I85PREP
⌘ K
FCP FortiManager 7.4 study materials
FCP FortiManager 7.4 study resources

FCP FortiManager 7.4: System Setup and Administration

FCP FortiManager 7.4 · Work through your exam, one topic at a time.

All guide sections

System Setup and Administration

Domain 1 - System Setup and Administration tests the foundation of a FortiManager deployment: how ADOMs partition the database, how administrators are authenticated and scoped, how change-control workspaces behave, and how backup, HA, licensing, and FortiGuard settings keep the appliance healthy.

ADOM design

  • An ADOM is the main administrative and database boundary. Each ADOM has its own devices, objects, policy packages, and revision history.
  • Match the ADOM firmware version to the managed FortiGate firmware; a 7.4 ADOM manages 7.4 devices. Create separate ADOMs for different firmware trains.
  • ADOM mode Normal supports policy and device management; Backup mode is for configuration backup only.
  • Admin domains can limit an administrator to selected ADOMs or devices, separate from the admin profile.

Admin access and workspaces

  • Authentication methods include local, LDAP, RADIUS, TACACS+, and SAML. Admin profiles define scope and per-object read/write permissions.
  • Workspace mode is per administrator: Normal edits apply immediately; Workspace gives a private workspace with Commit; Workflow requires Submit and Approve.
  • Use workflow for production change control; it prevents unapproved policy edits from reaching devices.

Backup, HA, FortiGuard

  • Schedule backups; a full backup includes system configuration and ADOM databases. Encrypt backups and record the password.
  • Restore to the same or compatible firmware; restoring an older backup can lose newer ADOM revisions.
  • HA pairs synchronize configuration; use the cluster virtual IP for administration and verify failover.
  • License capacity is based on managed devices and ADOM count (VM); FortiGuard settings control update and proxy behavior.

Worked example

A team adds a new 7.4 branch ADOM. They create ADOM “Branch-74” with version 7.4, add devices, create a restricted admin profile and an admin domain for that ADOM, and set the admin’s workspace mode to Workflow. A second admin with Normal mode can still edit directly, which is a common surprise: workspace mode is not global.

Traps that cost marks

Creating a 7.4 ADOM for 7.2 devices; assuming workspace mode is system-wide; forgetting that admin domain and admin profile are separate controls; restoring a backup from a newer firmware; leaving default admin access enabled.