FCP FortiManager 7.4 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

FGFM tunnel port

FortiGate-to-FortiManager management tunnel uses TCP port 541. Registration is authenticated by device serial plus the registration password configured on both sides.

FortiManager HA heartbeat

HA peers exchange heartbeats over TCP 8443 by default. Failover occurs on heartbeat loss, monitored interface failure, or primary FortiGuard connectivity loss.

Workspace mode

Admin setting that isolates each admin's edits into a private workspace until explicitly committed. Prevents concurrent edits from colliding in the shared ADOM.

Super_User admin profile

Built-in profile granting full read-write access across all areas and ADOMs. It cannot be edited or deleted; create custom profiles for restricted access.

ADOM upgrade requirement

An ADOM must be upgraded to the current firmware version before it can manage devices running that firmware. ADOM version must be greater than or equal to device firmware.

Root ADOM

The default administrative domain created at install. It cannot be deleted, and it holds the Global Database objects inherited by other ADOMs.

Config backup and restore

Backups capture FortiManager configuration from the dashboard. Restore requires matching or newer firmware; mismatched firmware blocks restoration.

FortiManager licensing model

Licensed per managed device, or by VM CPU/RAM tier. Registering more devices than licensed is blocked until the license is updated.

Model device

An offline device entry pre-created in an ADOM with a serial number and provisioning template. When the real device connects, config is pushed automatically.

Device config status colors

Green means synchronized, yellow means out-of-sync or modified, red means conflict. Retrieve pulls device config; Install pushes FortiManager config to the device.

Device ADOM membership

A device belongs to exactly one ADOM at a time. Moving between ADOMs requires deletion from the source or the Move operation.

Meta fields

Custom key-value attributes attached to managed devices. Used for grouping, filtering, and reporting; they do not change pushed configuration.

Device groups

Logical collections of devices used as install targets and for policy package assignment. Group membership does not alter object scope or inheritance.

Import configuration

Operation that reads a FortiGate running config and generates a policy package plus address and service objects in the ADOM database.

Device revision history

Per-device snapshots of configuration over time. You can diff two revisions and roll back. Separate from ADOM policy package revisions.

Auto-discovery registration

FortiGate initiates FGFM to FortiManager when its central management IP is set. FortiManager accepts based on serial and registration password match.

Global Database objects

Objects defined at the global level and inherited read-only by ADOMs. An ADOM can override with a per-ADOM object of the same name.

Policy package

Container of firewall policies installed to devices or device groups. A device can hold several packages but only one installed per VDOM mapping.

Delta install

Policy install pushes only changed objects and policies to the target device rather than the full config, and reports per-device install status.

Install On restriction

Firewall address object attribute limiting which devices receive the object. Objects not installed on a target are omitted from that device's config.

Interface mapping on install

Policy packages reference interfaces by name. If target device interface names differ, map them in the install wizard or validation fails.

Policy Check

Pre-install validation that flags shadowed, duplicate, or conflicting firewall rules in a policy package before pushing to devices.

Policy package revisions

Versioned snapshots of a policy package. Compare shows a diff between revisions; Restore reverts the package to a chosen prior revision.

VPN Manager community

Defines hub-and-spoke or full-mesh IPsec topology. Generates phase1 and phase2 entries plus matching policies when auto-create is enabled.

Implicit deny placement

FortiManager policies evaluate top-down like the FortiGate. The implicit deny sits below all policies and is not displayed as a rule.

Task Monitor

Records install, retrieve, import, and script tasks with status and logs. Failed tasks expose the exact CLI that failed for diagnosis.

CLI script types

FortiManager supports CLI scripts and Tcl scripts. They run on demand, on schedule, or against device groups, with output captured in Task Monitor.

FortiGuard proxy role

FortiManager can serve FortiGuard updates to managed devices when configured as a local FortiGuard server. It needs internet or an upstream server.

Log receiver role

FortiManager can receive logs from managed devices and provide Log View queries. Full FortiAnalyzer features require the corresponding feature or license.

ADOM upgrade failure causes

Common causes are insufficient disk space, a managed device still on old firmware, or a locked ADOM due to an open workspace. Unlock and retry.

JSON-RPC API access

Enabled under Admin settings. Uses HTTPS with an API token or admin session. Methods include get, add, set, update, delete, and exec.

HA sync verification

Confirm both units run identical firmware, heartbeat interfaces share Layer 2, and config sync status shows synchronized before trusting failover.