Addressing & Services
Reserve a fixed IP for a device (static DHCP)
Always give a specific MAC address the same IP, without configuring the client.
Why it differs: Mostly a convenience difference: some vendors let you promote an existing lease in one click, others make you type the MAC by hand.
Router / switch / AP
MikroTik RouterOS
GUI or CLIWritten against RouterOS 7.x
Steps
- Easiest: IP → DHCP Server → Leases, right-click the existing dynamic lease → Make Static, then edit the address if needed.
- CLI from scratch:
/ip dhcp-server lease add address=192.168.10.50 mac-address=AA:BB:CC:DD:EE:FF server=dhcp10 comment="printer" - Promote an existing lease:
/ip dhcp-server lease make-static [find mac-address="AA:BB:CC:DD:EE:FF"]
Gotchas & notes
- Make Static is the right workflow — it captures the MAC correctly and avoids typos. Typing MACs by hand is where reservations go wrong.
- A static lease address inside the pool range is fine and normal in RouterOS; it does not need to be outside the pool.
- Setting
address-lists on a lease automatically adds the client to a firewall address list — a genuinely useful RouterOS-only trick for per-device firewall rules. - A static lease with the wrong
server= value never matches. Check it when a reservation is ignored.
Vendor documentation ↗NGFW / router
Fortinet FortiGate (FortiOS)
GUI or CLIWritten against FortiOS 7.2 – 7.6
Steps
- GUI: Network → Interfaces → edit the interface → DHCP Server section → *Advanced* → IP Address Assignment Rules / *MAC Reservation + Access Control* → add the MAC and IP.
- Or from the monitor: Dashboard → DHCP monitor, select a lease, and create a reservation.
- CLI:
config system dhcp server → edit <id> → config reserved-address → edit 1 → set mac AA:BB:CC:DD:EE:FF → set ip 192.168.10.50 → next → end → end
Gotchas & notes
- The setting is buried under the interface's DHCP *Advanced* options; there is no top-level reservations page, which makes it hard to find and hard to audit.
- The same
reserved-address table also does MAC access control (set action block) — the fastest way to deny an address to a specific device. - A reservation does not take effect until the client's current lease expires or is cleared with
execute dhcp lease-clear <mac>.
Vendor documentation ↗Controller-managed gateway / switch / AP
Ubiquiti UniFi Network
GUIWritten against UniFi Network 8.x – 9.x (UDM / UDM-Pro / UXG)
Steps
- Clients → click the client → Settings / Config → set *Fixed IP Address*, choose the network, enter the IP.
- Save. The client keeps its DHCP lease but always receives that address.
- For a device not yet seen, add it manually under the client list (varies by version).
Gotchas & notes
- Reservations are attached to the client object, not to the DHCP scope — so the list of reservations is not visible in one place, which makes auditing awkward.
- 'Forgetting' a client in the UniFi UI deletes its fixed IP and name along with its history. This is the usual cause of reservations mysteriously disappearing.
- The fixed IP can be outside the DHCP range and usually should be, to keep static assignments visually separate.
- The client must reconnect (or the lease expire) before the new address applies.
Vendor documentation ↗Router / switch
Cisco IOS / IOS-XE
CLIWritten against IOS-XE 17.x (Catalyst 9000, ISR 1000/4000)
Steps
ip dhcp pool PRINTER → host 192.168.10.50 255.255.255.0 → client-identifier 01aa.bbcc.ddee.ff → default-router 192.168.10.1- Alternative on some versions:
hardware-address aabb.ccdd.eeff instead of client-identifier. - Verify:
show ip dhcp binding
Gotchas & notes
- A reservation is its own DHCP pool on IOS — one pool per reserved host, which is verbose and the reason few people use IOS DHCP at scale.
client-identifier needs the MAC prefixed with the media type (01 for Ethernet) and in dotted format: 01aa.bbcc.ddee.ff. Getting this format wrong is the usual failure, and there is no error message.- If
client-identifier does not work, try hardware-address aabb.ccdd.eeff — different client DHCP implementations send different identifiers. - Clear the existing binding after adding the reservation:
clear ip dhcp binding <old-ip>.
Vendor documentation ↗NGFW
Palo Alto Networks PAN-OS
GUI or CLIWritten against PAN-OS 10.2 / 11.x
Steps
- Network → DHCP → DHCP Server → select the server → Reserved Address section → Add the IP and the MAC.
- Commit.
- Verify:
show dhcp server lease interface <int>
Gotchas & notes
- The reserved address must be inside the configured pool, unlike several other vendors where it should be outside. PAN-OS reserves it from the pool rather than adding it.
- Requires a Commit, and the client needs to renew before it picks up the new address.
- The reservation list is per-DHCP-server and visible in one place — better for auditing than FortiGate or UniFi.
Vendor documentation ↗Router / firewall (FreeBSD)
Netgate pfSense CE
GUIWritten against pfSense CE 2.7 / Plus 24.x
Steps
- Fastest: Status → DHCP Leases → find the device → click the + / Add static mapping button next to it (pre-fills the MAC).
- Or Services → DHCP Server → <interface> → DHCP Static Mappings → Add and enter MAC, IP, hostname, description.
- Save → Apply Changes.
Gotchas & notes
- The one-click promote from Status → DHCP Leases is the best version of this workflow across all six vendors — it fills in the MAC and hostname for you.
- By default pfSense recommends the static IP be outside the dynamic pool range; addresses inside the pool work but can conflict depending on backend.
- Setting the *Hostname* field also registers the name in the DNS Resolver (if *Register DHCP static mappings in DNS Resolver* is enabled), giving you internal DNS for free — a commonly missed benefit.
- Static mappings can carry their own DNS/gateway/option overrides per host, which is useful for lab devices.
Vendor documentation ↗NGFW
SonicWall (SonicOS)
GUIWritten against SonicOS 7.3.x (Gen7 TZ/NSa/NSsp; current General Release line is 7.3.2/7.3.3 — note Gen8 TZ80/TZ280+/NSa 2800+ hardware instead runs the separate SonicOS 8.x line)
Steps
- MANAGE → Network → DHCP Server → Current DHCP Leases tab shows active leases with MAC, IP, and hostname.
- For a device that has already pulled an address: select its lease row and click Add to Reservations (sometimes shown as a 'convert to static' action icon) — this is the one-click path.
- For a device that has not leased yet: open the relevant scope and enter the MAC Address and desired Reserved IP directly in its reservation list.
- Save. The client picks up the reserved address on its next DHCP renewal, or force it by releasing/renewing on the client.
Gotchas & notes
- The 'promote an existing lease' shortcut only works while the lease is still live in the table — once it expires you're back to typing the MAC address in by hand.
- Reservations are stored inside the scope, not as standalone objects — deleting the DHCP scope deletes its reservations with it.
- No CLI path exists for this at all on SonicOS; it's strictly a GUI action, in line with SonicWall keeping service-level config out of the E-CLI.
- SonicWall recommends keeping the reserved address outside the scope's dynamic range; a reservation inside the active pool can occasionally lose a race to a different client if the reservation and the dynamic lease table are read at slightly different times.
Vendor documentation ↗Cloud-managed business routers, switches & Orbi Pro/WiFi APs
NETGEAR Insight (Cloud Management Platform)
GUI or CLIWritten against Insight Cloud Portal/App 10.0.x (cloud mgmt); switch-side CLI varies by line — Smart Switch "Lite CLI" firmware 6.0.10.5+/7.0.9.5+, fully-managed M4200/M4300 CLI 12.0.11.x
Steps
- Insight portal/app: Locations → [location] → Devices → [router or Orbi Pro] → LAN Settings → DHCP Reservations (or the Clients list) → click a currently-connected client → Reserve IP (auto-fills the MAC), or use Add Reservation to type in the MAC and desired IP by hand.
- No CLI equivalent on routers/Orbi Pro — same story as DHCP server itself: cloud GUI only.
- Smart Switches: not applicable — no DHCP server on the switch means no reservation feature to look for.
- M4200/M4300: a fixed binding lives inside the
ip dhcp pool you already created, as its own sub-object rather than a 'promoted lease.' GUI: DHCP Server → Pool → Static/Fixed Bindings → Add (name, IP, MAC). CLI: inside the ip dhcp pool <name> context, host <ip> <mask> followed by hardware-address <mac> (or client-identifier for identifier-based binding) — confirm exact keywords on-box since they can shift between 12.0.x firmware builds.
Gotchas & notes
- One-click 'promote this lease to a reservation' only exists on the router/Orbi Pro side via the Insight Clients list. On the M4200/M4300 you always type the MAC by hand — there's no equivalent promote button.
- Because DHCP server only exists on routers, Orbi Pro, and the M4300 L3 tier, 'reserve a static IP' simply isn't a feature anywhere else in the lineup — e.g. a plain Insight-managed Smart Switch has nothing to configure here, don't go hunting for it.
- Insight reservations match on MAC, not port/VLAN — if a reserved device gets moved to a different VLAN/subnet on the same router, the reservation's IP can silently fall outside the new subnet's range and just stop applying.
Vendor documentation ↗