FortiGate / FortiOS

FortiManager

FortiAnalyzer

Administration Guide

Setting up FortiManager
- Connecting to the GUI
  - FortiManager Setup wizard
  - Activating VM licenses
- Security considerations
- GUI overview
- FortiAnalyzer Features
  - Enable or disable FortiAnalyzer features
- Initial setup
- Restarting and shutting down
FortiManager Key Concepts
- Communication through protocols
- Configuration through Device Manager
- ADOMs and devices
- Operations
- Key features of the FortiManager system
Dashboard
- Customizing the dashboard
- System Information widget
- System Resources widget
- License Information widget
- Unit Operation widget
- Alert Messages Console widget
- Log Receive Monitor widget
- Insert Rate vs Receive Rate widget
- Log Insert Lag Time widget
- Receive Rate vs Forwarding Rate widget
- Disk I/O widget
- Device widgets
- Restart, shut down, or reset FortiManager
Device Manager
- ADOMs
- Device & Groups
- Scripts
- Provisioning Templates
- Firmware templates
- Monitors
- FortiGate chassis devices
  - Viewing chassis dashboard
Policy & Objects
- About policies
  - Policy theory
  - Global policy packages
- Policy workflow
  - Provisioning new devices
  - Day-to-day management of devices
- Feature visibility
- Managing policy packages
- Managing policies
- Using Policy Blocks
- Managing objects and dynamic objects
- ADOM revisions
SD-WAN Manager
- SD-WAN Network
  - SD-WAN Devices
  - SD-WAN Monitor
- SD-WAN Templates
- SD-WAN overlay orchestration
- SD-WAN rules
- Upgrading FortiManager with SD-WAN devices and templates
AP Manager
- Managed FortiAPs
- WiFi Maps
  - Google map
  - Floor map
- WiFi profiles and settings for central management
- WiFi profiles and settings for per-device management
  - Enabling FortiAP per-device management
  - Creating profiles
VPN Manager
- Overview
- Enabling central VPN management
- DDNS support
- VPN Setup Wizard supports device groups
- IPsec VPN
- Agentless VPN
- VPN security policies
  - Defining policy addresses
  - Defining security policies
- VPN CLI configurations
FortiView
Fabric View
- Security Fabric Topology
- Security Rating
  - Viewing Security Fabric Ratings
  - Security Fabric score
- Fabric Connectors
  - Core Network Security
    - Creating FortiClient EMS connectors
- External Connectors
- Cloud Orchestration
FortiAI
- Enabling administrator access to FortiAI
- Using FortiAI
- FortiAI data privacy
- FortiAI tokens
- FortiAI example tasks
- Submitting feedback for FortiAI
- Configuring role-based access control for FortiAI
FortiGuard
- Device licenses
  - View licensing status
- Package management
- Query services
- Firmware images
- External resources
- Settings
- Enabling FDN third-party SSL validation and Anycast support
- Configuring devices to use the built-in FDS
  - Handling connection attempts from unauthorized devices
  - Configure a FortiManager without Internet connectivity to access a local FortiManager as FDS
- Configuring FortiGuard services
- Logging events related to FortiGuard services
  - Logging FortiGuard antivirus and IPS updates
  - Logging FortiGuard web or email filter events
- Restoring the URL or antispam database
FortiSwitch Manager
- Managed FortiSwitches
- FortiSwitch central management
  - Enabling FortiSwitch central management
  - FortiSwitch Templates
- FortiSwitch per-device management
Extender Manager
- Managed extenders
  - Managing FortiExtender devices
- Extender profiles
  - FortiExtender profiles
  - Using Fortinet recommended extender profiles
- Data plans
- FortiExtender SSIDs
- Preview the JSON API or CLI script for Extender Manager configurations
System Settings
- Logging Topology
- Network
- RAID Management
- Administrative Domains (ADOMs)
- Fabric Management
- Certificates
- Event Log
  - Event log filtering
- Task Monitor
- Mail Server
- Syslog Server
  - Send local logs to syslog server
- Meta Fields
- Device logs
  - Configuring rolling and uploading of logs using the GUI
  - Configuring rolling and uploading of logs using the CLI
- Miscellaneous Settings
Administrators
- Trusted hosts
- Monitoring administrators
- Disconnecting administrators
- Managing administrator accounts
- Restricted administrators
- Administrator profiles
- Workspace
- Authentication
- Global administration settings
- Multi-factor authentication
  - Multi-factor authentication with FortiAuthenticator
    - Configuring FortiAuthenticator
    - Configuring FortiManager
  - Multi-factor authentication with FortiToken Cloud
High Availability
- Synchronizing the FortiManager configuration and HA heartbeat
- If the primary or a backup unit fails
- FortiManager HA cluster startup steps
- Configuring HA options
- Monitoring HA status
- Upgrading the FortiManager firmware for an operating cluster
Appendix A - Supported RFC Notes
Appendix B - Policy ID support
Appendix C - FortiManager Ansible Collection documentation
Appendix D - FortiAI token entitlements for FortiManager
Appendix E - VM license migration
Change Log

Home FortiManager 7.6.6 Administration Guide

7.6.6

Upgrading FortiManager with SD-WAN devices and templates

In FortiManager 7.6 and later, some SD-WAN configurations have been moved from the Device Manager into the SD-WAN Manager to allow administrators to centrally manage and monitor SD-WAN configurations from one location.

Following an upgrade from an earlier version, for example, FortiManager 7.4, managed SD-WAN devices will remain in the Device Manager. You must enable SD-WAN Management on these devices to add them to the SD-WAN Manager. See SD-WAN Devices.

Starting in FortiManager 7.6.3, further enhancements have been made to simplify the process of centrally managing FortiGate devices with SD-WAN Management enabled, allowing more resources to be shared between the Device Manager and SD-WAN Manager.

See the list below to determine how to manage your SD-WAN devices and templates following an upgrade based on your FortiManager version:

Devices and device groups

Behavior in 7.4 and earlier	Behavior in 7.6.0 - 7.6.2	Behavior in 7.6.3 and later
Devices and device groups used in SD-WAN configurations are managed using Device Manager.	Devices with SD-WAN Management enabled can only be managed using SD-WAN Manager > Network > Devices. Device groups can be created in Device Manager and can include devices with or without SD-WAN Management enabled.	Devices with SD-WAN Management enabled can be managed from both the SD-WAN Manager and Device Manager. Device groups can be created in Device Manager and can include devices with or without SD-WAN Management enabled.

SD-WAN provisioning templates

Behavior in 7.4 and earlier	Behavior in 7.6.0 - 7.6.2	Behavior in 7.6.3 and later
IPsec, BGP, static route, and CLI templates are managed from Device Manager.	IPsec, BGP, static route, and CLI templates can be created from SD-WAN Manager or Device Manager but are not shared. Templates created in SD-WAN Manager can only be applied to devices with SD-WAN Management enabled. Templates created in the Device Managercan be applied to all managed devices.	The Device Manager and SD-WAN Manager share the same provisioning templates. IPsec, BGP, static route, and CLI templates created in either location can be applied to devices with or without SD-WAN Management enabled.

Template groups

Behavior in 7.4 and earlier	Behavior in 7.6.0 - 7.6.2	Behavior in 7.6.3 and later
Template groups are managed in Device Manager > Provisioning Templates.	Template groups can be created in both the SD-WAN Manager or Device Manager. Template groups are not shared between the SD-WAN Manager and Device Manager. Template groups can contain provisioning templates from both Device Manager and SD-WAN Manager.	Template groups can be created in both the SD-WAN Manager or Device Manager. Template groups created in the Device Manager are not shown in the SD-WAN Manager. Template groups can contain provisioning templates from both Device Manager and SD-WAN Manager.

SD-WAN templates

Behavior in 7.4 and earlier	Behavior in 7.6.0 - 7.6.2	Behavior in 7.6.3 and later
SD-WAN templates are managed in Device Manager > Provisioning Templates > SD-WAN Template.	SD-WAN templates are managed in SD-WAN Manager > Rules. SD-WAN templates can only be applied to devices with SD-WAN Management enabled.	SD-WAN templates can be managed in SD-WAN Manager or Device Manager. SD-WAN templates are shared between SD-WAN Manager and Device Manager. SD-WAN templates can be applied to devices with or without SD-WAN Management enabled.

SD-WAN overlay templates

Behavior in 7.4 and earlier	Behavior in 7.6.0 - 7.6.2	Behavior in 7.6.3 and later
SD-WAN overlay templates are managed in Device Manager > Provisioning Templates > SD-WAN Overlay Templates.	SD-WAN overlay templates are managed in SD-WAN Manager > Overlay Orchestration.	SD-WAN overlay templates can be managed in SD-WAN Manager or Device Manager. SD-WAN overlay templates are shared between SD-WAN Manager and Device Manager.

SD-WAN Monitor

Behavior in 7.4 and earlier	Behavior in 7.6.0 - 7.6.2	Behavior in 7.6.3 and later
SD-WAN Monitor can be viewed in Device Manager > Monitors.	The SD-WAN monitor can be viewed in SD-WAN Manager > Network > Monitor.	The SD-WAN monitor can be viewed in both SD-WAN Manager and Device Manager.