REIMAGE FORTINET OS AND RESTORE BACKUP CONFIG

Connect your PC's Ethernet port directly to the FortiGate's MGMT port using an RJ-45 cable.

• Open Windows Network Connections (ncpa.cpl).

• Open Internet Protocol Version 4 (TCP/IPv4) Properties on the connected adapter.

• Select Use the following IP address and set:

  • IP address: 192.168.1.100

  • Subnet mask: 255.255.255.0

  • Leave Default gateway and DNS entries blank.

Verification: Open Command Prompt and run ipconfig to confirm your adapter reflects 192.168.1.100.

Open Windows Defender Firewall with Advanced Security.

• Ensure firewall profiles (Domain Profile, Private Profile, and Public Profile) are turned off to prevent blocking inbound TFTP UDP port 69 traffic.

Verification: The overview pane displays "Windows Defender Firewall is off" for all three profiles.

• Place your downloaded FortiOS firmware file (image.out) in a dedicated folder (e.g., FG Firmware).

• Launch Tftpd64. Under Current Directory, browse to the folder containing image.out.

• Set the Server interfaces drop-down to 192.168.1.100.

Verification: Click Show Dir in Tftpd64 and confirm image.out appears in the file directory list.

• Connect an RJ-45 to USB console cable to the FortiGate CONSOLE port.

• Open PuTTY, select Serial, enter your active port (e.g., COM8), and set the speed to 9600 baud (8-N-1).

• Power-cycle the FortiGate. When the message Please wait for OS to boot, or press any key to display configuration menu... appears, press any key immediately.

Verification: PuTTY displays the boot configuration menu listing commands [C], [R], [T], [F], etc.

• Type F at the prompt.

• When prompted with It will erase data in boot device. Continue? [yes/no]:, type yes and press Enter.

Verification: The console prints Formatting.........done followed by Done. and returns to the menu prompt.

• Type C to set up connection parameters (TFTP Server IP 192.168.1.100, Local IP 192.168.1.99, Firmware Image Name image.out).

• Type T to initiate the transfer. The unit will display Connect to tftp server 192.168.1.100 ... followed by hashes (#).

• Once Image Received. Checking image... OK appears, choose:

  • Save as Default firmware/Backup firmware/Run image without saving: [D/B/R]? → Type d.

  • The default and backup firmware will be lost. Continue: [Y/N]? → Type Y.

Verification: PuTTY shows Programming the boot device now..., Verifying..., and the unit reboots into partition formatting and system initialization.

Open a Windows Command Prompt window and execute:

ping 192.168.1.99 -t

While the FortiGate builds the filesystem and starts daemons, you will see timeouts.

Verification: The command begins receiving continuous replies (Reply from 192.168.1.99: bytes=32...), confirming default management services are operational.

• Open a browser and navigate to [https://192.168.1.99](https://192.168.1.99).

• Log in with username admin and leave the password blank.

• On the Change Password screen:

  • Leave Old Password blank.

  • Enter and confirm your new administrator password, then click OK.

• Re-login using admin and the newly created password.

• On the Automatic Patch Upgrades setup screen:

  • Select Disable automatic patch upgrades.

  • Click Save and continue.

  • Check the I acknowledge box in the confirmation prompt and click OK.

Verification: You are redirected to the FortiGate Web GUI Dashboard.

• In the top-right corner of the Dashboard, click on the admin profile name and navigate to Configuration > Restore.

• Select Local PC and click Upload.

• Browse and select your configuration backup file (.conf) and click Open.

• Enter the configuration password if the file is encrypted, then click OK.

• On the confirmation dialog (Restoring a global system configuration will cause the device to reboot...), click OK.

Verification: The browser displays the System Rebooting screen (Please wait while the system reboots.).

Because restoring the backup replaces the default factory IP with your previously configured production settings, DDNS, and custom ports:

• Open Command Prompt and ping your restored production domain or IP (e.g., ping rcsvillasis.fortiddns.com -t).

• Once the unit finishes rebooting and resolves on the network, navigate to your custom access URL (e.g., [https://rcsvillasis.fortiddns.com:9443](https://rcsvillasis.fortiddns.com:9443)).

• Log in with your restored administrative credentials (e.g., username krumayam and your production password).

Verification: You successfully log into the dashboard with all prior firewall policies, VPNs, interfaces, and hostnames intact.