-preserving password reset keeps settings, but a format wipes them.