I85PREP
⌘ K
FCP FortiManager 7.4 study materials
FCP FortiManager 7.4 study resources

FCP FortiManager 7.4: Advanced Configuration and Troubleshooting

FCP FortiManager 7.4 · Work through your exam, one topic at a time.

All guide sections

Advanced Configuration and Troubleshooting

Domain 4 - Advanced Configuration and Troubleshooting tests HA operation, ADOM revisions, API automation, FortiGuard integration, and diagnosis of sync and install failures.

HA and revisions

  • FortiManager HA uses primary and secondary members with synchronized configuration and a virtual IP. Administer through the VIP; check HA status before changes; do not edit the secondary directly.
  • ADOM revisions snapshot an ADOM’s configuration. Create a revision before major changes, lock it to prevent deletion, and restore only with awareness that newer changes are replaced.
  • Device config revisions and ADOM revisions are different: one is per device, the other is the ADOM database.

API and FortiGuard

  • The JSON-RPC API is enabled per administrator; the admin profile needs JSON API access. Requests go to /jsonrpc; use it for bulk object creation and automation.
  • FortiManager can act as a FortiGuard proxy for managed devices; configure FortiGuard settings and verify connectivity.
  • Firmware and signatures are staged from FortiGuard; schedule updates and check device support.

Troubleshooting installs and sync

  • Config Status shows In Sync or Out of Sync. Retrieve pulls the device’s current config; Install pushes FortiManager’s version. Use Install Preview and Task Monitor to see failures.
  • If install fails, check the task log, device reachability on TCP 541, ADOM version match, Policy Check results, and whether the device is an HA subordinate.
  • Use event logs and CLI diagnostics on FortiManager to inspect FGFM sessions and device database state.

Worked example

A policy install fails for one FortiGate. Task Monitor shows a timeout. The admin verifies the device is reachable on 541, confirms the ADOM version, runs Retrieve, then Install Preview. The preview shows an interface referenced in policy no longer exists. After correcting the policy, install succeeds and a revision is created. The trap is repeatedly reinstalling without reading the task log.

Traps that cost marks

Editing the HA secondary; restoring an ADOM revision without a current backup; assuming API access is enabled by default; confusing Retrieve and Import; ignoring Task Monitor; installing to an out-of-sync device without preview.