Device Manager
Domain 2 - Device Manager covers onboarding and maintaining FortiGates: adding and authorizing devices, model-device pre-provisioning, device-level configuration, groups, firmware, scripts, and backups.
Onboarding devices
- Add a device by IP and admin credentials or by discovery; FortiManager uses FGFM over TCP 541. The device must permit the FortiManager, and the request must be authorized.
- Verify serial number and model; add the device to the correct ADOM. A device whose firmware does not match the ADOM version cannot be managed normally.
- Model devices let you pre-build a configuration for hardware that has not arrived: choose model and serial, assign an ADOM, then map the real device when it connects.
Device-level management
- Device Manager handles interfaces, static routes, HA, VDOMs, DNS, and other device settings. Policy & Objects handles firewall policy.
- Retrieve pulls the current device config into FortiManager; Install pushes FortiManager device settings to the FortiGate. Import can bring device configuration into the database.
- Device groups simplify bulk installs and script runs; group membership can be static.
- Firmware Manager stages images and upgrades selected devices; check the upgrade path and HA behavior.
Scripts and backups
- CLI scripts run FortiOS commands on devices or groups; TCL scripts add logic. Schedule scripts or run on demand; review results per device.
- FortiManager stores configuration revisions and can compare them; enable automatic backup before or after installs where appropriate.
Worked example
A new FortiGate-100F is delayed. The admin creates a model device with the planned serial, assigns it to the Branch-74 ADOM, adds it to the “Branch” device group, and runs a CLI script to set hostname, NTP, and DNS. When the hardware arrives, the real device connects via FGFM; the admin maps it to the model device, then installs device settings and policy. The trap is assuming the model device pushes configuration before the real serial is mapped.
Traps that cost marks
Blocking TCP 541; adding to the wrong ADOM version; using policy install when only device settings changed; forgetting to authorize a device; model serial mismatch; upgrading firmware without checking HA state.