FortiGate to FortiManager authentication

FortiGate presents a certificate as part of the initial connection setup, which FortiManager uses to uniquely validate the serial number of the device.

Once a FortiManager has accepted an incoming connection from a FortiGate unit, the FortiManager will send its certificate to the FortiGate unit via SSL.

The FortiGate unit then authenticates the certificate as follows:

1. It compares the serial number provided in the authentication message against the one in the certificate;
2. It verifies that the serial number is in its local allowed serial number table;
3. It then verifies the validity of the certificate.

If any of the above steps fail, authentication fails and the FortiGate unit will not accept management from the FortiManager. This authentication process occurs at the start of any new SSL session.

Communication sequence for authentication

Each FortiGate unit maintains a local trusted list containing up to ten unique entries. This contains a list of FortiManager serial numbers that the FortiGate is willing to yield management rights to. If a FortiManager unit with a serial number not on that FortiGate’s trust list attempts to connect to the FortiGate, the unit will immediately terminate the connection and refuse to be managed. The local trusted list on the FortiGate is not configurable and the serial number of the managing FortiManager is added to the device’s trusted list when added to the FortiManager’s list of managed devices.