Administration Guide

Setting up FortiManager
- Connecting to the GUI
- Security considerations
  - Restricting GUI access by trusted host
  - Other security considerations
- GUI overview
- FortiAnalyzer Features
  - Enable or disable FortiAnalyzer features
- Configuring FortiManager appliances
- Adding devices
- Installing to managed devices
- Monitoring managed devices
- Restarting and shutting down
FortiManager Key Concepts
- FortiManager modules
  - Modules for FortiAnalyzer feature set
- Object database and FortiManager modules
- Inside the FortiManager system
- Key features of the FortiManager system
Firewall Devices
- ADOMs
- Adding devices
- Adding FortiAnalyzer devices
  - Adding FortiAnalyzer devices with the wizard
  - Viewing policy rules
- Importing devices
  - Importing detected devices
  - Importing and exporting device lists
- Configuring devices
- Using the device dashboard
- Installing to devices
- Managing devices
- Verifying devices with private data encryption enabled
- Managing device configurations
- Device groups
- Firmware
- License
  - License Management
  - Add-on license
- Provisioning Templates
- Scripts
- SD-WAN
- FortiMeter
- FortiGate chassis devices
  - Viewing chassis dashboard
Firewall Policy & Objects
- About policies
  - Policy theory
  - Global policy packages
- Policy workflow
  - Provisioning new devices
  - Day-to-day management of devices
- Display options
- Managing policy packages
- Managing policies
- Managing objects and dynamic objects
- ADOM revisions
Fabric View
- Security Fabric Topology
- Security Rating
- Fabric Connectors
FortiView
- Monitors
  - Device Status
  - Using the Monitors dashboard
VPN
- Overview
- Enabling central VPN management
- DDNS support
- VPN Setup Wizard supports device groups
- IPsec VPN Communities
- IPsec VPN gateways
- VPN security policies
  - Defining policy addresses
  - Defining security policies
- SSL VPN
Access Points
- Managed APs
- Monitor
  - Clients Monitor
  - Health Monitor
- Map view
  - Google map
  - Floor map
- WiFi profiles for central management
- WiFi profiles for per-device management
  - Enabling FortiAP per-device management
  - Creating profiles
FortiSwitch Manager
- Managed Switches
- Monitor
- FortiSwitch Templates for central management
  - Enabling FortiSwitch central management
  - FortiSwitch Templates
- FortiSwitch Profiles for per-device management
Endpoint Compliance
- How FortiManager fits into endpoint compliance
- FortiTelemetry
- Monitor
- FortiClient profiles
Device Firmware and Security Updates
- FDN third-party SSL validation and Anycast support
- Settings
- Configuring devices to use the built-in FDS
- Configuring FortiGuard services
- Logging events related to FortiGuard services
  - Logging FortiGuard antivirus and IPS updates
  - Logging FortiGuard web or email filter events
- Restoring the URL or antispam database
- Licensing status
- Package management
- Query server management
- Firmware images
Locks for restricting configuration changes
- Workspace mode
- Workflow mode
Extender Manager
- Managed extenders
- SIM Profiles
- Data plans
System Settings
- Dashboard
- Logging Topology
- Network
- RAID Management
- Administrative Domains
- Certificates
- Fetcher Management
- Event Log
  - Event log filtering
- Task Monitor
- SNMP
- Mail Server
- Syslog Server
  - Send local logs to syslog server
- Meta Fields
- Device logs
  - Configuring rolling and uploading of logs using the GUI
  - Configuring rolling and uploading of logs using the CLI
- File Management
- Advanced Settings
- Restart, shut down, or reset FortiManager
Administrators
- Trusted hosts
- Monitoring administrators
- Disconnecting administrators
- Managing administrator accounts
- Administrator profiles
- Authentication
- Global administration settings
- Two-factor authentication
  - Configuring FortiAuthenticator
  - Configuring FortiManager
High Availability
- Synchronizing the FortiManager configuration and HA heartbeat
- If the primary or a backup unit fails
- FortiManager HA cluster startup steps
- Configuring HA options
  - General FortiManager HA configuration steps
  - GUI configuration steps
- Monitoring HA status
- Upgrading the FortiManager firmware for an operating cluster
- FortiManager support for FortiAnalyzer HA
Management Extensions
- SD-WAN Orchestrator MEA
- FortiPortal MEA
- FortiWLM MEA
- FortiSigConverter MEA
- FortiAuthenticator MEA
- Enabling management extension applications
  - CLI for management extensions
- Accessing management extension logs
Appendix A - Supported RFC Notes
Appendix B - Re-establishing the FGFM tunnel after VM license migration
Change Log

Home FortiManager 6.4.13 Administration Guide

6.4.13

SD-WAN central management

When central management is enabled for SD-WAN, you can configure SD-WAN templates and assign the templates to FortiGate devices. SD-WAN templates help you do the following:

Deploy a single SD-WAN template from FortiManager across multiple FortiGate devices.
Perform a zero-touch deployment without manual configuration locally at the FortiGate devices.
Roll out a uniform SD-WAN configuration across your network.
Eliminate errors in SD-WAN configuration across multiple FortiGate devices since the SD-WAN template is applied centrally from FortiManager.
Monitor network Performance SLA across multiple FortiGate devices centrally from FortiManager.
Monitor the performance of your SD-WAN with multiple views.

Using SD-WAN templates consists of the following steps:

Specify the ports where the SD-WAN settings will be applied. See Interface members.
Specify the health-check servers that will monitor the network parameters. See Health-Check Servers.
(Optional) Specify BGP Neighbors.
Create an SD-WAN template that includes the following:
1. Add zones and interface members - add the Interface Members created in step 1.
2. Performance SLA - create a Performance SLA. Add the interface member and Health Check Servers.
3. BGP Neighbors - create BGP neighbors.
4. SD-WAN Rules - create rules and configure advanced options on network traffic management.
See SD-WAN templates.
Assign the SD-WAN templates to FortiGate devices. See Assign SD-WAN templates to devices.
Install device settings using the Install Wizard. See Using the Install Wizard to install device settings only.
Go to SD-WAN > Monitor to monitor the FortiGate devices. See Monitor SD-WAN.

The SD-WAN template takes effect on the FortiGate device only after it is installed using the Install Wizard. After installing the SD-WAN template on the FortiGate device, changing settings in SD-WAN, Performance SLA, or SD-WAN Rules locally on the FortiGate device will result in the SD-WAN template on the FortiManager being out of sync with the FortiGate device. You must configure the same settings on the FortiManager SD-WAN template and install it again using the Install Wizard to be in sync with the settings on the FortiGate.