Central Management

Some customers require a centralized way to manage configuration for their on-premise FortiGate devices and remote users connecting using FortiSASE. FortiSASE integrates with FortiManager to provide central management for a selected set of configuration settings. In FortiManager, configuration settings such as addresses, address groups, and security profile groups are also known as objects.

Central management supports only one-way configuration synchronization from FortiManager to FortiSASE. Therefore, avoid deleting objects from FortiManager to prevent any conflicts.

Central management supports synchronizing a maximum of 3000 objects at once from FortiManager.

The following configuration settings synchronize from FortiManager to FortiSASE:

• Security profile group:
  • SSL/SSH Inspection (SSL Inspection only)
  • AntiVirus Profile
  • Web Filter Profile (custom categories not supported)
  • IPS Profile
  • File Filter Profile
  • DLP Profile
  • DNS Filter
  • Application Control
  • Video Filter profile
• Firewall address and address group
• Security profile group
• Local, PKI, and LDAP users and user groups
• Authentication sources (LDAP and RADIUS)

If you attempt to synchronize any security profiles or other configuration settings from FortiManager that FortiSASE does not support, they are ignored and not synchronized to FortiSASE. FortiSASE treats all flow-based features synchronized from FortiManager as proxy-based features (best match). Security profiles are synchronized with FortiSASE for use with Internet Access security profile groups only.

User groups used for single sign on authentication (SAML) are outside the scope of central management. The FortiSASE administrator must maintain them through the corresponding portal configuration pages.

After enabling central management, objects synchronized from FortiManager to FortiSASE are considered read-only and you cannot modify them directly in FortiSASE.

An administrator follows this configuration workflow for central management:

1. Configure FortiSASE for central management.
2. Configure FortiManager for central management.
3. Verify configuration updates performed using central management.