Administration Guide

• Setting up FortiManager
  • Connecting to the GUI
    • FortiManager Setup wizard
    • Activating VM licenses
  • Security considerations
    • Restricting GUI access by trusted host
    • Trusted platform module support
    • Other security considerations
  • GUI overview
    • Panes
    • Color themes
    • Side menu open or closed
    • Switching between ADOMs
    • Using the right-click menu
    • Using the CLI console
    • Avatars
    • Using the Process Monitor
    • Showing and hiding passwords
    • Google Map integration
  • FortiAnalyzer Features
    • Enable or disable FortiAnalyzer features
  • Initial setup
  • Restarting and shutting down
• FortiManager Key Concepts
  • Communication through protocols
    • FortiGuard
    • Device Manager
    • FortiAnalyzer features
  • Configuration through Device Manager
    • Direct device database editing
    • Indirect device database editing
    • Model devices
    • Zero-touch and low-touch provisioning
  • ADOMs and devices
    • Global ADOM layer
    • ADOM and policy layer
    • Device Manager layer
  • Operations
    • Install device settings only
    • Quick install (device db)
    • Install policy package
    • Re-install policy
    • Import configuration
    • Retrieve configuration
    • Auto-update and auto-retrieve
    • Auto-backup
    • Refresh
    • Revert
    • Sequence of operations for installation to managed devices
  • Key features of the FortiManager system
    • Security Fabric
    • Configuration revision control and tracking
    • Centralized management
    • Administrative domains
    • Local FortiGuard service provisioning
    • Firmware management
    • Scripting
    • Logging and reporting
    • Fortinet device life cycle management
• Dashboard
  • Customizing the dashboard
  • System Information widget
    • Changing the host name
    • Configuring the system time
    • Updating the system firmware
    • Backing up the system
    • Restoring the configuration
    • Migrating the configuration
  • System Resources widget
  • License Information widget
    • Registering with FortiCloud
    • Activating add-on licenses
    • Understanding license count rules
  • Unit Operation widget
  • Alert Messages Console widget
  • Log Receive Monitor widget
  • Insert Rate vs Receive Rate widget
  • Log Insert Lag Time widget
  • Receive Rate vs Forwarding Rate widget
  • Disk I/O widget
  • Device widgets
  • Restart, shut down, or reset FortiManager
• Device Manager
  • ADOMs
  • Device & Groups
    • Add devices
      • Adding online devices using Discover mode
      • Security Fabric authorization
      • Adding online devices using Discover mode and legacy login
      • Adding offline model devices
      • Adding a model FortiGate HA cluster
      • Import model devices from a CSV file
      • Adding FortiSOAR devices
      • Adding a Security Fabric group
      • Authorizing devices
      • Hiding unauthorized devices
      • Setting unauthorized device options
      • Importing detected devices
      • Importing and exporting device lists
      • Configuring the management address
      • Verifying devices with private data encryption enabled
      • Using device blueprints for model devices
      • Example of adding an offline device by pre-shared key
      • Example of adding an offline device by serial number
      • Example of adding an offline device by using device template
      • Adding FortiGate CNF device
    • Add FortiAnalyzer or FortiAnalyzer BigData
      • Adding FortiAnalyzer devices using the wizard
      • Adding FortiAnalyzer devices using a fabric connection
      • Viewing policy rules
    • Add VDOM
      • Adding a split-task VDOM
      • Adding a multi VDOM
    • Device groups
      • Default device groups
      • Adding custom device groups
      • Managing device groups
    • Table view
      • Using the quick status bar
      • Viewing managed devices
      • Viewing configuration status
      • Viewing policy package status
      • Editing device information
      • Setting values for required meta fields
      • Customizing columns
      • Displaying Security Fabric topology
      • Refreshing a device
      • Using device group tree menus
      • Installing VM licenses on managed devices
    • Ring view
      • Using the monitors dashboard
      • Customizing the monitors dashboard
    • Map view
      • Positioning devices on the map
      • Viewing device details
      • Viewing problematic devices
    • Folder view
      • Creating folders
      • Nesting folders
      • Moving devices between folders
      • Moving folders
    • Import Configuration wizard
      • Importing policies and objects
      • Importing AP profiles and FortiSwitch templates
    • Install wizard
      • Installing policy packages and device settings
      • Install device settings only
      • Out-of-Sync device
      • Viewing a policy package diff
      • Firewall policy reordering on first installation
      • Installing the device database
    • Firmware upgrade
      • Viewing installed firmware versions
      • Upgrading firmware
      • Upgrading multiple firmware images on FortiGate
      • Upgrading firmware downloaded from FortiGuard
    • Device database (DB)
      • Displaying the device database
      • Choosing feature visibility for devices
      • Using the CLI console for managed devices
      • Viewing and managing LTE modems
    • Device DB - Dashboard
      • Adding widgets to dashboards
      • Creating custom system dashboards
      • Copying custom system dashboards
      • Summary dashboard
    • Device DB - configuration management
      • Checking device configuration status
      • Viewing configuration revision history
      • Viewing configuration settings on FortiGate
      • Adding a tag to configuration versions
      • Downloading a configuration file
      • Importing a configuration file
      • Comparing different configuration files
      • Reverting to another configuration file
    • Device DB - Network Interface
      • Device zones
      • Interface packet capture
    • Device DB - System Virtual Domain
      • Enabling virtual domains
      • Viewing virtual domains
      • Creating virtual domains
      • Configuring inter-VDOM routing
      • Deleting a virtual domain
      • Editing resource limits
    • Device DB - Network SD-WAN
      • SD-WAN per-device management
      • SD-WAN zones and interface members
      • IPsec VPN Wizard
      • Performance SLA
      • SD-WAN rules
      • BGP Neighbors
      • Duplication
    • Device DB - Network BGP
    • Device DB - CLI Configurations
    • Device maintenance
      • Deleting a device
      • Replacing a managed device
    • Managing FortiGate HA clusters
      • Configuring model HA cluster members
      • FortiManager supports FortiGate auto-scale clusters
      • How FortiGate VDOM exceptions interact with FortiManager
    • Support for FortiAnalyzer HA
    • Retrieving account level entitlements for FortiGate
    • Remotely access a managed FortiGate
  • Scripts
    • Enabling scripts
    • Configuring scripts
      • Run a script
      • Add a script
      • Edit a script
      • Clone a script
      • Delete a script
      • Export a script
      • Import a script
      • Schedule a script
    • CLI script group
    • Script syntax
    • Script history
    • Script samples
      • CLI scripts
      • Tcl scripts
      • Use Tcl script to access FortiManager’s device database or ADOM database
  • Provisioning Templates
    • Template groups
      • Creating template groups
      • Assigning template groups
      • Editing template groups
      • Deleting template groups
    • Fabric authorization templates
    • System templates
      • Assigning system templates to devices and device groups
      • Previewing interface actions
      • Using meta field variables
    • IPsec tunnel templates
      • Recommended IPsec templates
      • Creating new IPsec VPN templates
      • Assigning IPsec VPN templates
      • Installing IPsec VPN configuration
      • Verifying IPsec template configuration status
      • Verifying IPsec VPN tunnel status
      • Un-assigning IPsec templates
      • IPsec tunnel template example
        • Defining the hub template
        • Defining the branch template
        • Assigning templates to devices and groups
        • Creating and installing the policy package and IPsec template
        • Verifying VPN template and tunnel status
    • SD-WAN templates
      • SD-WAN templates
      • Zones and interface members
      • Performance SLA
      • SD-WAN rules
      • Neighbors
      • Duplication
      • Assign SD-WAN templates to devices and device groups
      • Migrate an SD-WAN Orchestrator configuration into SD-WAN templates
    • SD-WAN overlay templates
      • Template prerequisites and network planning
      • Using the SD-WAN overlay template
      • Configuring an SD-WAN overlay template
      • Editing the SD-WAN overlay template
      • Onboarding new branch devices
      • Objects and templates created by the SD-WAN overlay template
      • SD-WAN overlay template IP network design
    • Static route templates
    • BGP templates
      • Recommended BGP templates
    • Certificate templates
    • Threat Weight templates
    • CLI templates
      • Adding CLI templates
      • Editing CLI templates
      • Deleting CLI templates
      • Assigning CLI templates to managed devices
      • Importing CLI templates
      • Cloning CLI templates
      • Exporting CLI templates
      • Validate CLI templates
      • CLI template groups
      • Default CLI templates
      • Using FortiManager device database variables in Jinja
    • NSX-T service templates
    • Viewing the CLI preview for provisioning templates
  • Firmware templates
    • Creating firmware templates
    • Editing firmware templates
    • Deleting firmware templates
    • Assigning firmware templates to devices
    • Previewing upgrades
    • Reviewing upgrade history
    • Upgrading devices now
    • Viewing the firmware upgrade report
  • Monitors
    • SD-WAN Monitor
      • Map View
      • Table View
      • Template View
      • Enabling SD-WAN monitoring history
      • SD-WAN cloud assisted monitoring speed test
    • VPN Monitor
    • Asset Identity Center
    • AI Analysis
    • LTE modem monitors
  • FortiMeter
    • FortiOS VMs
    • FortiWeb VMs
    • Overview
    • Points
    • Authorizing metered VMs
      • Authorizing FortiOS VMs
      • Authorizing FortiWeb VMs
    • Monitoring VMs
  • FortiGate chassis devices
    • Viewing chassis dashboard
• Policy & Objects
  • About policies
    • Policy theory
    • Global policy packages
  • Policy workflow
    • Provisioning new devices
    • Day-to-day management of devices
  • Feature visibility
  • Managing policy packages
    • Create new policy packages
    • Create new policy package folders
    • Edit a policy package or folder
    • Clone a policy package
    • Remove a policy package or folder
    • Assign a global policy package
    • Install a policy package
    • Reinstall a policy package
    • Schedule a policy package install
    • Export a policy package
    • Policy package installation targets
    • Perform a policy consistency check
    • View logs related to a policy rule
    • Find and replace objects
  • Managing policies
    • Column options
    • Policy search and filter
    • Policy hit count
    • Viewing unused policies
    • Policy Lookup
    • Creating policies
    • Creating policies based on logged traffic
    • Editing policies
      • Object selector
      • Drag and drop objects
      • Install policies only to specific devices
      • Configuring policy details
      • Reverting a Policy to a previous version
    • Create a new firewall policy
    • Create a new SSL inspection and authentication policy
    • Create a new security policy
    • Create a new firewall virtual wire pair policy
    • Create a new virtual wire pair SSL inspection and authentication policy
    • Create a new security virtual wire pair policy
    • Create a new proxy policy
    • Create a new central SNAT policy
    • Create a new central DNAT or IPv6 central DNAT policy
    • Create a new DoS policy
    • Create a new interface policy
    • Create a new multicast policy
    • Create a new local-in policy
    • Create a new traffic shaping policy
    • Create a new authentication rule
    • Hyperscale policies
    • Create a new NAC policy
    • Create a new FortiProxy firewall policy
    • Create a new FortiProxy proxy auto-configuration (PAC) policy
  • Using Policy Blocks
    • Creating Policy Blocks
    • Editing Policy Blocks
    • Adding policies to a Policy Block
    • Appending a Policy Block to a Policy Package
    • Installing Policy Blocks to target devices
    • Using Policy Blocks versus Global Policy Packages
    • Role-based access control for Policy Blocks
    • Migrating global policies to policy blocks
  • Managing objects and dynamic objects
    • Create a new object
      • Color code an object
    • Creating an IPv6 Address Template
    • Promote an Object to Global Database
    • Normalized interfaces
      • Viewing normalized interfaces
      • Viewing normalized interfaces mapped to devices
      • Viewing where normalized interfaces are used
      • Editing per-platform mapping rules
      • Deleting per-platform mapping rules
      • Deleting default normalized interfaces
      • Creating normalized interfaces
      • Creating virtual wire pairs
    • Map a dynamic ADOM object
    • Map a dynamic device object
      • Create a dynamic local certificate
      • Create a dynamic VPN Tunnel
    • Map a dynamic device group
    • Delete an object
    • Edit an object
    • Installing objects
    • Clone an object
    • Search objects
    • Find unused objects
    • Find and merge duplicate objects
    • Export signatures to CSV file format
    • CLI Configurations
    • FortiToken configuration example
    • FSSO user groups
    • Interface mapping
    • VIP mapping
    • Modify existing interface-zone mapping
    • Create a new shaping profile
      • Assigning a shaping profile
      • Viewing the traffic shaping widget
    • Intrusion Prevention filtering options
    • IPS Signatures
    • ADOM-level metadata variables
    • Default address space objects
    • Persistent object search menu
    • Zero Trust Network Access (ZTNA) objects
      • Viewing security posture tags
      • Creating ZTNA geographic IP objects
      • Creating security posture tag groups
      • Configuring a ZTNA server
    • FortiProxy content analysis objects
      • ICAP profile
      • ICAP remote server
      • ICAP load balancing
  • ADOM revisions
• AP Manager
  • Managed FortiAPs
    • Quick status bar
    • Managing APs
      • Add a FortiAP device
      • Editing FortiAP devices
      • Deleting FortiAP devices
      • Upgrading FortiAP devices
      • Importing and exporting FortiAP devices
    • FortiAP groups
    • Device summary
    • Authorizing and deauthorizing FortiAP devices
    • Installing changes to FortiAP devices
    • Rogue APs
    • Authorizing unknown APs
    • Connected clients
    • Spectrum analysis for managed APs
    • Clients Monitor
    • Health Monitor
    • Replacing APs
  • WiFi Maps
    • Google map
    • Floor map
  • WiFi profiles and settings for central management
    • Enabling FortiAP central management
    • SSIDs
      • Creating SSIDs
      • Adding SSID per-device mapping
      • Adding additional DHCP options
      • Adding a MAC address reservation
    • FortiAP profiles
    • QoS profiles
    • Bonjour profiles
    • Bluetooth profiles
    • WIDS profiles
    • L3 firewall profiles
    • ARRP profiles
    • WiFi settings
    • Assigning profiles to FortiAP devices
    • Using Fortinet recommended profiles
  • WiFi profiles and settings for per-device management
    • Enabling FortiAP per-device management
    • Creating profiles
• VPN Manager
  • Overview
  • Enabling central VPN management
  • DDNS support
  • VPN Setup Wizard supports device groups
  • IPsec VPN
    • IPsec VPN Communities
      • Managing IPsec VPN communities
      • Creating IPsec VPN communities
      • VPN community settings
      • View IPsec VPN community details
      • Editing an IPsec VPN community
      • Deleting VPN communities
    • IPsec VPN gateways
      • Managing VPN gateways
      • Creating managed gateways
      • Creating external gateways
      • Editing an IPsec VPN gateway
      • Deleting VPN gateways
    • Using Map View
    • Monitoring IPsec VPN tunnels
  • SSL VPN
    • SSL VPN settings
      • Creating SSL VPNs
      • Editing SSL VPNs
      • Deleting SSL VPNs
    • SSL VPN portals
      • Creating SSL VPN portal profiles
      • Predefined bookmarks
      • Editing portal profiles
      • Deleting portal profiles
    • SSL VPN monitor
  • VPN security policies
    • Defining policy addresses
    • Defining security policies
• Fabric View
  • Security Fabric Topology
    • Physical Topology
    • Logical Topology
    • Filter Topology Views
    • Search Topology Views
  • Security Rating
    • Viewing Security Fabric Ratings
    • Security Fabric score
  • Fabric Connectors
    • Core Network Security
      • Creating FortiClient EMS connectors
  • External Connectors
    • Public and private SDN
      • Creating ACI fabric connectors
      • Creating AWS fabric connectors
      • Using FortiManager as a SDN proxy for AWS connectors
      • Creating Microsoft Azure fabric connectors
      • Creating VMware NSX fabric connectors
      • Creating Nuage fabric connectors
      • Create Nutanix fabric connectors
      • Creating OpenStack (Horizon) connector
      • Creating Oracle Cloud Infrastructure (OCI) connector
      • Creating VMWare ESXi connector
      • Creating Kubernetes connector
      • Creating AliCloud Service connector
      • Creating Google Cloud Platform connector
      • Creating IBM Cloud connector
      • Importing address names to fabric connectors
      • Configuring dynamic firewall addresses for fabric connectors
      • Configuring virtual wire pairs
    • Threat Feeds
      • Creating threat feed connectors
    • Endpoint/Identity
      • Creating Active Directory connectors
      • Creating FSSO connectors
      • Creating RADIUS connectors
      • Creating Cisco pxGrid connectors
      • Creating ClearPass connectors
      • Creating VMware NSX-T connectors
      • Creating VMware vCenter connectors
      • Creating FortiFlex connectors
      • Creating JSON API connectors
  • Cloud Orchestration
    • Creating cloud connectors
    • Creating cloud deployment templates
    • Deploying cloud orchestration
• FortiGuard
  • Device licenses
    • View licensing status
  • Package management
    • Receive status
    • Service status
    • IoT packages
    • Exporting packages example
    • Importing packages example
  • Query services
    • Receive status
    • Query status
    • Exporting web filter databases example
    • Importing web filter databases example
    • Providing delta updates to downstream FortiManagers in cascade mode