Normal versus Backup Mode

Once FortiGates are managed by a FortiManager that is operating in Normal Mode, whenever possible, configuration changes should be made on the FortiManager and not the FortiGate.

This is particularly true for changes to policies or objects that affect the Policies & Objects pane on the FortiManager. Any such changes made directly on a FortiGate will require manual changes to resynchronize the FortiManager with the FortiGate. Although the Device Manager pane will learn about the changes, these changes will be overridden by the next policy package installation, unless the ADOM level Policy & Objects have been updated.

If you intend to regularly make changes directly on the FortiGate, and only need FortiManager to act as a configuration repository, it is recommended that you use FortiManager in Backup Mode.

When FortiManager is in Normal Mode, GUI access to managed FortiGates is restricted to Read-Only mode in order to limit the number of changes made directly on the FortiGate. Super_User accounts have the option of switching to Read-Write mode.