ADOM modes
When creating an ADOM, the mode can be set to Normal or Backup.
Normal mode ADOMs
When creating an ADOM in normal mode, the ADOM is considered Read/Write, where you are able to make changes to the ADOM and managed devices from the FortiManager. FortiGate units in the ADOM will query their own configuration every 5 seconds. If there has been a configuration change, the FortiGate unit will send a diff revision on the change to the FortiManager using the FGFM protocol.
Backup mode ADOMs
Backup mode ADOMs are used to store the configurations of managed devices.
In backup mode, you cannot push new configuration changes from FortiManager to managed devices directly. Instead, changes are made using scripts run on the managed device, or through the device's GUI or CLI directly.
When adding a device to a backup ADOM, the device's configuration is automatically stored in the FortiManager device database, and revisions are sent to the FortiManager when the following specific conditions are met:
- Configuration change and session timeout
- Configuration change and log out
- Configuration change and reboot
- Manual configuration backup from the managed device
You can monitor and review the revision history for managed devices, and you can push existing revisions to managed devices.
Optionally, you can also import a device's objects (for example, firewall addresses) into the FortiManager's ADOM database, which allows these objects to be stored and shared with other managed devices. See Importing objects to backup ADOMs.
In backup mode, scripting is still allowed for pushing scripts directly to FortiGate units.
|
Enable fcp-cfg-service for backup mode ADOMsIn order to perform configuration backups from the CLI of a FortiGate device that is in a backup mode ADOM, you must first enable " config system global set fcp-cfg-service enable end |