FCP FortiManager 7.4 key terms

A workflow mode where an administrator locks a portion of the configuration, edits it in isolation, then commits or reverts the change as a unit. It prevents concurrent edits from overwriting each other across teams.

A logical container that separates device groups, policies, objects, and administrators. Devices in one ADOM cannot share policy packages or objects with devices in another, which keeps managed environments isolated.

A saved snapshot of the FortiManager configuration created automatically or manually. Administrators compare revisions and roll back to an earlier state when a change causes problems.

A shared object repository at the root level whose objects can be assigned to multiple ADOMs. It reduces duplicate address and service definitions across independently managed domains.

A permission template that defines which parts of FortiManager an administrator account can read or change. Profiles restrict access by area such as device manager, policy, or system settings.

A configuration that forwards FortiManager administrator logins to an external server for credential checking. Group matching on the server maps users to local administrator profiles and their permissions.

A login requirement combining a password with a second proof such as a one-time code from an authenticator app or token. It reduces risk from stolen credentials on administrative accounts.

Two or more FortiManager units sharing a virtual address so management survives a node failure. The primary serves requests while the secondary stays synchronized and takes over automatically.

The process of exporting the FortiManager configuration and database to an encrypted file and importing it later. It is used for migrations, disaster recovery, and moving settings between units.

The outbound link FortiManager uses to reach Fortinet update servers. It delivers firmware images, signature updates, and licensing data that the manager then distributes to managed devices.

The per-device copy of a managed FortiGate configuration stored on FortiManager. It reflects what the manager believes the device runs and is the source for installs and comparisons.

An indicator showing whether a managed device matches the configuration FortiManager last installed. A modified or out-of-sync state means the device changed locally or a new install is pending.

A placeholder device entry created without a real serial number, used to pre-build configuration before hardware arrives. It can later be promoted to a real device by assigning the actual serial number.

A reusable set of settings applied to model devices so new hardware receives baseline configuration automatically. It typically covers interfaces, static routes, and system settings at first contact.

A definition that maps device models to a target firmware image and upgrade path. It lets administrators stage and schedule firmware changes across many devices from one place.

A container of firewall policies, objects, and security profiles that can be installed on one or more managed devices. It is the main unit for pushing consistent rules to groups of firewalls.

A policy placed ahead of the normal rule set that is evaluated first. It is often used for temporary blocks or exceptions that must override existing rules without editing them.

A named group of related policies managed together inside a policy package. Blocks make large rule sets easier to read, reorder, and reuse across multiple packages.

The guided workflow that previews pending changes and pushes a policy package or device settings to selected targets. It shows conflicts and lets the administrator confirm before committing.

A stored history entry for a firewall object such as an address or service. It allows comparison of earlier versions and rollback if an edit breaks policy behavior.

An address or service entry whose value is supplied at runtime rather than fixed in the policy. Examples include geographic location groups and fabric connectors that resolve members automatically.

A mapping that translates physical interface names on different device models to a common logical name used in policy. It lets one package apply to firewalls with different port layouts.

The grouping of FortiGate, FortiSwitch, FortiAP, and other devices under a root FortiGate that FortiManager can discover and manage together. It centralizes topology and policy for the whole branch.

A stored sequence of CLI commands that FortiManager runs on selected devices on demand or on a schedule. Scripts handle changes that templates and policy do not cover.

The page listing background jobs such as installs, script runs, and firmware upgrades, with status and logs. It is the first place to check when an operation appears to hang or fail.

The action that reads a FortiGate's running configuration and loads it into FortiManager as a device-level database and policy package. It is how existing firewalls are brought under management.

A validation that flags overlapping, shadowed, or conflicting rules before an install. It helps catch mistakes that would otherwise silently change traffic behavior on the firewall.

A side-by-side comparison of two configuration revisions or device databases that highlights added, removed, and changed lines. It is used to audit changes and troubleshoot unexpected differences.

A setting that determines whether an ADOM operates in normal mode or backup mode. Backup mode restricts the ADOM to configuration backup only, without policy installation.

A collection of managed devices inside an ADOM that share policy packages and provisioning. Grouping lets one install reach many firewalls with a consistent rule set.

A programmatic interface that accepts JSON-RPC requests to read or change FortiManager objects and run tasks. It enables automation and integration with external management systems.

Configuration that controls where FortiManager stores or sends logs received from managed devices. Administrators forward to analyzers or syslog collectors and set retention for troubleshooting.

The FortiManager host configuration covering interfaces, routes, DNS, NTP, and administrative access. Correct time and reachability are prerequisites for certificates, HA, and device communication.

The handling of local and CA-signed certificates used for administrator logins, fabric connections, and device trust. Expired or mismatched certificates commonly break secure communication between manager and devices.

The link between a policy package and the devices or groups that receive it. Assigning the same package to several targets keeps their firewall rules identical and easier to audit.

The practice of using FortiManager diagnostic commands, task logs, and event logs to trace failed installs or connections. It narrows problems to credentials, reachability, or configuration conflicts.