Administration Guide

• What’s New in FortiManager
  • FortiManager 6.0.4
  • FortiManager 6.0.3
  • FortiManager 6.0.2
  • FortiManager 6.0.1
    • Central change management
  • FortiManager 6.0.0
    • SD-WAN improvements
    • SD-WAN central template
    • SD-WAN monitoring
    • Export IPS and application information to file in CSV format
    • Export device list to file in CSV format
    • Find and replace objects
    • Fortinet Security Fabric Rating
    • Automatic policy package install for offline devices
    • Workspace device lock
    • Workflow improvements
    • AP Manager floor map support
• Setting up FortiManager
  • Connecting to the GUI
  • Security considerations
    • Restricting GUI access by trusted host
    • Other security considerations
  • GUI overview
    • Panes
    • Color themes
    • Full-screen mode
    • Switching between ADOMs
    • Using the right-click menu
    • Avatars
    • Showing and hiding passwords
  • FortiAnalyzer Features
    • Enable or disable FortiAnalyzer features
  • Configuring FortiManager appliances
  • Adding devices
  • Installing to managed devices
  • Enabling central management
  • Monitoring managed devices
  • Restarting and shutting down
• FortiManager Key Concepts
  • FortiManager modules
    • Modules for FortiAnalyzer feature set
  • Object database and FortiManager modules
  • Inside the FortiManager system
    • Communication protocols and devices
    • Object database and devices
    • ADOMs and devices
    • Operations
  • Key features of the FortiManager system
    • Security Fabric
    • Configuration revision control and tracking
    • Centralized management
    • Administrative domains
    • Local FortiGuard service provisioning
    • Firmware management
    • Scripting
    • Logging and reporting
    • Fortinet device life cycle management
• Firewall Devices
  • ADOMs
  • Adding devices
    • Adding devices using the wizard
      • Adding a device using Discover mode
      • Adding a model device
    • Adding devices manually
    • Example of adding a model device by pre-shared key
    • Example of adding a model device by serial number
    • Add a VDOM to a device
    • Adding a Security Fabric group
    • Import policy wizard
  • Adding FortiAnalyzer devices
    • Adding FortiAnalyzer devices with the wizard
    • Viewing policy rules
  • Importing devices
    • Importing detected devices
    • Importing and exporting device lists
  • Configuring devices
    • Configuring a device
      • Firewall policy reordering on first installation
    • Out-of-Sync device
    • Configuring VDOMs
      • Creating and editing virtual domains
      • Configuring inter-VDOM routing
      • Deleting a virtual domain
  • Using the device dashboard
    • View system dashboard for managed/logging devices
      • To view the dashboard for managed/logging devices:
      • Dashboard toolbar
      • Display Options
    • View system interfaces
    • CLI-Only Objects menu
    • System dashboard widgets
  • Installing to devices
    • Using the Install Wizard to install policy packages and device settings
    • Using the Install Wizard to install device settings only
    • View a policy package diff
  • Managing devices
    • Using the quick status bar
    • Customizing columns
    • Refreshing a device
    • Editing device information
    • Deleting a device
    • Replacing a managed device
    • Setting unregistered device options
    • Using the CLI console for managed devices
    • Displaying Security Fabric topology
  • Managing device configurations
    • View configurations for device groups
    • Checking device configuration status
    • Managing configuration revision history
      • Downloading and importing a configuration file
      • Comparing different configuration files
  • Device groups
    • Default device groups
    • Add device groups
    • Manage device groups
  • Firmware
    • View firmware for device groups
    • Upgrade firmware for device groups
    • Firmware Management
  • License
    • View licenses for device groups
    • License Management
    • Add-on license
  • Provisioning Templates
    • System templates
    • Threat Weight templates
    • Certificate templates
  • Scripts
    • Enabling scripts
    • Configuring scripts
      • Run a script
      • Add a script
      • Edit a script
      • Clone a script
      • Delete a script
      • Export a script
      • Import a script
      • Schedule a script
    • CLI script group
    • Script syntax
    • Script history
    • Script samples
      • CLI scripts
      • Tcl scripts
      • Use Tcl script to access FortiManager’s device database or ADOM database
  • SD-WAN
    • Enabling central SD-WAN management
    • Interface members
    • SD-WAN templates
    • Health-Check Servers
    • Assigned devices
    • Monitor SD-WAN
  • FortiExtender
    • To edit a FortiExtender:
  • FortiMeter
    • FortiOS VMs
    • FortiWeb VMs
    • Overview
    • Points
    • Authorizing metered VMs
      • Authorizing FortiOS VMs
      • Authorizing FortiWeb VMs
    • Monitoring VMs
  • FortiGate chassis devices
    • Viewing chassis dashboard
• Firewall Policy & Objects
  • About policies
    • Policy theory
    • Global policy packages
  • Policy workflow
    • Provisioning new devices
    • Day-to-day management of devices
  • Display options
  • Managing policy packages
    • Create new policy packages
    • Create new policy package folders
    • Edit a policy package or folder
    • Clone a policy package
    • Remove a policy package or folder
    • Assign a global policy package
    • Install a policy package
    • Reinstall a policy package
    • Schedule a policy package install
    • Export a policy package
    • Policy package installation targets
    • Perform a policy consistency check
    • View logs related to a policy rule
    • Find and replace objects
  • Managing policies
    • Column options
    • Policy search and filter
    • Policy hit count
    • Creating policies
    • Editing policies
      • Object selector
      • Drag and drop objects
      • Install policies only to specific devices
      • Configuring policy details
    • IP policies
    • Virtual wire pair policy
    • NAT policies
    • Proxy policy
    • Central SNAT
    • Central DNAT
    • DoS policies
    • Interface policies
    • Multicast policy
    • Local in policies
    • Traffic shaping policy
  • Managing objects and dynamic objects
    • Create a new object
      • Color code an object
    • Map a dynamic object
    • Map a dynamic device group
    • Remove an object
    • Edit an object
    • Push to device
    • Clone an object
    • Search objects
    • Find unused objects
    • Find and merge duplicate objects
    • Export signatures to CSV file format
    • CLI-Only objects
    • FortiToken configuration example
    • FSSO user groups
    • Interface mapping
    • VIP mapping
    • Modify existing interface-zone mapping
  • ADOM revisions
• Fabric View
  • Security Rating
    • Enabling the Security Rating tab
    • Viewing Security Fabric Ratings
  • Fabric Connectors
    • SDN
      • Creating ACI fabric connectors
      • Creating AWS fabric connectors
      • Creating Microsoft Azure fabric connectors
      • Creating VMware NSX fabric connectors
      • Creating Nuage fabric connectors
      • Importing address names to fabric connectors
      • Configuring dynamic firewall addresses for fabric connectors
      • Configuring virtual wire pairs
    • Threat Feeds
      • Creating threat feed connectors
    • SSO/Identity
      • Creating Active Directory connectors
      • Creating FSSO connectors
      • Creating RADIUS connectors
• NOC - SOC Monitoring
  • NOC - SOC dashboards and widgets
    • Device Status
  • Using the NOC - SOC dashboard
    • Customizing the NOC - SOC dashboard
• VPN
  • Overview
  • Enabling central VPN management
  • DDNS support
  • IPsec VPN Communities
    • Managing IPsec VPN communities
    • Creating IPsec VPN communities
    • VPN community settings
    • View IPsec VPN community details
    • Editing an IPsec VPN community
    • Deleting VPN communities
    • Monitoring IPsec VPN tunnels
    • Map View
  • IPsec VPN gateways
    • Managing VPN gateways
    • Creating managed gateways
    • Creating external gateways
    • Editing an IPsec VPN gateway
    • Deleting VPN gateways
  • VPN security policies
    • Defining policy addresses
    • Defining security policies
  • SSL VPN
    • Manage SSL VPNs
    • Creating SSL VPNs
    • Editing SSL VPNs
    • Deleting SSL VPNs
    • Portal profiles
    • Creating SSL VPN portal profiles
    • Predefined bookmarks
    • Editing portal profiles
    • Deleting portal profiles
    • Monitor SSL VPNs
• Access Points
  • Managed APs
    • Quick status bar
    • Managing APs
    • FortiAP groups
    • Authorizing and deauthorizing FortiAP devices
    • Assigning profiles to FortiAP devices
    • Rogue APs
    • Connected clients
  • Monitor
    • Clients Monitor
    • Health Monitor
  • Map view
    • Google map
    • Floor map
  • WiFi profiles
    • AP profiles
    • SSIDs
      • Creating SSIDs
    • WIDS profiles
    • Bluetooth profiles
    • QoS profiles
    • Bonjour profiles
• FortiSwitch Manager
  • Managed Switches
    • Quick status bar
    • Managing FortiSwitches
    • Editing switches
    • Deleting switches
    • Authorizing and deauthorizing FortiSwitch devices
    • Assigning templates to FortiSwitch devices
  • Monitor
  • FortiSwitch Templates
    • FortiSwitch templates
      • Creating FortiSwitch templates
      • Importing FortiSwitch templates
      • FortiSwitch LLDP Profiles
        • Creating FortiSwitch LLDP Profiles
      • FortiSwitch QoS Policy
        • Creating FortiSwitch QoS Policies
    • FortiSwitch VLANs
      • Creating FortiSwitch VLANs
    • FortiSwitch security policies
      • Creating FortiSwitch security policies
• Endpoint Compliance
  • How FortiManager fits into endpoint compliance
  • FortiTelemetry
    • Viewing devices
    • Enabling FortiTelemetry on interfaces
    • Enabling endpoint control on interfaces
    • Assigning FortiClient profile packages to devices
  • Monitor
    • Monitoring FortiClient endpoints
    • Monitoring FortiClient endpoints by compliance status
    • Monitoring FortiClient endpoints by interface
    • Exempting non-compliant FortiClient endpoints
  • FortiClient profiles
    • Viewing profile packages
    • Viewing FortiClient profiles
    • Creating FortiClient profile packages
    • Creating FortiClient profiles
    • Editing FortiClient profiles
    • Deleting FortiClient profiles
    • Importing FortiClient profiles
    • Assigning profile packages
• Device Firmware and Security Updates
  • Settings
    • Connecting the built-in FDS to the FDN
    • Operating as an FDS in a closed network
  • Configuring devices to use the built-in FDS
    • Matching port settings
    • Handling connection attempts from unregistered devices
    • Configure a FortiManager without Internet connectivity to access a local FortiManager as FDS
  • Configuring FortiGuard services
    • Enabling push updates
    • Enabling updates through a web proxy
    • Overriding default IP addresses and ports
    • Scheduling updates
    • Accessing public FortiGuard web and email filter servers
  • Logging events related to FortiGuard services
    • Logging FortiGuard antivirus and IPS updates
    • Logging FortiGuard web or email filter events
  • Restoring the URL or antispam database
  • Licensing status
  • Package management
    • Receive status
    • Service status
  • Query server management
    • Receive status
    • Query status
  • Firmware images
• Locks for Restricting Configuration Changes
  • Normal mode
    • Enable normal mode
    • Locking an ADOM
    • Locking a device
    • Locking a policy package
  • Workflow mode
    • Enable workflow mode
    • Workflow approval
    • Workflow sessions
      • Starting a workflow session
      • Saved sessions
      • View session diff
      • Discarding a session
      • Submitting a session
      • Approving or rejecting a session
      • Repairing a rejected session
      • Reverting a session
      • The session list
• System Settings
  • Dashboard
    • Customizing the dashboard
    • System Information widget
      • Changing the host name
      • Configuring the system time
      • Updating the system firmware
      • Backing up the system
      • Restoring the configuration
      • Migrating the configuration
    • System Resources widget
    • License Information widget
    • Unit Operation widget
    • CLI Console widget
    • Alert Messages Console widget
    • Log Receive Monitor widget
    • Insert Rate vs Receive Rate widget
    • Log Insert Lag Time widget
    • Receive Rate vs Forwarding Rate widget
    • Disk I/O widget
  • Logging Topology
  • Network
    • Configuring network interfaces
      • Disabling ports
      • Changing administrative access
    • Static routes
  • RAID Management
    • Supported RAID levels
    • Configuring the RAID level
    • Monitoring RAID status
    • Checking RAID from command line
    • Swapping hard disks
    • Adding hard disks
  • Administrative Domains
    • Default ADOMs
    • Organizing devices into ADOMs
    • Enabling and disabling the ADOM feature
    • ADOM device modes
    • ADOM modes
      • Creating backup ADOMs
      • Importing objects to backup ADOMs
      • Viewing read-only polices in backup ADOMs
    • Managing ADOMs
      • Creating ADOMs
      • Assigning devices to an ADOM
      • Assigning VDOMs to an ADOM
      • Assigning administrators to an ADOM
      • Editing an ADOM
      • Deleting ADOMs
    • ADOM versions
      • Global database version
    • Concurrent ADOM access
    • Locking an ADOM
    • Upgrading an ADOM
  • Certificates
    • Local certificates
    • CA certificates
    • Certificate revocation lists
  • Fetcher Management
    • Fetching profiles
    • Fetch requests
    • Synchronizing devices and ADOMs
    • Request processing
    • Fetch monitoring
  • Event Log
    • Event log filtering
  • Task Monitor
  • SNMP
    • SNMP agent
    • SNMP v1/v2c communities
    • SNMP v3 users
    • SNMP MIBs
    • SNMP traps
    • Fortinet & FortiManager MIB fields
  • Mail Server
  • Syslog Server
  • Meta Fields
  • Device logs
    • Configuring rolling and uploading of logs using the GUI
    • Configuring rolling and uploading of logs using the CLI
  • File Management
  • Advanced Settings
• Administrators
  • Trusted hosts
  • Monitoring administrators
  • Disconnecting administrators
  • Managing administrator accounts
    • Creating administrators
    • Editing administrators
    • Deleting administrators
    • Restricted administrators
      • Web Filter
      • Intrusion Prevention
      • Application Control
  • Administrator profiles
    • Permissions
    • Creating administrator profiles
    • Editing administrator profiles
    • Cloning administrator profiles
    • Deleting administrator profiles
  • Authentication
    • Public Key Infrastructure
    • Managing remote authentication servers
      • Editing remote authentication servers
      • Deleting remote authentication servers
    • LDAP servers
    • RADIUS servers
    • TACACS+ servers
    • Remote authentication server groups
  • Global administration settings
    • Password policy
    • Password lockout and retry attempts
    • GUI language
    • Idle timeout
  • Two-factor authentication
    • Configuring FortiAuthenticator
    • Configuring FortiManager
• High Availability
  • Synchronizing the FortiManager configuration and HA heartbeat
  • If the primary or a backup unit fails
  • FortiManager HA cluster startup steps
  • Configuring HA options
    • General FortiManager HA configuration steps
    • GUI configuration steps
  • Monitoring HA status
  • Upgrading the FortiManager firmware for an operating cluster
• Appendix A - Supported RFC Notes