diff --git a/scripts/discover-fortigate.sh b/scripts/discover-fortigate.sh
index 982dd54..908103a 100755
--- a/scripts/discover-fortigate.sh
+++ b/scripts/discover-fortigate.sh
@@ -47,9 +47,17 @@ USER="${FORTIGATE_SSH_USER:-admin}"
 # signal when the command returns empty. Let them flow to the caller.
 
 raw=""
-for cmd in 'execute dhcp lease-list all' 'execute dhcp lease-list'; do
-  raw=$(ssh -o StrictHostKeyChecking=accept-new "$TARGET" "$cmd" || true)
-  if [ -n "$raw" ] && ! grep -qiE 'unknown action|parse error|command fail' <<<"$raw"; then
+# Try the plain form first — works across FortiOS versions. `all` is
+# an interface name on some devices but errors with "Interface name
+# 'all' does not exist" on others (including 7.x ana-gw). Fall back
+# to `all` only if the plain form returns no lease rows.
+for cmd in 'execute dhcp lease-list' 'execute dhcp lease-list all'; do
+  out=$(ssh -o StrictHostKeyChecking=accept-new "$TARGET" "$cmd" || true)
+  # Accept only output that actually contains at least one IP-like token.
+  # This filters out "Interface name X does not exist" and similar noise
+  # without needing to enumerate every FortiOS error phrase.
+  if grep -qE '([0-9]+\.){3}[0-9]+' <<<"$out"; then
+    raw="$out"
     break
   fi
 done