I85PREP
⌘ K
FCP FortiManager 7.4 study materials
FCP FortiManager 7.4 study resources

FCP FortiManager 7.4: Policy and Objects

FCP FortiManager 7.4 · Work through your exam, one topic at a time.

All guide sections

Policy and Objects

Domain 3 - Policy and Objects tests central firewall policy construction and installation: policy packages, reusable objects, policy blocks, install preview, policy check, metadata variables, and revisions.

Policy packages and objects

  • A policy package contains firewall policies and is assigned to devices or VDOMs. A device can have several packages assigned, but only one installed at a time.
  • Objects are ADOM-scoped: addresses, services, schedules, and UTM profiles. Global objects live in the Global ADOM and can be shared; ADOM objects stay local.
  • Policy blocks are reusable groups of policies inserted into packages; editing a block affects every package that uses it.
  • Check object usage before deletion; FortiManager blocks removal of objects referenced by policy.

Install workflow

  • The Install Wizard selects policy packages and target devices. “Install Policy Package” pushes policy; “Install Policy Package & Device Settings” also pushes device-level configuration.
  • Install Preview shows the CLI changes; Policy Check flags shadowed, duplicate, or conflicting rules before install.
  • Metadata variables allow one policy to use per-device values such as interface names or IP addresses.
  • Each install creates a policy package revision; compare and revert from Revision History.

Workflow interaction

  • In Workspace mode, commit changes before install. In Workflow mode, submit for approval; an approver must approve before install.
  • Global policy assignment can add global policies to ADOM packages.

Worked example

An admin builds “Branch-Standard” with a LAN-to-WAN policy, an address object for 10.10.0.0/16, and a web-filter profile. The package is assigned to two FortiGates. Policy Check reports the LAN-to-WAN rule is shadowed by a broader allow rule above it; the admin reorders, runs Install Preview, then installs with device settings. A revision is created. If the second device has a different WAN interface name, a metadata variable avoids a per-device clone.

Traps that cost marks

Installing without device settings after changing interfaces; deleting an object still in use; confusing global and ADOM objects; installing a package not assigned to the target; forgetting approval in Workflow mode.