Thursday, February 25, 2010

Custom DHCP Options in FortiSpeak

Sometimes it is useful to configure certain custom DHCP options in your DHCP scopes. For example to point your clients to a network time server you use DHCP option 42. Also custom DHCP options are typically used for VoIP phones to find their softswitch.

Here are some tips for configuring these parameters properly as it is not entirely obvious. The example I am using is to point some VoIP phones to an IP PBX.
Also see RFC2131 for the official DHCP definition.

Address info:
  • Firewall IP:
  • TFTP Host Name (IP PBX):
  • NTP Server:
  • Phone IP Range: -
  • FTP Username: user1 (this is for the phone to login to the IP PBX)
  • FTP Password: password1

  • Browse to System -> DHCP and create or modify an appropriate DHCP scope
  • Name: VoIP_Phone_Scope
  • IP Range: -
  • Network Mask:
  • Default Gateway:
  • Domain:
  • Click the Advanced button to expand your available options
  • IP Assignment Mode: Server IP Range
  • DNS Server 1:
Now for the fun part, defining the custom options.
  • Option 1: Code = 42, Option = C0A80114
  • This defines the NTP Time Server (Option 42) as (192=C0, 168=A8,1=01,20=14 in hex). You can use the Windows Calculator in scientific mode to do the decimal to hex conversion if you don't do dec to hex in your head :)
  • Option 2: Code = 66, Option = 6674703a2f2f75736572313a70617373776f726431403139322e3136382e312e3130
How do you get this value for option 66? Simply take this string "ftp://user1:password1@" which is what you need to send to the phone and run it through an ASCII to HEX converter, such as Remove any %s or :s from the output and you get the correct hex string.

You can also accomplish the above tasks via the CLI:
  • config system dhcp server
  • edit "dhcp scope name"
  • set option 1 42 C0A80114
  • set option 2 66 6674703a2f2f75736572313a70617373776f726431403139322e3136382e312e3130
  • end


Anonymous said...

Er.. isn't 168 A8, not A0?

Sebastian said...

Of course it is .. isn't that what it says? ;) (Yeah yeah .. I fixed it)

Anonymous said...

Thanks, very helpful. The string value I needed to use was also shown with "quotes" but I had to remove the quotes when I converted to HEX. I had never done this before, so that was not obvious to me.

matthew said...


I hope you can help me.
Im tring to get send my ip phone the address of my NTP server so i have created a option 4 and and converted the ip address to hex the problem is that the ip address that the ip phone get is not the ip address the i converted to hex

hex code"
ip address

for NTP do i just uses the ip adress or should i be useing a different formate?

matthew said...

never mind I have just seen what i was doing wrong

Anonymous said...

Thanks man!

Jason Burns said...

Is there any way to add more than 3 options? I'm using MS Lync and it needs 7 options added.

Anonymous said...

Just wondering if anyone has tried using an MS Server DHCP scope and option 138 to dynamically configure a FortiAP?

My customer has a remote network with DHCP relay to a central server (Windows 2k3), so configuring the Hex option 138 on the FortiGate is not an option. Once would assume that a 'string' type is configured on the MS DHCP scope, but the AP doesn't seem to work with this...

Keen to hear some feedback on this...

John Ward said...

Hi there,
This works for me:

netsh dhcp>server \\
netsh dhcp>add optiondef 138 Capwap IPADDRESS 1 comment=CAPWAP
netsh dhcp>set optionvalue 138 IPADDRESS
netsh dhcp>exit

your ip addresses will obviously be different. ;)


Bubba said...

Sebastian you are my new Hero...nowhere in the Fortinet site could I find information regarding "invalid input option"

Many Thanks my friend....

Sebastian said...

Happy to help "Bubba" :)

Anonymous said...

So how does one know when to use the string versus digit value for the IP address? Example above, it is digit value on option 42, but string on 66.

DIDOCTS said...

John Ward, Awesome answer buddy, it worked perfectly. Muddled through context a little, but in the end I have an option 138 on my win2k8 server. Thanks man!

Raimbert Namukuwa said...
This comment has been removed by the author.