FCP FortiManager 7.4 cheat sheet

FortiManager 7.4 deployment modes: standalone (single unit), HA (primary/secondary with up to 4 secondaries), and the deprecated collector/analyzer split; the collector role is merged into the main unit in 7.x.

HA failover is triggered by monitored interface link failure, a dead heartbeat peer, or the primary losing its FortiGuard connectivity; heartbeat runs over TCP port 8443 by default.

Default management ports: GUI/API over HTTPS 443, admin SSH 22, FortiGate-to-FortiManager FGFM tunnel over TCP 541. FGFM traffic is encrypted and authenticated by the device serial and registration password.

Admin profiles are permission bundles (none/read/write per area plus scope). The built-in Super_User profile has full access and cannot be edited; the built-in Standard_User profile is read-only on most areas.

Workspace mode (System Settings > Admin > Workspace mode) locks an admin's changes into a private workspace until committed; in normal mode edits write to the shared ADOM immediately.

ADOM modes: Normal (mixed devices), Backup (config-only storage, no policy push), and IPS Manager/others per license. Device counts against an ADOM limit; the root ADOM cannot be deleted.

Backup strategy: config backup from System Settings > Dashboard > Backup, or scheduled backups; restore requires a matching or newer firmware. Revisions per ADOM are limited by the 'max revisions' setting and can be pruned.

Firmware upgrade path: upload the image to FortiManager, upgrade ADOMs (ADOM upgrade is mandatory before managing devices on the new firmware), then upgrade managed devices. ADOM version must be >= device firmware.

Licensing: FortiManager is licensed per managed device (or by VM CPU/RAM tier). Adding a device beyond the license blocks registration until the license is updated.

Device registration methods: auto-discovery (FGFM from the FortiGate with the FortiManager IP configured), add-by-serial with a pre-shared registration password, and 'Add Device' wizard using admin credentials.

Provisioning templates: model devices (offline/pre-provisioned) use model device entries in the ADOM; on first connect the model device is matched by serial and its template config is pushed.

A device can only belong to one ADOM. Moving a device between ADOMs requires deleting it from the source ADOM (or using 'Move' which preserves policy assignments if object names match).

Config status indicators: synchronized (green), modified/out-of-sync (yellow), conflict (red). 'Retrieve' pulls config from the device; 'Install' pushes FortiManager config to the device.

Revision history stores per-device config snapshots; you can diff two revisions and roll back. Device-level revisions are separate from ADOM policy revisions.

Device groups are logical groupings used for policy package assignment and install targets; group membership does not affect object scope.

Meta fields are custom key/value attributes on devices used for dynamic grouping and reporting; they do not affect configuration push.

'Import Configuration' from a device creates a policy package and address/service objects from the device's running config; the imported objects land in the ADOM database.

Object scope: global objects live in the Global Database and are inherited read-only by ADOMs unless overridden; ADOM-level objects are local to that ADOM. 'Per-ADOM' objects shadow global objects of the same name.

Policy packages contain firewall policies, and are assigned to devices or device groups. A device can have multiple policy packages but only one is installed at a time per VDOM mapping.

Installation targets: install a policy package to a device/VDOM; FortiManager pushes only the delta (changed objects/policies) and reports per-device install status.

Policy order matters: FortiManager evaluates top-down like the FortiGate. 'Move' and 'Insert' operations rewrite sequence numbers; the implicit deny sits at the bottom and is not shown as a policy.

Interface mapping: policy packages reference interfaces by name; when installing to a device whose interfaces differ, use the install wizard's interface mapping or the package will fail validation.

Dynamic objects: 'Install On' for firewall addresses can be limited to specific devices; objects not installed on a target are omitted from that device's config.

VPN Manager builds IPsec tunnels from a 'VPN community' (hub/spoke or full mesh) and auto-generates the phase1/phase2 and policy entries; the generated policies appear in the policy package if 'auto-create' is enabled.

Revision control: each policy package has revisions; 'Compare' shows a diff, and 'Restore' reverts the package to a prior revision. Policy check ('Policy Check') flags shadowed, duplicate, or conflicting rules before install.

FGFM tunnel troubleshooting: verify 'diagnose fgfm' style checks on the FortiGate side, confirm port 541 reachability, and check FortiManager's 'Task Monitor' for registration/install failures with error codes.

Task Monitor (System Settings > Task Monitor) records install, retrieve, import, and script tasks; failed tasks show a status and a log you can open for the exact CLI that failed.

Scripts: CLI scripts (run on device or via policy) and Tcl scripts. Scripts can be scheduled, run on demand, or attached to device groups; output is captured in Task Monitor.

FortiManager as FortiGuard proxy: devices can point to FortiManager for FortiGuard updates (System Settings > FortiGuard > 'Use FortiManager as local FortiGuard server'); requires the FortiManager to have internet or an upstream server.

Logging: FortiManager can act as a log receiver (FortiAnalyzer features require the FAZ feature/license). Configure devices to send logs to FortiManager, then use Log View for traffic/event queries.

HA troubleshooting: check 'diagnose ha status' equivalent via GUI HA status page; verify heartbeat interfaces are on the same L2 and that the secondary has the same firmware and config sync.

ADOM upgrade failures usually stem from insufficient disk space, a device still on the old firmware, or a locked ADOM (workspace in use). Unlock workspaces and retry.

API access: enable under System Settings > Admin > Settings; use JSON-RPC over HTTPS with an API token or admin session. Common methods: get, add, set, update, delete, exec.

FortiManager 7.4 deployment modes: standalone (single unit), HA (primary/secondary with up to 4 secondaries), and the deprecated collector/analyzer split; the collector role is merged into the main unit in 7.x.

HA failover is triggered by monitored interface link failure, a dead heartbeat peer, or the primary losing its FortiGuard connectivity; heartbeat runs over TCP port 8443 by default.

Default management ports: GUI/API over HTTPS 443, admin SSH 22, FortiGate-to-FortiManager FGFM tunnel over TCP 541. FGFM traffic is encrypted and authenticated by the device serial and registration password.

Admin profiles are permission bundles (none/read/write per area plus scope). The built-in Super_User profile has full access and cannot be edited; the built-in Standard_User profile is read-only on most areas.

Workspace mode (System Settings > Admin > Workspace mode) locks an admin's changes into a private workspace until committed; in normal mode edits write to the shared ADOM immediately.

ADOM modes: Normal (mixed devices), Backup (config-only storage, no policy push), and IPS Manager/others per license. Device counts against an ADOM limit; the root ADOM cannot be deleted.

Backup strategy: config backup from System Settings > Dashboard > Backup, or scheduled backups; restore requires a matching or newer firmware. Revisions per ADOM are limited by the 'max revisions' setting and can be pruned.

Firmware upgrade path: upload the image to FortiManager, upgrade ADOMs (ADOM upgrade is mandatory before managing devices on the new firmware), then upgrade managed devices. ADOM version must be >= device firmware.

Licensing: FortiManager is licensed per managed device (or by VM CPU/RAM tier). Adding a device beyond the license blocks registration until the license is updated.

Device registration methods: auto-discovery (FGFM from the FortiGate with the FortiManager IP configured), add-by-serial with a pre-shared registration password, and 'Add Device' wizard using admin credentials.

Provisioning templates: model devices (offline/pre-provisioned) use model device entries in the ADOM; on first connect the model device is matched by serial and its template config is pushed.

A device can only belong to one ADOM. Moving a device between ADOMs requires deleting it from the source ADOM (or using 'Move' which preserves policy assignments if object names match).

Config status indicators: synchronized (green), modified/out-of-sync (yellow), conflict (red). 'Retrieve' pulls config from the device; 'Install' pushes FortiManager config to the device.

Revision history stores per-device config snapshots; you can diff two revisions and roll back. Device-level revisions are separate from ADOM policy revisions.

Device groups are logical groupings used for policy package assignment and install targets; group membership does not affect object scope.

Meta fields are custom key/value attributes on devices used for dynamic grouping and reporting; they do not affect configuration push.

'Import Configuration' from a device creates a policy package and address/service objects from the device's running config; the imported objects land in the ADOM database.

Object scope: global objects live in the Global Database and are inherited read-only by ADOMs unless overridden; ADOM-level objects are local to that ADOM. 'Per-ADOM' objects shadow global objects of the same name.

Policy packages contain firewall policies, and are assigned to devices or device groups. A device can have multiple policy packages but only one is installed at a time per VDOM mapping.

Installation targets: install a policy package to a device/VDOM; FortiManager pushes only the delta (changed objects/policies) and reports per-device install status.

Policy order matters: FortiManager evaluates top-down like the FortiGate. 'Move' and 'Insert' operations rewrite sequence numbers; the implicit deny sits at the bottom and is not shown as a policy.

Interface mapping: policy packages reference interfaces by name; when installing to a device whose interfaces differ, use the install wizard's interface mapping or the package will fail validation.

Dynamic objects: 'Install On' for firewall addresses can be limited to specific devices; objects not installed on a target are omitted from that device's config.

VPN Manager builds IPsec tunnels from a 'VPN community' (hub/spoke or full mesh) and auto-generates the phase1/phase2 and policy entries; the generated policies appear in the policy package if 'auto-create' is enabled.

Revision control: each policy package has revisions; 'Compare' shows a diff, and 'Restore' reverts the package to a prior revision. Policy check ('Policy Check') flags shadowed, duplicate, or conflicting rules before install.

FGFM tunnel troubleshooting: verify 'diagnose fgfm' style checks on the FortiGate side, confirm port 541 reachability, and check FortiManager's 'Task Monitor' for registration/install failures with error codes.

Task Monitor (System Settings > Task Monitor) records install, retrieve, import, and script tasks; failed tasks show a status and a log you can open for the exact CLI that failed.

Scripts: CLI scripts (run on device or via policy) and Tcl scripts. Scripts can be scheduled, run on demand, or attached to device groups; output is captured in Task Monitor.

FortiManager as FortiGuard proxy: devices can point to FortiManager for FortiGuard updates (System Settings > FortiGuard > 'Use FortiManager as local FortiGuard server'); requires the FortiManager to have internet or an upstream server.

Logging: FortiManager can act as a log receiver (FortiAnalyzer features require the FAZ feature/license). Configure devices to send logs to FortiManager, then use Log View for traffic/event queries.

HA troubleshooting: check 'diagnose ha status' equivalent via GUI HA status page; verify heartbeat interfaces are on the same L2 and that the secondary has the same firmware and config sync.

ADOM upgrade failures usually stem from insufficient disk space, a device still on the old firmware, or a locked ADOM (workspace in use). Unlock workspaces and retry.

API access: enable under System Settings > Admin > Settings; use JSON-RPC over HTTPS with an API token or admin session. Common methods: get, add, set, update, delete, exec.