# Administration and Management ### **1.1 Overview of FortiManager** #### **What is FortiManager?** FortiManager is a centralized **network security management solution** developed by **Fortinet**. It provides administrators with a **single platform** to manage multiple Fortinet security devices, particularly **FortiGate firewalls**. Instead of configuring each FortiGate manually, **FortiManager allows centralized control**, saving time, reducing errors, and improving security consistency across the network. #### **Why Do You Need FortiManager?** Imagine you are managing **hundreds of FortiGate firewalls** spread across different locations. Configuring each firewall manually would be **time-consuming, error-prone, and inefficient**. With FortiManager, you can: - **Apply security policies** across multiple firewalls at once. - **Ensure consistent security settings** across all devices. - **Monitor network activity** and generate reports. - **Backup and restore device configurations** to prevent data loss. #### **Key Features and Benefits** FortiManager offers several features that make it essential for large-scale Fortinet deployments: 1. **Centralized Configuration Management** - Instead of configuring each firewall separately, administrators can **manage security policies, NAT rules, firewall configurations, and objects** from a single interface. - This ensures **consistency** across multiple FortiGate devices. 2. **Multi-Domain Administration (ADOMs)** - ADOMs (Administrative Domains) allow network administrators to **segment the network into different administrative areas**. - Example: A large organization with **multiple branches** can assign **each branch its own ADOM**, ensuring that changes in one branch **do not affect other branches**. 3. **Automated Backup and Revision Control** - FortiManager automatically **saves different versions of device configurations**. - If a **mistake is made** or a **configuration issue arises**, administrators can **restore previous settings**. 4. **Real-time Monitoring and Logging** - FortiManager collects **logs from all connected devices**, providing real-time visibility into **network threats, security events, and compliance status**. - Example: If a firewall detects **suspicious activity**, FortiManager logs it and can trigger an **alert**. 5. **Integration with FortiAnalyzer** - FortiManager can work with **FortiAnalyzer**, a powerful log management and analytics tool. - This integration allows administrators to perform **detailed forensic analysis, log correlation, and reporting** for enhanced security insights. ### **1.2 FortiManager Access Methods** Administrators can interact with FortiManager using **three primary access methods**: #### **1. Graphical User Interface (GUI)** - The **GUI is a web-based interface** that provides an easy-to-use dashboard. - It includes the following key sections: - **Dashboard** – Displays system status, device health, and alerts. - **Device Manager** – Allows administrators to register, monitor, and configure FortiGate devices. - **Policy & Objects** – Used to define firewall policies, address groups, services, and security profiles. - **FortiGuard Services** – Manages security services like IPS, Antivirus, and Web Filtering. - **Log View & Reports** – Provides real-time monitoring and historical analysis of network events. - **How to Access FortiManager GUI:** 1. Open a web browser (Chrome, Firefox, Edge, etc.). 2. Enter FortiManager’s IP address in the address bar. 3. Log in using your **administrator username and password**. 4. Navigate through the dashboard to manage your network. #### **2. Command-Line Interface (CLI)** - CLI provides a **text-based command environment** for **advanced users**. - It is useful for **scripting, troubleshooting, and bulk configuration**. - Administrators can access the CLI via: - **SSH (Secure Shell)** for remote access. - **Console (Serial Port)** for direct physical access. - **Common CLI Commands:** - **Check system status:** ```bash get system status ``` - **View registered devices:** ```bash show device ``` - **Restart FortiManager:** ```bash execute reboot ``` #### **3. REST API** - The **REST API (Representational State Transfer Application Programming Interface)** allows administrators to **automate tasks and integrate FortiManager with third-party applications**. - It enables bulk configuration changes **without manual intervention**. - Example API request to fetch firewall policies: ```bash curl -X GET "https://fortimanager-ip/api/v2/cmdb/firewall/policy" ``` - **Why Use the API?** - Automates repetitive tasks (e.g., adding new firewall rules). - Reduces human error. - Allows integration with other security tools. ### **1.3 FortiManager System Administration** #### **1. System Settings Configuration** Administrators must configure basic system settings before using FortiManager effectively. ##### **Hostname and System Time Settings** - The hostname is the **unique identifier** for the FortiManager device. - System time should be synchronized with **NTP (Network Time Protocol)** to ensure accurate log timestamps. - Example CLI command to configure NTP: ```bash config system ntp set server "pool.ntp.org" set syncinterval 60 end ``` ##### **Network Interfaces and IP Address Configuration** - FortiManager must have a **static IP address** to be reachable. - Interfaces should be assigned to **different network zones** for security. - Configuration example: ```bash config system interface edit "port1" set ip 192.168.1.100 255.255.255.0 next end ``` ##### **DNS and Routing Settings** - Configure **DNS servers** to enable FortiManager to resolve domain names. - **Static routes** should be defined for proper network communication. - Example DNS setup: ```bash config system dns set primary 8.8.8.8 set secondary 8.8.4.4 end ``` #### **2. Administrator Accounts and Roles** FortiManager supports **different administrator roles** to enforce security and access control. ##### **Types of Administrator Accounts** 1. **Super_Admin** - Has **full access** to all features, settings, and ADOMs. - Can **create new administrators** and manage security policies. 2. **Restricted_Admin** - Has **limited access** based on **role-based permissions**. - Can only modify **assigned policies and devices**. 3. **API User** - A specialized account for **automation tasks** using **REST API**. - Cannot log into the GUI but can interact with FortiManager through API calls. #### **3. Role-Based Access Control (RBAC)** - **RBAC allows administrators to define roles** with specific permissions. - **Why is RBAC important?** - Ensures **only authorized users** can modify security settings. - Limits **potential misconfigurations** by junior administrators. - Example RBAC settings: - **Read-Only Admin** – Can view settings but **cannot make changes**. - **Policy Manager** – Can modify firewall policies **but not system settings**. - **Device Manager** – Can register and configure FortiGate devices **but not change policies**. #### **4. FortiManager High Availability (HA)** - **HA ensures system reliability** by **preventing downtime**. - **Active-Passive (A-P) mode**: One **active** unit and one **backup** unit. - **Database Synchronization**: Ensures configurations are replicated **across multiple FortiManager instances**. ### **1.4 FortiManager Overview With Hands-on Examples** #### **Lab Setup for Learning FortiManager** To practice **FortiManager administration**, you can set up a lab environment using one of the following methods: ##### **Option 1: Use a Fortinet Virtual Machine (VM)** 1. Download **FortiManager VM** from the **Fortinet Support Portal** (requires a Fortinet account). 2. Deploy the **FortiManager VM** in **VMware Workstation, VirtualBox, or ESXi**. 3. Configure a FortiGate device in the same virtual environment to register and manage. ##### **Option 2: Use an Online Fortinet Lab** - Fortinet provides **online training environments** for certification courses. - Visit [Fortinet NSE Training](https://training.fortinet.com) and register for **FortiManager Labs**. #### **1. Accessing the FortiManager GUI** ##### **Step 1: Log into FortiManager** 1. Open a **web browser** (Chrome, Firefox, Edge). 2. Enter the **FortiManager IP Address** in the browser (e.g., `https://192.168.1.100`). 3. Log in using **admin credentials**. ##### **Step 2: Explore the Dashboard** The **Dashboard** provides an overview of: - **System Status** (CPU, memory usage, and system uptime). - **Device Manager** (Lists all FortiGate devices). - **Policy & Objects** (Where you manage firewall rules). - **Log View & Reports** (Shows traffic and security events). **[Screenshot: FortiManager Dashboard]** *(I will generate an image representation for you upon request.)* ##### **Step 3: Configure System Settings** 1. Go to **System Settings → Network**. 2. Set the **Hostname** (e.g., `FortiManager-Training`). 3. Configure the **Management IP Address** (e.g., `192.168.1.100`). 4. Set **DNS Servers** (e.g., Google DNS `8.8.8.8`). **Lab Exercise:** Try to **change the hostname** in FortiManager and verify if it updates in the CLI. #### **2. Using FortiManager CLI (Hands-on)** **Why use the CLI?** - The **CLI** is useful for **advanced configurations** and **troubleshooting**. - You can access it via **SSH or the Console**. ##### **How to Access FortiManager CLI** 1. Open **PuTTY** or any **SSH client**. 2. Connect to FortiManager using: ```bash ssh admin@192.168.1.100 ``` 3. Enter your **admin password**. ##### **Basic CLI Commands** 1. **Check System Status** ```bash get system status ``` **Expected Output:** - Displays **FortiManager version, serial number, and uptime**. 2. **Show Current Network Configuration** ```bash show system interface ``` **Expected Output:** - Shows **configured interfaces and IP addresses**. 3. **Set a Static IP Address** ```bash config system interface edit "port1" set ip 192.168.1.100 255.255.255.0 set allowaccess ping http https ssh next end ``` **Expected Output:** - Updates **IP address and access permissions**. **Lab Exercise:** Try to **change the FortiManager IP address** and verify it in the **GUI and CLI**. #### **3. FortiManager API (Automation Practice)** **Why use the API?** - Allows **automation** of firewall rule deployment. - Helps integrate **FortiManager with third-party tools**. ##### **Step 1: Enable API Access** 1. Log into **FortiManager GUI**. 2. Navigate to **System Settings → Admin Settings**. 3. Enable **REST API Access**. ##### **Step 2: Make an API Request** - Open a terminal and execute: ```bash curl -k -X GET "https://192.168.1.100/api/v2/cmdb/firewall/policy" ``` **Expected Output:** - Returns **a list of firewall policies**. **Lab Exercise:** Try to **create a new API user** and retrieve FortiManager policies using an API request. ### **1.5 FortiManager User Accounts and Role-Based Access Control (RBAC)** #### **1. Creating Administrator Accounts** 1. Go to **System Settings → Administrators**. 2. Click **Create New**. 3. Set: - **Username:** `security_admin` - **Password:** `StrongPassword123` - **Administrator Profile:** `Read-Only` 4. Click **OK**. **Expected Outcome:** - A **new user with limited permissions** is created. **Lab Exercise:** Log out and try **logging in with the new administrator account**. Check what **functions are restricted**. #### **2. Configuring Role-Based Access Control (RBAC)** ##### **Why RBAC is Important** - Ensures **only authorized users** can modify settings. - Protects against **accidental or malicious changes**. ##### **Example: Creating a Custom Role** 1. Navigate to **System Settings → Admin Profiles**. 2. Click **Create New** and set: - **Profile Name:** `Policy_Manager` - **Permissions:** Only allow access to **Policy & Objects**. 3. Assign this role to a **new administrator**. **Lab Exercise:** Try creating **another administrator with only read access** and verify their permissions. ### **1.6 FortiManager High Availability (HA)** **Why Use HA?** - Ensures **failover protection**. - Prevents **downtime** if one FortiManager fails. ##### **Step 1: Configure Active-Passive HA** 1. Connect to **both FortiManager devices**. 2. On the **Primary Device (Active)**, run: ```bash config system ha set mode a-p set group-name "FMG-HA" set priority 200 end ``` 3. On the **Secondary Device (Passive)**, run: ```bash config system ha set mode a-p set group-name "FMG-HA" set priority 100 end ``` 4. Check HA status: ```bash diagnose system ha status ``` **Expected Outcome:** - The **Primary device (Active)** handles management. - If it fails, the **Secondary device (Passive)** takes over. **Lab Exercise:** Simulate an **HA failover** by shutting down the **Primary device** and checking if the **Secondary device** takes over. --- # Device Registration ### **2.1 FortiGate Registration Process** #### **What is Device Registration in FortiManager?** Device registration is the process of **connecting** a FortiGate firewall to FortiManager so that it can be centrally **managed, monitored, and configured**. Before a FortiGate firewall can be managed by FortiManager, it must go through the **registration process**, which involves **four key steps**: 1. **Connecting FortiGate to FortiManager** - The FortiGate firewall needs to be **configured to communicate** with FortiManager. - FortiGate and FortiManager must be **reachable over the network**. - Correct **management ports (TCP/541 and TCP/443)** must be **open** to allow communication. 2. **Authorizing the Device within FortiManager** - When a FortiGate requests registration, it appears in the **Pending Devices** section in FortiManager. - An administrator must manually **approve** or **reject** the device. 3. **Assigning the Device to an Administrative Domain (ADOM)** - If **ADOMs (Administrative Domains) are enabled**, the device must be assigned to the **correct ADOM**. - If **ADOMs are disabled**, the device is automatically assigned to the **root ADOM**. 4. **Synchronizing Device Settings** - After approval, FortiManager retrieves **existing configuration settings** from FortiGate. - This ensures that FortiManager and FortiGate settings **match**. #### **Hands-on Lab: Checking Connectivity Before Registration** Before registering the device, you need to make sure that FortiGate can **communicate** with FortiManager. ##### **Step 1: Check Network Connectivity** On the FortiGate device, run the following command to **ping FortiManager**: ```bash execute ping ``` If the ping is **successful**, the network connection is working. If it **fails**, check: - Network routing between FortiGate and FortiManager. - Firewall policies that might be **blocking traffic**. ##### **Step 2: Verify FortiGate’s Management Configuration** To check the current FortiManager settings on FortiGate, run: ```bash show system central-management ``` If the output shows **FortiManager settings**, the device is already configured for central management. ##### **Step 3: Open Required Ports on FortiGate** To ensure that FortiGate can communicate with FortiManager, you may need to **allow the following ports**: - **TCP/541** → FortiGate uses this port to communicate with FortiManager. - **TCP/443** → Required for web-based management access. Use the following CLI command to allow FortiManager access: ```bash config system interface edit "port1" set allowaccess ping https ssh fgfm next end ``` This command ensures that **ping, HTTPS, SSH, and FortiGate-FortiManager (fgfm) connections** are enabled on the management interface. ### **2.2 Methods of Device Registration** There are **four primary methods** for registering FortiGate devices with FortiManager. Let’s go through them **step by step**. #### **1. Manual Registration (GUI-based)** This method requires an **administrator to manually enter** the FortiGate device’s details into FortiManager. ##### **Steps for Manual Registration:** 1. **Log in** to the **FortiManager GUI**. 2. Navigate to **Device Manager**. 3. Click **"Add Device"**. 4. Fill in the following details: - **Device Name**: Give a recognizable name to the FortiGate. - **IP Address**: Enter the **FortiGate’s management IP address**. - **Username & Password**: Provide **admin credentials** for FortiGate. 5. Click **OK** to save. 6. The device will appear under **Pending Devices**. 7. **Manually approve** the device in FortiManager. ##### **Hands-on Lab: Manual Registration** Try registering a FortiGate manually and verify its status under **Device Manager**. #### **2. Automatic Registration (Pre-configured Setup)** This method is **useful for large-scale deployments** where devices are **pre-configured** to contact FortiManager. ##### **How Automatic Registration Works** 1. The FortiGate device is **pre-configured** with FortiManager’s IP. 2. When the device **connects to the network**, it **automatically sends a registration request**. 3. The administrator logs into FortiManager and **approves the request**. ##### **CLI Configuration for Automatic Registration** On the **FortiGate device**, run the following CLI commands: ```bash config system central-management set type fortimanager set fmg 192.168.1.100 # Replace with your FortiManager IP end ``` Once this is set, the FortiGate device **automatically appears** in FortiManager for approval. ##### **Hands-on Lab: Automatic Registration** Try setting up **automatic registration** and see if FortiManager **detects the device** automatically. #### **3. Zero-Touch Provisioning (ZTP)** **Best for large enterprises** deploying multiple devices at once. ##### **How ZTP Works** 1. **FortiDeploy Cloud** automatically assigns the correct FortiManager IP to new FortiGate devices. 2. The devices connect to FortiManager **without manual intervention**. 3. The administrator only **approves the request**. ##### **Advantages of ZTP** - **No manual setup required**. - Works **out of the box**. - Ideal for **remote branch deployments**. ##### **Hands-on Lab: ZTP** If you have access to **FortiDeploy**, try setting up **Zero-Touch Provisioning**. #### **4. Script-Based Registration (CLI-based)** If you prefer **using the CLI**, you can manually register a FortiGate device using the following commands. ##### **CLI Commands for Manual Registration** ```bash config system central-management set type fortimanager set fmg 192.168.1.100 # Replace with FortiManager’s IP set fmg-source-ip 192.168.1.1 # Optional: Specify source IP end ``` ##### **Hands-on Lab: Script-Based Registration** - Run the above commands on **FortiGate CLI**. - Log into FortiManager and approve the request. ### **2.3 Device Connectivity Status** After a device is registered, FortiManager displays its **status** to indicate whether it is properly connected. | **Status** | **Meaning** | | --- | --- | | **Pending Approval** | The device has requested registration but is waiting for administrator approval. | | **Authorized** | The device is registered and managed by FortiManager. | | **Unauthorized** | The device was rejected by an administrator. | | **Disconnected** | The device is offline and not communicating with FortiManager. | #### **Checking Device Status in CLI** To check **FortiGate’s connection status**, use the following command: ```bash diagnose sys central-management status ``` This command provides **real-time information** about whether **FortiGate is properly registered and communicating** with FortiManager. ##### **Hands-on Lab: Checking Connection Status** Run the above command and verify whether: - The device is **connected** to FortiManager. - The status is **Authorized**. ### **2.4 Troubleshooting FortiGate Registration Issues** Even after configuring a FortiGate device to register with FortiManager, you may encounter **registration failures** or **connection issues**. Below are the **common problems** and how to fix them. #### **1. FortiGate is not appearing in FortiManager (Registration Failure)** ##### **Possible Causes:** - The **FortiManager IP is incorrect** in the FortiGate configuration. - Network connectivity between FortiGate and FortiManager is **blocked**. - The required **management ports (TCP/541 and TCP/443) are closed**. - FortiGate is in a **different subnet** and cannot reach FortiManager. - The FortiGate **firmware is incompatible** with FortiManager. ##### **Solution:** 1. **Verify the IP address configuration** Run the following command on FortiGate: ```bash show system central-management ``` Ensure that the **FortiManager IP is correct**. 2. **Check network connectivity** Try **pinging FortiManager** from FortiGate: ```bash execute ping ``` If ping fails, check the **routing and firewall policies**. 3. **Check if FortiManager is reachable on the required ports** From FortiGate, run: ```bash execute telnet 541 execute telnet 443 ``` If the connection fails, make sure that **TCP/541 and TCP/443** are open. #### **2. FortiGate is stuck in "Pending Approval" state** ##### **Possible Causes:** - The FortiGate **has sent a request**, but no administrator has **approved it** in FortiManager. - The **wrong ADOM (Administrative Domain)** was selected during approval. - The FortiGate firmware version **does not match** FortiManager’s expected version. ##### **Solution:** 1. **Check pending devices in FortiManager** - Log in to **FortiManager GUI**. - Go to **Device Manager → Pending Devices**. - Select the **FortiGate** and click **Approve**. 2. **Check if ADOMs are enabled** - Go to **System Settings → ADOMs**. - Ensure that the FortiGate is assigned to the **correct ADOM**. 3. **Verify Firmware Compatibility** - Go to **System Settings → FortiGuard**. - Check the **supported firmware versions**. - If the FortiGate firmware is too old, consider **upgrading it**. #### **3. FortiGate is showing as "Disconnected" in FortiManager** ##### **Possible Causes:** - The FortiGate device is **powered off**. - The **network connection is lost** between FortiGate and FortiManager. - FortiManager **reached the device limit** (in licensed versions). - The FortiGate **management IP has changed**, and FortiManager cannot reach it. ##### **Solution:** 1. **Check FortiGate’s connectivity from CLI** ```bash diagnose sys central-management status ``` This command shows whether **FortiGate is communicating** with FortiManager. 2. **Re-establish the connection manually** If FortiGate is no longer communicating, try re-registering it: ```bash config system central-management set type fortimanager set fmg end ``` 3. **Check the device limit on FortiManager** - If you are using a **trial version**, check how many devices can be registered. ### **2.5 Managing Registered Devices in FortiManager** Once a FortiGate device is successfully registered in FortiManager, you can perform **various management tasks**. #### **1. Viewing Registered Devices** - Go to **Device Manager → Managed Devices**. - You will see a list of **all FortiGate devices**. #### **2. Synchronizing Configuration** After registering a device, FortiManager retrieves its **existing configuration**. ##### **How to manually synchronize a device:** 1. Go to **Device Manager**. 2. Click on the FortiGate device. 3. Click **Retrieve Config**. Alternatively, you can synchronize via CLI: ```bash diagnose sys central-management sync-status ``` ### **2.6 Policy Synchronization Between FortiManager and FortiGate** When a device is first registered, FortiManager does **not** automatically apply new policies. The administrator must **push** the policy packages to FortiGate. #### **Steps to Apply Policies from FortiManager to FortiGate** 1. **Log in** to FortiManager. 2. Go to **Policy & Objects**. 3. Select the **Policy Package** assigned to the device. 4. Click **Install Wizard**. 5. Choose the **target FortiGate device**. 6. Click **Install**. ##### **Checking Policy Sync Status in CLI** On FortiGate, you can check if the latest policies are applied: ```bash diagnose sys cmdb status ``` ### **2.7 Hands-on Lab Exercises** These exercises will help you **practice the concepts** we covered. #### **Exercise 1: Manually Register a FortiGate Device** 1. Log into **FortiManager GUI**. 2. Go to **Device Manager** and click **Add Device**. 3. Enter: - **Device Name**: `Branch-Firewall` - **IP Address**: `192.168.1.10` - **Admin Username & Password**. 4. Click **OK**. 5. Approve the device in **Pending Devices**. #### **Exercise 2: Register FortiGate Using CLI** 1. Open **FortiGate CLI**. 2. Run: ```bash config system central-management set type fortimanager set fmg 192.168.1.100 # Replace with your FortiManager IP end ``` 3. Log into **FortiManager** and approve the device. #### **Exercise 3: Troubleshoot a Disconnected FortiGate** 1. Run the following command on FortiGate: ```bash diagnose sys central-management status ``` 2. If FortiGate is disconnected, try **re-registering** it. 3. Run: ```bash execute ping ``` If ping fails, check **network connectivity**. --- # Device-Level Configuration and Installation ### **3.1 Configuration Management in FortiManager** #### **What is Configuration Management?** Configuration management in FortiManager allows administrators to **centrally manage multiple FortiGate firewalls**. Instead of configuring each FortiGate manually, you can use **FortiManager to push standardized configurations** across your network. #### **Key Features of Configuration Management in FortiManager** 1. **Create and Edit Firewall Configurations Centrally** - Instead of logging into each FortiGate separately, you can **modify all settings** from FortiManager. - This includes **interfaces, routing, security policies, and VPN settings**. 2. **Use Configuration Templates for Multiple Devices** - If you have **many FortiGate devices**, you can create **standard templates** to apply common settings. - This ensures that all devices have **consistent configurations**. 3. **Track Configuration Changes with Revision History** - FortiManager keeps a **record of all changes** made to firewall configurations. - You can see **who modified what** and when. 4. **Rollback to Previous Configurations if Needed** - If a **configuration change causes issues**, you can **revert** to an older version with a single click. #### **Hands-on Lab: Viewing and Editing Configuration in FortiManager** ##### **Step 1: Viewing a FortiGate’s Configuration in FortiManager** 1. **Log in** to FortiManager GUI. 2. Navigate to **Device Manager**. 3. Click on the **FortiGate device** you want to manage. 4. Go to **System Settings → Configuration**. 5. Click **Retrieve Config** to get the latest settings from the device. ##### **Step 2: Editing a Configuration** 1. After retrieving the configuration, go to **Policy & Objects**. 2. Modify a setting, for example: - Change the **default gateway** under **Network Settings**. - Modify an existing **security policy**. 3. Click **Save**. ##### **Step 3: Pushing the Configuration to FortiGate** 1. Click **Install Wizard**. 2. Select the **FortiGate device** to apply the changes. 3. Click **Preview Changes** to ensure everything is correct. 4. Click **Install** to push the new configuration. **Expected Outcome:** - The new configuration should now be applied to the FortiGate device. - If something goes wrong, you can **rollback to a previous configuration version**. ### **3.2 Policy Packages and Installations** #### **What is a Policy Package?** A **Policy Package** in FortiManager is a **set of firewall rules, NAT settings, and security profiles** that you can apply to FortiGate devices. Instead of configuring rules **one by one**, you can create a **template** and apply it to multiple firewalls. #### **Components of a Policy Package** 1. **Firewall Rules** – Control traffic flow between networks. 2. **NAT Settings** – Define how IP addresses are translated. 3. **Security Profiles** – Includes antivirus, web filtering, IPS, etc. #### **Steps to Create and Install a Policy Package** ##### **Step 1: Create a Policy Package** 1. **Log in** to FortiManager. 2. Navigate to **Policy & Objects**. 3. Click **Create New → Policy Package**. 4. Enter a **name** and description for the policy package. ##### **Step 2: Define Firewall Rules** 1. Click **Add New Policy**. 2. Define the following settings: - **Source & Destination** networks. - **Services** (e.g., allow HTTP, SSH, etc.). - **Security Profiles** (IPS, Web Filtering, etc.). 3. Click **Save**. ##### **Step 3: Assign the Policy Package to a Device** 1. Go to **Device Manager**. 2. Select a **FortiGate device**. 3. Click **Assign Policy Package**. 4. Choose the **policy package you created**. 5. Click **OK**. ##### **Step 4: Preview Changes Before Deployment** 1. Click **Install Wizard**. 2. Select the target **FortiGate device**. 3. Click **Preview Changes**. - This step ensures you are not overwriting **critical settings**. ##### **Step 5: Install the Policy Package on the Device** 1. Click **Install**. 2. Wait for the **installation to complete**. 3. Verify that the **new policies are active** on the FortiGate device. **Expected Outcome:** - The **new security policies** should now be applied to the firewall. - The **FortiGate device will enforce** the new rules and security settings. ### **3.3 Configuration Synchronization** #### **Why Do We Need Configuration Synchronization?** When managing multiple firewalls, it’s important to **keep configurations up to date**. FortiManager allows **two types** of synchronization: 1. **Manual Sync** – Admins must manually trigger synchronization. 2. **Automatic Sync** – FortiManager periodically updates configurations. #### **Manual Synchronization Process** ##### **Step 1: Check if FortiGate and FortiManager Are Synchronized** 1. Open **FortiManager GUI**. 2. Go to **Device Manager**. 3. Check the **Sync Status** next to each device. - **Green** = Synced - **Red** = Out of sync ##### **Step 2: Manually Sync the Configuration** 1. Select the FortiGate device. 2. Click **Retrieve Config**. 3. Click **Compare Configurations** to see differences. 4. Click **Sync Now** to update FortiManager with the latest settings. #### **Automatic Synchronization Process** 1. Open **FortiManager GUI**. 2. Go to **System Settings → Auto Sync Settings**. 3. Enable **Automatic Sync**. 4. Set the **synchronization interval** (e.g., every 30 minutes). 5. Click **Save**. **Expected Outcome:** - FortiManager will **automatically check for configuration changes** and update its database. - This ensures that **all devices stay updated** without manual intervention. ### **3.4 Troubleshooting Configuration Errors in FortiManager** Even when following best practices, configuration issues can occur. Below are **common errors** and how to fix them. #### **Common Configuration Issues and Fixes** | **Issue** | **Possible Cause** | **Solution** | | --- | --- | --- | | **Policy package not installing on FortiGate** | FortiGate is out of sync with FortiManager | Perform a **manual sync** before pushing policies | | **Device appears "Disconnected" in FortiManager** | Network issue or FortiGate management IP has changed | Check connectivity and verify **correct IP address** | | **Configuration rollback failed** | The rollback version is corrupted or incomplete | Try a **different backup version** | | **Policy conflict error** | Duplicate firewall rules exist | Review and resolve **conflicting policies** | | **Auto-sync is not working** | Incorrect synchronization settings | Verify that **auto-sync is enabled** and check logs | #### **How to Troubleshoot Configuration Issues in FortiManager** ##### **Step 1: Check the Configuration Status** 1. Log in to **FortiManager GUI**. 2. Navigate to **Device Manager**. 3. Look for **warning icons** next to devices. 4. Click **Sync Status** to see the **latest updates**. ##### **Step 2: View FortiGate Configuration Differences** 1. Select the FortiGate device. 2. Click **Compare Configurations**. 3. Review differences **between FortiManager and FortiGate**. 4. Click **Apply Sync** to update. ##### **Step 3: Debug Policy Package Installation** If a policy package fails to install, check logs: 1. Open **FortiManager CLI** and run: ```bash diagnose debug application install -1 ``` 2. Check FortiGate logs for errors: ```bash diagnose debug console timestamp enable diagnose debug application fgfmsd -1 ``` 3. If you see an error, resolve the **conflicting rule** before retrying the installation. ### **3.5 Rollback Strategies for Configuration Changes** If a configuration change **causes problems**, FortiManager allows you to **rollback** to a previous version. #### **How to Rollback a Configuration Change** 1. **Log in** to FortiManager. 2. Go to **Device Manager**. 3. Select the FortiGate device. 4. Click **Revisions** → **View Configuration History**. 5. Select a **previous working configuration**. 6. Click **Restore**. 7. Click **Install** to apply the rollback. **Expected Outcome:** - The **previous configuration** is restored, undoing unwanted changes. - This is useful when a **new update causes network disruptions**. #### **Automating Configuration Backups** FortiManager can **automatically create backups** before making changes. ##### **Enable Auto-Backup** 1. Open **System Settings**. 2. Go to **Backup Settings**. 3. Enable **Auto-Backup before every change**. 4. Set the **backup retention period** (e.g., keep last 10 versions). 5. Click **Save**. **Why is this important?** - If an error occurs, you can **restore the last working configuration**. - Prevents **accidental misconfigurations** from disrupting the network. ### **3.6 Best Practices for FortiManager Configuration Management** Following best practices **reduces errors** and **improves efficiency**. #### **1. Always Test Configurations Before Deployment** - Use **Preview Changes** before installing policies. - Avoid pushing changes **during business hours**. #### **2. Use Policy Packages to Standardize Configurations** - Create **different policy packages** for different locations. - Example: - **Branch Office Policy Package** → For remote sites. - **Data Center Policy Package** → For high-security environments. #### **3. Enable Automatic Synchronization** - Prevents **manual sync errors**. - Ensures **FortiManager always has the latest configurations**. #### **4. Implement Role-Based Access Control (RBAC)** - **Limit access** to configuration changes. - Example: - **Junior Admins** → Read-only access. - **Senior Engineers** → Can modify configurations. #### **5. Regularly Audit Firewall Rules** - Over time, **unused rules accumulate**. - Run: ```bash diagnose firewall rule list ``` - Remove **unused firewall policies** to improve performance. ### **3.7 Hands-on Lab: Full Configuration Management Workflow** #### **Scenario: Configure and Deploy a Policy Package** You are an administrator responsible for managing **20 FortiGate devices** using FortiManager. You need to: 1. Create a **policy package**. 2. Apply it to multiple devices. 3. Ensure all devices stay **synchronized**. #### **Step 1: Create a New Policy Package** 1. Open **FortiManager**. 2. Navigate to **Policy & Objects**. 3. Click **Create New → Policy Package**. 4. Name it **"Branch_Office_Policy"**. #### **Step 2: Define Firewall Rules** 1. Click **Add New Policy**. 2. Configure: - **Source: Internal_Network** - **Destination: Internet** - **Service: Allow HTTPS, SSH** - **Security Profile: Enable Antivirus, Web Filtering** 3. Click **Save**. #### **Step 3: Assign to Multiple FortiGate Devices** 1. Go to **Device Manager**. 2. Select **all branch office devices**. 3. Click **Assign Policy Package**. 4. Choose **Branch_Office_Policy**. #### **Step 4: Deploy the Policy Package** 1. Click **Install Wizard**. 2. Select the target devices. 3. Click **Preview Changes** to verify settings. 4. Click **Install** to apply. #### **Step 5: Verify Configuration Sync** 1. Open **Device Manager**. 2. Check **Sync Status** (should be green). 3. Run CLI command: ```bash diagnose sys cmdb status ``` 4. If "Out of Sync," manually **trigger a sync**. **Expected Outcome:** - The new security policies are **applied to all branch offices**. - FortiManager keeps all devices **updated and synchronized**. --- # Policy and Objects ### **4.1 Firewall Policies** #### **What Are Firewall Policies?** Firewall policies are **rules that control network traffic** between different segments. They define **who can communicate with whom**, what type of traffic is allowed, and whether security inspections should be applied. #### **How Are Firewall Policies Processed?** - Firewall policies are **processed from top to bottom**. - The **first matching rule** determines whether the traffic is **allowed or denied**. - If no rule matches the traffic, the **default implicit deny rule** blocks it. **Example:** If we have the following rules: 1. **Allow** traffic from `192.168.1.0/24` to the Internet. 2. **Deny** traffic from `192.168.2.0/24` to the Internet. Traffic from **192.168.1.0/24** is allowed, but traffic from **192.168.2.0/24** is denied. #### **Basic Firewall Rule Components** | **Component** | **Description** | | --- | --- | | **Source & Destination** | Defines where the traffic comes from and where it goes. | | **Services** | Specifies allowed protocols (e.g., HTTP, SSH, or custom services). | | **Action** | Choose between **Allow** or **Deny**. | | **Logging** | Enables logging for traffic monitoring and auditing. | | **Security Profiles** | Attach web filtering, antivirus, IPS, etc., for deeper inspection. | **Example Firewall Policy:** A rule that allows all employees to access the Internet **except for certain restricted websites**. | **Source** | **Destination** | **Service** | **Action** | **Security Profile** | | --- | --- | --- | --- | --- | | `Employees` | `Internet` | `HTTP, HTTPS` | `Allow` | `Web Filtering - Block Social Media` | #### **Hands-on Lab: Creating a Firewall Policy in FortiManager** ##### **Step 1: Create a New Policy** 1. **Log in** to FortiManager. 2. Go to **Policy & Objects**. 3. Click **Create New → Firewall Policy**. ##### **Step 2: Define Rule Settings** 1. **Set Source**: - Click **Add** → Select **"Employees_Network"**. 2. **Set Destination**: - Click **Add** → Select **"Internet"**. 3. **Choose Allowed Services**: - Select **"HTTP, HTTPS, DNS"**. 4. **Set Action**: - Choose **"Allow"**. ##### **Step 3: Attach Security Profiles** 1. Enable **Web Filtering**. 2. Choose **Block Social Media and Streaming**. 3. Click **Save**. ##### **Step 4: Apply the Policy to a FortiGate Device** 1. Navigate to **Device Manager**. 2. Select the **FortiGate firewall**. 3. Click **Install Wizard**. 4. Choose the **policy package** you created. 5. Click **Install** to apply the rules. **Expected Outcome:** - Employees **can browse the Internet**, but social media and video streaming websites are **blocked**. - The **firewall logs all Internet activity** for security auditing. ### **4.2 Address and Object Management** Firewall rules use **objects** instead of hardcoded IP addresses. This makes policies **easier to manage and scale**. #### **Types of Objects in FortiManager** | **Object Type** | **Description** | | --- | --- | | **Address Objects** | Define single IPs, ranges, or subnets. | | **Service Objects** | Represent TCP/UDP port numbers. | | **Time Schedules** | Apply policies based on time constraints. | | **User/Group Objects** | Assign rules based on user identity. | **Why Use Objects Instead of IP Addresses?** - If a server **changes IP**, you **only update the object**, not every policy. - Makes firewall rules **easier to understand and manage**. #### **1. Address Objects** Define **IP addresses, subnets, or FQDNs (fully qualified domain names)**. **Example:** | **Object Name** | **Type** | **IP Address/Subnet** | | --- | --- | --- | | `HR_Network` | Subnet | `192.168.10.0/24` | | `Finance_Server` | Host | `10.10.10.5` | #### **2. Service Objects** Define **protocols and port numbers** used in firewall policies. **Example:** | **Service Name** | **Protocol** | **Port(s)** | | --- | --- | --- | | `Web_Traffic` | TCP | `80, 443` | | `SSH_Access` | TCP | `22` | | `Custom_App` | UDP | `5000-5100` | #### **3. Time Schedules** Firewall rules **can be restricted to specific time periods**. **Example:** | **Schedule Name** | **Time Window** | | --- | --- | | `Work_Hours` | Mon-Fri 9:00 AM - 6:00 PM | | `Night_Access` | Daily 10:00 PM - 6:00 AM | #### **4. User/Group Objects** - Apply policies based on **user authentication** instead of IP addresses. - Works with **LDAP, RADIUS, or local user groups**. **Example:** | **User Group** | **Allowed Access** | | --- | --- | | `HR_Department` | Internal Network, HR Apps | | `Developers` | Internet, GitHub, Dev Servers | #### **Hands-on Lab: Creating Address and Object Management in FortiManager** ##### **Step 1: Create an Address Object** 1. **Log in** to FortiManager. 2. Navigate to **Policy & Objects → Addresses**. 3. Click **Create New → Address Object**. 4. Enter: - **Name**: `HR_Network` - **Type**: `Subnet` - **Subnet**: `192.168.10.0/24` 5. Click **OK**. ##### **Step 2: Create a Service Object** 1. Navigate to **Policy & Objects → Services**. 2. Click **Create New → Service Object**. 3. Enter: - **Name**: `Custom_Web_Service` - **Protocol**: TCP - **Port Range**: `8080-8090` 4. Click **OK**. ##### **Step 3: Apply Objects in a Firewall Rule** 1. Navigate to **Policy & Objects → Firewall Policy**. 2. Select an **existing policy** or create a new one. 3. In **Source**, select `HR_Network`. 4. In **Destination**, select `Internet`. 5. In **Service**, select `Custom_Web_Service`. 6. Click **Save**. ##### **Step 4: Install the Configuration** 1. Go to **Device Manager**. 2. Select the **FortiGate firewall**. 3. Click **Install Wizard**. 4. Select the **policy package**. 5. Click **Install**. **Expected Outcome:** - Only HR department devices can access `Internet` using ports `8080-8090`. - If the HR network changes, **only the object needs updating**, not every rule. ### **4.3 Advanced Firewall Policy Configurations** Basic firewall rules are simple, but in **complex networks**, additional settings may be needed. Below are some **advanced configurations** used in FortiManager. #### **1. Deep Packet Inspection (DPI)** - **By default, firewalls filter traffic based on IP addresses and ports.** - **DPI allows FortiGate to inspect the actual content of packets**, preventing **malware, exploits, and suspicious activities**. **Example:** A company wants to allow **HTTPS traffic**, but they need to **block downloads of EXE files** from the Internet. **Solution:** 1. Enable **DPI** in **SSL/SSH Inspection Settings**. 2. Create a **Web Filter Profile** to **block EXE downloads**. 3. Apply the **Web Filter Profile** to the **firewall policy**. #### **2. Application Control Policies** - **Instead of filtering traffic by IP and ports, Application Control allows blocking or allowing specific applications.** - Useful for **blocking social media, gaming, or VPN applications**. **Example:** A company wants to allow **Internet access** but **block social media apps like Facebook, Instagram, and Twitter**. **Solution:** 1. Create an **Application Control Profile**. 2. In the profile, **block** applications under **Social Media category**. 3. Attach this profile to the **Internet access firewall policy**. #### **3. Traffic Shaping (QoS - Quality of Service)** - **Traffic shaping prioritizes important applications and limits bandwidth for less important traffic**. - **Ensures business-critical apps (VoIP, CRM, VPN) get priority over video streaming or downloads**. **Example:** A company wants to **prioritize VoIP calls and limit YouTube streaming bandwidth**. **Solution:** 1. Enable **Traffic Shaping**. 2. Create a **Traffic Shaping Policy**: - High priority for **VoIP** traffic (UDP 5060). - Low priority for **YouTube** (TCP 443). 3. Apply the shaping rule to the **firewall policy**. ### **4.4 Network Address Translation (NAT) Policies** #### **What is NAT?** NAT (Network Address Translation) modifies the **source or destination IP address** of packets as they pass through the firewall. **Why use NAT?** - **Hides internal IPs** from the Internet. - **Allows multiple internal devices** to share a public IP. - **Enables inbound access** to internal servers. #### **Types of NAT in FortiGate** | **NAT Type** | **Description** | **Example Use Case** | | --- | --- | --- | | **Source NAT (SNAT)** | Replaces the source IP with a public IP. | **Users accessing the Internet from inside the network.** | | **Destination NAT (DNAT)** | Maps external IP to internal server IP. | **Allowing external users to access an internal web server.** | | **Overload (PAT - Port Address Translation)** | Multiple internal users share a single public IP. | **Office network using one ISP public IP for all users.** | #### **1. Source NAT (SNAT) - Internet Access** - **Used when internal users need to access the Internet**. - **Replaces the internal IP with the firewall's public IP**. ##### **Step-by-Step: Configuring SNAT** 1. **Go to Policy & Objects → Firewall Policy**. 2. **Edit** the Internet access rule. 3. **Enable NAT** under "Outgoing Interface". 4. **Select "Use Outgoing Interface Address"**. 5. **Click Save and Install the Policy**. **Expected Outcome:** - Internal devices **can browse the Internet**, but their real IPs are hidden. - External websites will see the **firewall’s public IP** instead. #### **2. Destination NAT (DNAT) - Hosting a Web Server** - **Used when external users need access to an internal server** (e.g., Web, Mail, RDP). - **Maps a public IP to an internal private IP**. ##### **Step-by-Step: Configuring DNAT** 1. **Go to Policy & Objects → Virtual IPs (VIPs)**. 2. **Click Create New → Virtual IP**. 3. **Set the External IP (Public IP assigned by ISP)**. 4. **Set the Internal IP (Server’s Private IP)**. 5. **Create a Firewall Policy**: - **Source:** Internet. - **Destination:** VIP Object. - **Service:** HTTP, HTTPS. - **Action:** Allow. 6. **Click Save and Install the Policy**. **Expected Outcome:** - External users can **access the internal web server** using the public IP. - The firewall **forwards traffic to the internal server**. #### **3. PAT (Port Address Translation) - One Public IP for Many Users** - **PAT allows multiple internal users to share a single public IP**. - **It assigns different port numbers to each session**. ##### **Step-by-Step: Configuring PAT** 1. **Go to Policy & Objects → Firewall Policy**. 2. **Edit the Internet access policy**. 3. **Enable NAT**. 4. **Select "Use Dynamic IP Pool"**. 5. **Choose an IP Pool range assigned by the ISP**. 6. **Click Save and Install the Policy**. **Expected Outcome:** - Multiple users can **browse the Internet using a single public IP**. - **Port numbers help keep sessions separate**. ### **4.5 Troubleshooting Firewall and NAT Policies** Even with correct configurations, **firewall policies or NAT rules may fail**. Below are **common issues and solutions**. | **Issue** | **Possible Cause** | **Solution** | | --- | --- | --- | | **Firewall Policy Not Working** | Misconfigured source/destination or wrong service type | Verify the policy order, source/destination, and services used. | | **NAT Not Working** | NAT is disabled or incorrectly configured | Ensure NAT is enabled on the correct interface. | | **External Users Cannot Access an Internal Server** | VIP (DNAT) misconfigured or firewall policy missing | Verify Virtual IP settings and create a proper firewall rule. | | **Internal Users Cannot Browse the Internet** | No NAT rule applied | Enable SNAT using the outgoing interface address. | | **Traffic Logs Not Showing Expected Results** | Logging not enabled in policy | Enable logging for both accepted and denied traffic. | #### **How to Troubleshoot Using CLI** 1. **Check if firewall policy is applied:** ```bash diagnose firewall policy list ``` 2. **Check NAT table:** ```bash diagnose firewall ippool list ``` 3. **View active sessions:** ```bash diagnose sys session list ``` 4. **Test if the firewall allows outbound traffic:** ```bash execute ping 8.8.8.8 ``` --- # Global ADOM and Central Management ### **5.1 Administrative Domains (ADOMs)** #### **What Are Administrative Domains (ADOMs)?** ADOMs (Administrative Domains) **allow multiple organizations or departments to be managed independently within a single FortiManager instance**. Each ADOM contains its **own devices, policies, and settings**, preventing conflicts between different environments. #### **Why Use ADOMs?** - **Network Segmentation** – Different business units or customers can have **separate configurations**. - **Role-Based Access Control (RBAC)** – Administrators can be assigned **to specific ADOMs** without affecting other networks. - **Multi-Tenancy** – Service providers can manage **multiple customers** in a single FortiManager without mixing configurations. #### **Types of ADOMs in FortiManager** FortiManager supports two types of ADOMs: | **ADOM Type** | **Purpose** | | --- | --- | | **Global ADOM** | Used for **shared policies and objects** across multiple ADOMs. | | **Regular ADOM** | Contains specific **device groups, firewall rules, and configurations**. | **Key Difference:** - The **Global ADOM** is like a **master configuration area** that **applies standard security policies to all networks**. - **Regular ADOMs** are **separate environments** with their own **customized policies and device settings**. #### **Real-World Use Case for ADOMs** Imagine a **Managed Security Provider (MSP)** that provides firewall management for multiple customers: | **Customer** | **ADOM Used** | **Purpose** | | --- | --- | --- | | **Retail Store Chain** | Regular ADOM | Each store has unique network policies. | | **Banking Network** | Regular ADOM | Requires strict security policies different from retail. | | **Corporate HQ** | Global ADOM | Enforces standard policies across all branch offices. | Using **ADOMs**, the MSP can **keep customer configurations separate while managing them from one FortiManager**. #### **How to Enable ADOMs in FortiManager** By default, FortiManager **does not enable ADOMs**. You must **turn them on** manually. ##### **Step 1: Enable ADOMs** 1. Log in to **FortiManager GUI**. 2. Navigate to **System Settings → General Settings**. 3. Find the **Administrative Domains (ADOMs) setting**. 4. Click **Enable**. 5. Click **Apply** to save the changes. **Expected Outcome:** - The **ADOMs feature is now activated**, allowing administrators to create separate management environments. #### **How to Create an ADOM** Once ADOMs are enabled, you can create **separate ADOMs** for different environments. ##### **Step 1: Create a New ADOM** 1. Go to **System Settings → ADOMs**. 2. Click **Create New ADOM**. 3. Enter a **name** for the ADOM (e.g., "Retail_Network"). 4. Choose the **FortiOS version** of the devices to be managed in the ADOM. 5. Click **OK** to create the ADOM. **Expected Outcome:** - A **new ADOM is created**, and you can assign FortiGate devices to this ADOM. #### **How to Assign a FortiGate to an ADOM** After creating an ADOM, you need to **assign devices to it**. ##### **Step 1: Move a FortiGate to an ADOM** 1. Go to **Device Manager**. 2. Click **Import Device**. 3. Select the **FortiGate firewall** you want to add. 4. Choose the **ADOM** to assign it to. 5. Click **OK**. **Expected Outcome:** - The **FortiGate is now managed under the specified ADOM**, and its configuration is **isolated from other ADOMs**. ### **5.2 Centralized Configuration Features** One of the biggest advantages of FortiManager is its **ability to manage multiple firewalls from a central location**. Below are key features that make centralized management efficient. #### **1. Shared Policy Management Across ADOMs** - The **Global ADOM** allows security teams to **create standard policies and apply them to all ADOMs**. - Instead of configuring **each FortiGate separately**, administrators **define rules once and push them across the network**. **Example:** A company with **50 branch offices** needs to apply a **standard web filtering policy** across all locations. **Solution:** 1. **Create a global policy** in the **Global ADOM**. 2. **Assign it to all branch ADOMs**. 3. **Install the policy** to push it to all firewalls. **Expected Outcome:** - All **50 locations** now **follow the same security policy**, ensuring consistency. #### **2. Central Logging and Integration with FortiAnalyzer** - FortiManager collects logs **from all FortiGate devices** and integrates with **FortiAnalyzer for deep analysis**. - This allows security teams to **monitor threats, failed login attempts, and traffic patterns in one dashboard**. **Example:** A company wants to **track all denied traffic across all branch offices**. **Solution:** 1. Enable **logging for denied traffic** in firewall policies. 2. **Send logs to FortiAnalyzer** via FortiManager. 3. Use FortiAnalyzer to **generate security reports**. **Expected Outcome:** - The security team can now **analyze threats across all firewalls from a single interface**. #### **3. Automated Configuration Deployment for Consistency** - Instead of **manually configuring each firewall**, FortiManager can **automatically push settings** to all devices. - This ensures **standardized security policies** and **prevents configuration drift**. **Example:** A company wants to **apply the same VPN settings to all branch offices**. **Solution:** 1. Create a **VPN configuration template**. 2. Assign it to **all branch office ADOMs**. 3. **Install the configuration** to deploy settings to all firewalls. **Expected Outcome:** - VPN settings are **automatically applied** to all locations, ensuring **consistent security**. ### **5.3 Advanced ADOM Configurations** #### **1. Inheritance and Policy Overrides Between Global and Regular ADOMs** One of the **powerful features** of FortiManager is the ability to **inherit global policies** while allowing **custom modifications per ADOM**. ##### **How Inheritance Works:** - **Global ADOM policies** are shared across all **Regular ADOMs**. - Regular ADOM administrators **cannot modify global policies**, ensuring **consistent security settings**. - However, Regular ADOMs **can add additional policies** or **override local rules**. **Example:** A company enforces **strict security rules** across all branch offices but allows **specific exceptions** per location. **Solution:** 1. **Create a standard security policy** in the **Global ADOM**. 2. Apply the policy to **all branch office ADOMs**. 3. Allow local admins to **add site-specific rules** for their ADOMs. **Expected Outcome:** - **Global security rules remain enforced**, but each branch can customize **certain aspects** without violating security policies. #### **2. Policy Package Cloning for Multi-ADOM Deployments** Managing multiple ADOMs manually can be **time-consuming**. FortiManager allows **policy package cloning**, making it easy to duplicate policies **across ADOMs**. **Example:** A company has **three departments (HR, IT, Sales)**, and each requires **similar but slightly different security policies**. **Solution:** 1. Create a **master policy package** in the **Global ADOM**. 2. **Clone the policy package** into the HR, IT, and Sales ADOMs. 3. Modify department-specific rules in **each ADOM**. **Expected Outcome:** - Saves time by **reusing security policies**, while **allowing department-level adjustments**. #### **3. Inter-ADOM Policy Communication (Cross-ADOM Objects)** By default, **ADOMs are isolated**. However, FortiManager **allows certain objects (addresses, services, or policies) to be shared** across ADOMs. ##### **Steps to Enable Cross-ADOM Object Sharing:** 1. Go to **System Settings → ADOMs**. 2. Select **Global ADOM** and enable **Cross-ADOM Object Sharing**. 3. Choose which objects to share **(IP addresses, firewall policies, VPN settings, etc.)**. **Example:** A company wants all branch offices to use a **shared VPN gateway**, but each site has unique policies. **Solution:** - The **VPN configuration** is defined in **Global ADOM**. - Each branch office **inherits the VPN settings** but applies local policies. **Expected Outcome:** - **VPN settings remain uniform**, while each site **maintains its security rules**. ### **5.4 Role-Based Access Control (RBAC) for ADOMs** #### **1. Why Use RBAC?** Role-Based Access Control (RBAC) **restricts what administrators can access and modify in FortiManager**. This ensures that users **only have access to the ADOMs and features they need**. #### **2. RBAC User Roles in FortiManager** | **Role Type** | **Permissions** | **Use Case** | | --- | --- | --- | | **Super_Admin** | Full control over all ADOMs and system settings. | Used for top-level administrators. | | **Restricted_Admin** | Limited access to specific ADOMs and policies. | Used for department-specific IT teams. | | **Read-Only_Admin** | Can view configurations but cannot make changes. | Used for auditors or compliance officers. | | **API_User** | Can access the FortiManager API but not the GUI. | Used for automation and scripting. | **Example:** An organization wants to allow **branch office IT staff to manage their own FortiGates**, but they **should not modify global settings**. **Solution:** 1. Create **Restricted_Admin accounts**. 2. Assign them access **only to their ADOMs**. 3. Prevent changes to **Global ADOM policies**. **Expected Outcome:** - Branch IT staff can **manage their local settings**, while **global security policies remain protected**. ### **5.5 Troubleshooting Common ADOM Issues** Even with careful configuration, **ADOM-related issues** can occur. Below are **common problems and solutions**. #### **1. ADOMs Are Not Available in FortiManager** **Possible Causes:** - ADOMs are **disabled** in FortiManager. - User account does not have **ADOM permissions**. **Solution:** 1. Go to **System Settings → General Settings**. 2. Ensure **ADOMs are enabled**. 3. Assign the **correct ADOM permissions** to the user. #### **2. Global ADOM Policies Are Not Being Applied** **Possible Causes:** - The **Global ADOM policy package** is **not assigned to Regular ADOMs**. - The **policy installation failed**. **Solution:** 1. Go to **Policy & Objects → Policy Packages**. 2. Ensure the **policy is assigned to the correct ADOMs**. 3. Click **Install Wizard** to deploy the policy. 4. Verify the installation log for **any errors**. #### **3. ADOM Sync Status Shows "Out of Sync"** **Possible Causes:** - The **FortiGate device has local changes** that conflict with FortiManager. - The **latest configuration was not retrieved**. **Solution:** 1. Open **Device Manager**. 2. Select the affected **FortiGate device**. 3. Click **Retrieve Config** to update FortiManager with the latest settings. 4. Click **Install Wizard** to resynchronize configurations. **Expected Outcome:** - The ADOM should now **show as "In Sync"**. #### **4. Users Cannot Modify Their Assigned ADOM** **Possible Causes:** - The user role does not have **write permissions** for the ADOM. - The **ADOM is in read-only mode**. **Solution:** 1. Go to **System Settings → Admin Profiles**. 2. Select the **user role** and ensure **write permissions** are enabled. 3. Check if the **ADOM is locked by another admin**. **Expected Outcome:** - Users should now be able to **modify policies within their ADOM**. ### **5.6 Best Practices for Global ADOM and Central Management** #### **1. Use Global ADOM for Standard Security Policies** - Define **firewall rules, logging settings, and VPN configurations** once. - Apply them **across all Regular ADOMs** for consistency. #### **2. Limit ADOM Access Using RBAC** - Assign **Super_Admin** to manage **Global ADOM**. - Assign **Restricted_Admins** to manage **specific ADOMs**. - Use **Read-Only_Admins** for auditors. #### **3. Enable Cross-ADOM Object Sharing for Reusable Configurations** - Use **shared address objects** for common subnets. - Define **VPN gateways globally**, so all ADOMs can use them. #### **4. Regularly Synchronize ADOMs** - Run **Retrieve Config** weekly to **keep FortiManager up to date**. - Check the **ADOM sync status** to **prevent conflicts**. #### **5. Automate Policy Deployment** - Use **Automated Install Schedules** to deploy security updates **outside business hours**. --- # Diagnostics and Troubleshooting ### **6.1 Common FortiManager Troubleshooting Commands** FortiManager provides **various CLI commands** to diagnose system performance, network connectivity, and policy management issues. Below are some of the most frequently used troubleshooting commands. #### **1. Checking System Processes** When FortiManager **slows down or crashes**, checking system processes can help identify **high CPU or memory usage**. **Command:** ```bash diag sys top ``` **What it does:** - Displays **real-time system performance** (CPU, memory usage, and running processes). - Helps **identify processes consuming too many resources**. **Example Output:** ``` Run Time: 23 days, 14 hours PID USER PRI NI VIRT RES SHR S %CPU %MEM TIME+ COMMAND 1003 root 20 0 325m 85m 15m R 15.3 10.2 1:03.55 fmgd ``` **Solution:** - If **CPU or memory usage is high**, consider **restarting unnecessary processes** using: ```bash diag sys kill 9 ``` *(Replace `` with the process ID from `diag sys top`.)* #### **2. Testing Network Connectivity** If a FortiGate device **cannot connect to FortiManager**, use **ping and traceroute** to check connectivity. **Command to Ping a Target:** ```bash execute ping ``` **What it does:** - Tests whether **FortiManager can reach a target device (FortiGate, server, etc.)**. **Command to Trace Network Route:** ```bash execute traceroute ``` **What it does:** - Shows the **hops between FortiManager and the target**. - Helps **identify network delays or failures**. **Example Output (Traceroute to FortiGate):** ``` 1 192.168.1.1 1.234 ms 2 203.0.113.10 2.345 ms 3 10.10.10.1 3.456 ms ``` **Solution:** - If the **ping fails**, check if **firewall rules** are blocking communication. - If **traceroute stops** at a specific hop, check for **network issues between FortiManager and FortiGate**. #### **3. Viewing FortiManager Logs** FortiManager **logs system events, errors, and policy installation failures**. **Command to View Debug Logs:** ```bash diag debug application fmg -1 ``` **What it does:** - Shows detailed **FortiManager system logs**, including: - Device connectivity logs. - Policy installation logs. - License issues. **Example Output:** ``` 2024-03-04 10:15:23 fmgd: FortiGate (10.0.0.1) failed to connect - Authentication Error ``` **Solution:** - If **authentication errors appear**, check FortiGate's **system central-management settings**. ### **6.2 Troubleshooting Common Issues** Now, let’s go through **common problems and how to fix them**. #### **1. Device Connectivity Problems** When a FortiGate device **does not appear in FortiManager** or is **disconnected**, follow these steps: **Step 1: Check Firewall Rules on FortiGate** - Ensure that **FortiGate allows connections from FortiManager**. - Use the following command to verify access permissions: ```bash show system interface ``` - Ensure that **fgfm** (FortiGate-FortiManager communication) is enabled on the management interface: ```bash config system interface edit "port1" set allowaccess ping https ssh fgfm end ``` **Step 2: Verify FortiGate’s Central Management Settings** Run the following command on FortiGate to check if it is properly configured for FortiManager: ```bash show system central-management ``` **What it does:** - Displays the current **FortiManager IP and connection status**. **Example Output:** ``` config system central-management set mode normal set type fortimanager set fmg "192.168.1.100" end ``` **Solution:** - If the **FortiManager IP is incorrect**, update it using: ```bash config system central-management set fmg end ``` - If the FortiGate is **disconnected**, check **network settings and firewall rules**. #### **2. Policy Installation Failures** If a policy **fails to install** on FortiGate, follow these steps: **Step 1: Check Policy Installation Logs** Use FortiManager CLI: ```bash diag debug application install -1 ``` **What it does:** - Shows **why the policy installation failed**. **Step 2: Common Error Messages and Fixes** | **Error Message** | **Possible Cause** | **Solution** | | --- | --- | --- | | `Installation failed: Policy conflict detected` | Duplicate firewall rules exist. | Remove or modify conflicting policies. | | `FortiGate unreachable` | Network issue or device is offline. | Ensure FortiGate is online and accessible. | | `Invalid policy configuration` | Misconfigured security profiles. | Check policy objects and correct errors. | **Step 3: Fix Configuration Sync Issues** If FortiManager and FortiGate are **out of sync**, manually resync: ```bash execute refresh-device ``` **What it does:** - Forces **FortiManager to retrieve the latest configuration** from FortiGate. #### **3. License Issues** If FortiManager or FortiGate **displays a license error**, follow these steps: **Step 1: Check License Status in FortiManager** Use: ```bash diag hardware deviceinfo license ``` **What it does:** - Displays the **current license status**. **Step 2: Common License Issues and Fixes** | **Issue** | **Cause** | **Solution** | | --- | --- | --- | | `License expired` | FortiManager or FortiGate subscription expired. | Renew the license through Fortinet Support. | | `Device limit exceeded` | Too many FortiGate devices registered. | Upgrade the FortiManager license. | | `License not activated` | License file not uploaded. | Upload the license file in **System Settings → License Management**. | **Step 3: Re-apply a License** If a FortiManager license is **not recognized**, reload it: ```bash execute update-now ``` **What it does:** - Forces **FortiManager to refresh the license from Fortinet servers**. ### **6.3 Advanced Debugging Techniques** #### **1. Checking Real-Time Debug Logs** When troubleshooting **device registration, policy installation, or system errors**, real-time debug logs provide **detailed information**. 1. What command enables real-time debugging in FortiManager? Answer: ```bash diag debug enable diag debug console timestamp enable diag debug application fmg -1 ``` Explanation: 1. `diag debug enable` – Turns on debugging. 2. `diag debug console timestamp enable` – Adds timestamps to log entries. 3. `diag debug application fmg -1` – Displays FortiManager-specific logs. #### **2. Checking FortiGate and FortiManager Communication** If a FortiGate **fails to register** with FortiManager, use **diagnostic commands** to verify communication. 2. How can you check the FortiGate-FortiManager connection status? Answer: Run the following command on FortiGate: ```bash diagnose sys central-management status ``` Explanation: - Displays the **FortiManager IP, connection status, and last sync time**. #### **3. Checking Policy Package Installation Status** If a **policy installation fails**, use debug logs to identify the issue. 3. What command displays policy installation debug logs? Answer: ```bash diag debug application install -1 ``` Explanation: - Shows detailed logs related to **policy installation failures**. - Helps identify **policy conflicts, object errors, or FortiGate sync issues**. #### **4. Debugging Database and Configuration Sync Issues** If FortiManager and FortiGate **show "Out of Sync"**, you can debug configuration synchronization. 4. What command checks database synchronization in FortiManager? Answer: ```bash diagnose dvm device list ``` Explanation: - Lists all **registered devices** and their **synchronization status** with FortiManager. ### **6.4 FortiGate-FortiManager Communication Troubleshooting** #### **1. Checking if FortiGate Can Reach FortiManager** If a FortiGate **is not appearing in FortiManager**, first check if it can **reach FortiManager's IP**. 5. What CLI command tests network connectivity from FortiGate to FortiManager? Answer: ```bash execute ping ``` Explanation: - Verifies if FortiGate **can communicate with FortiManager** over the network. - If the ping fails, check **firewall rules, routes, or physical connectivity**. #### **2. Checking FortiGate’s Central Management Settings** If FortiGate **is not registered** with FortiManager, verify its **central management configuration**. 6. What command shows the FortiGate’s FortiManager settings? Answer: ```bash show system central-management ``` Explanation: - Displays **FortiManager's IP address**, **connection status**, and **synchronization mode**. #### **3. Manually Registering FortiGate with FortiManager** If FortiGate **is not automatically registering**, you can manually add it. 7. What CLI command registers a FortiGate to FortiManager? Answer: ```bash config system central-management set type fortimanager set fmg end ``` Explanation: - Manually **configures FortiGate to connect to FortiManager** using its IP address. ### **6.5 Real-World Troubleshooting Scenarios** #### **Scenario 1: FortiGate Device is "Disconnected" in FortiManager** A FortiGate that was previously **connected to FortiManager** is now showing as **"Disconnected"**. 8. What steps should be taken to troubleshoot a disconnected FortiGate device in FortiManager? Answer: 9. Check if FortiGate can reach FortiManager: ```bash execute ping ``` 10. Verify **firewall policies** allowing FortiManager communication. 11. Check **FortiGate's system central-management settings**: ```bash show system central-management ``` 12. If needed, **re-register FortiGate**: ````bash execute central-management register ``` ```` #### **Scenario 2: Policy Package Fails to Install on FortiGate** A **policy installation** in FortiManager fails with an **error message**. 9. What steps should be taken to troubleshoot a failed policy installation? Answer: 10. Check **policy package logs**: ```bash diag debug application install -1 ``` 11. Ensure the **policy is assigned to the correct ADOM**. 12. Run **Retrieve Config** to update FortiManager with FortiGate’s latest settings. 13. If "Out of Sync," force synchronization: ````bash execute refresh-device ``` ```` #### **Scenario 3: FortiManager Reports a License Issue** A security team receives a **license error message** in FortiManager. 10. How do you check FortiManager's license status? Answer: Run the following command in FortiManager CLI: ```bash diag hardware deviceinfo license ``` Explanation: - Displays **license expiration status** and **device limits**. - If expired, renew the license and upload it in **System Settings → License Management**. ### **6.6 Best Practices for Effective Troubleshooting** #### **1. Regularly Monitor System Health** - Use `diag sys top` to **monitor CPU and memory usage**. - Check **FortiManager logs** with `diag debug application fmg -1`. #### **2. Ensure Proper Network Connectivity** - Run `execute ping ` to check **connectivity from FortiGate**. - Run `execute traceroute ` to identify **network delays**. #### **3. Keep FortiManager and FortiGate in Sync** - Run `execute refresh-device` if configurations are **out of sync**. - Run `diagnose dvm device list` to check **sync status**. #### **4. Debug Policy Installation Issues** - Run `diag debug application install -1` to check **why a policy failed**. - Ensure **correct ADOM assignment** for policy deployment. #### **5. Verify Licensing Regularly** - Run `diag hardware deviceinfo license` to **check license validity**. - Ensure **FortiManager and FortiGate licenses are active**. --- # Additional Configuration ### **7.1 FortiManager High Availability (HA)** #### **What is High Availability (HA)?** High Availability (HA) in FortiManager ensures that if one FortiManager **fails**, another **takes over seamlessly**. This prevents **service interruptions** and **ensures continuous network management**. #### **Why is HA Important?** - **Prevents downtime** – Ensures **continuous availability** of FortiManager. - **Automatic failover** – If the primary FortiManager **goes down**, the secondary one **takes over automatically**. - **Redundant management** – Ensures that **policies, configurations, and logs** are **not lost**. #### **HA Modes in FortiManager** FortiManager supports **Active-Passive HA**, which includes: | **HA Mode** | **Description** | | --- | --- | | **Active-Passive** | One **primary FortiManager (active)** handles management. A **secondary FortiManager (passive)** takes over if the active unit fails. | **Key HA Features:** - Configuration **synchronization** between active and passive FortiManagers. - Automatic **failover in case of hardware failure**. - Ensures all **FortiGate devices remain managed without disruption**. #### **How to Configure FortiManager HA (Active-Passive Mode)** ##### **Step 1: Prepare FortiManager Devices** - You need **two or more FortiManager units**. - Ensure they run **the same firmware version**. - Connect both devices to the **same network segment**. ##### **Step 2: Configure the Primary (Active) FortiManager** 1. Log in to **FortiManager CLI**. 2. Enter HA configuration mode: ```bash config system ha set mode a-p set group-name FMG-HA set priority 200 set peer-ip set sync-interface port1 end ``` 3. Explanation: - `mode a-p` – Sets HA mode to **Active-Passive**. - `group-name` – Defines **HA group name**. - `priority` – Higher value means **higher priority** (Primary Unit). - `peer-ip` – IP address of the **Secondary FortiManager**. - `sync-interface` – The interface used for **configuration synchronization**. ##### **Step 3: Configure the Secondary (Passive) FortiManager** 1. Log in to **Secondary FortiManager CLI**. 2. Run the following commands: ```bash config system ha set mode a-p set group-name FMG-HA set priority 100 set peer-ip set sync-interface port1 end ``` 3. Explanation: - Lower **priority value (100)** means **this unit is the backup**. ##### **Step 4: Verify HA Status** 1. On **Primary FortiManager**, run: ```bash diagnose system ha status ``` 2. Expected Output: ``` HA Mode: Active-Passive Primary: 192.168.1.1 Secondary: 192.168.1.2 Sync Status: Synchronized ``` 3. If status shows **“Out of Sync”**, manually force synchronization: ```bash execute ha synchronize ``` ### **7.2 SNMP and Monitoring in FortiManager** #### **What is SNMP?** SNMP (Simple Network Management Protocol) allows **external monitoring tools** to collect **FortiManager health and performance data**. #### **Why Use SNMP in FortiManager?** - **Monitor system performance** (CPU, memory, storage usage). - **Receive alerts** for **policy changes, device disconnects, and errors**. - **Integrate with third-party monitoring tools** (e.g., Zabbix, PRTG, SolarWinds). #### **How to Enable SNMP on FortiManager** ##### **Step 1: Enable SNMP Agent** 1. Log in to **FortiManager GUI**. 2. Navigate to **System Settings → Network → SNMP Agent**. 3. Click **Enable SNMP Agent**. 4. Set **SNMP version** (v1, v2c, or v3). ##### **Step 2: Configure SNMP Community** 1. Click **Create New SNMP Community**. 2. Set the **Community Name** (e.g., `FMG-SNMP`). 3. Define **Allowed Hosts** (e.g., `192.168.1.100`). 4. Click **Apply**. ##### **Step 3: Configure SNMP Traps** 1. Navigate to **SNMP Traps**. 2. Enable **Critical Events** like: - **Device Disconnects** - **Policy Installation Failures** - **License Expiry Warnings** 3. Set **SNMP Trap Server** (e.g., `192.168.1.200`). 4. Click **Save**. **Expected Outcome:** - FortiManager **sends alerts** to the SNMP monitoring server. - External tools **display real-time FortiManager performance metrics**. #### **Verifying SNMP Configuration** 1. On an SNMP server, run: ```bash snmpwalk -v 2c -c FMG-SNMP ``` 2. If SNMP is working, you will see output like: ``` SNMPv2-MIB::sysName.0 = STRING: "FortiManager-HA" SNMPv2-MIB::sysUpTime.0 = Timeticks: 12345678 ``` ### **7.3 REST API and Automation** #### **What is the FortiManager API?** The FortiManager **REST API** allows administrators to **automate firewall policies, device management, and configuration changes**. #### **Why Use the API?** - **Automates repetitive tasks** (e.g., adding firewall rules). - **Integrates with third-party orchestration tools** (e.g., Ansible, Terraform). - **Reduces manual errors** when managing multiple FortiGates. #### **How to Use the FortiManager API** ##### **Step 1: Enable API Access** 1. Log in to **FortiManager GUI**. 2. Navigate to **System Settings → Admin Profiles**. 3. Create a **New API Admin** with permissions. 4. Set **API Key Authentication**. 5. Click **Save**. ##### **Step 2: Create an API Key** 1. Navigate to **System Settings → Administrators**. 2. Click **Create API Key**. 3. Copy the **API Key** for later use. #### **Example: Adding a Firewall Policy via API** Run the following `curl` command: ```bash curl -k -X POST "https:///api/v2/cmdb/firewall/policy/" \ -H "Authorization: Bearer " \ -H "Content-Type: application/json" \ -d '{ "name": "Allow_Web_Traffic", "srcintf": [{"name": "port1"}], "dstintf": [{"name": "port2"}], "srcaddr": [{"name": "all"}], "dstaddr": [{"name": "all"}], "service": [{"name": "HTTP"}, {"name": "HTTPS"}], "action": "accept" }' ``` **Expected Outcome:** - The **firewall rule is automatically created** without using the GUI. ### **7.4 Troubleshooting FortiManager HA (High Availability)** #### **1. Checking HA Status** 1. What command is used to check the current HA status in FortiManager? Answer: ```bash diagnose system ha status ``` Explanation: - Displays **HA mode, primary and secondary units, and sync status**. - Helps verify if **FortiManager units are synchronized properly**. #### **2. Forcing HA Synchronization** 2. How can you manually synchronize the secondary FortiManager with the primary? Answer: ```bash execute ha synchronize ``` Explanation: - Forces the **secondary FortiManager** to sync with the primary unit. - Useful if the **sync status shows "Out of Sync"**. #### **3. Troubleshooting HA Failover Issues** If the **secondary unit is not taking over** after a primary failure: 3. What steps should be taken if FortiManager failover is not working correctly? Answer: 1. Verify HA status: ```bash diagnose system ha status ``` 2. Check if **both devices have the correct HA configuration**: ```bash show system ha ``` 3. Ensure the **sync interface is correctly set**: ```bash diagnose netlink interface list | grep sync ``` 4. If necessary, **force a failover manually**: ```bash execute ha failover set 1 ``` 5. Reboot the primary device to test failover. ### **7.5 Troubleshooting SNMP and Monitoring** #### **1. Verifying SNMP Configuration** 4. How can you check if FortiManager’s SNMP service is running? Answer: ```bash diagnose test application snmpd 1 ``` Explanation: - Displays SNMP service **status and active connections**. - Helps verify if **SNMP is running correctly**. #### **2. Testing SNMP Connectivity** 5. What command can be used to test if an SNMP server can retrieve data from FortiManager? Answer: ```bash snmpwalk -v 2c -c ``` Explanation: - Confirms that **SNMP is properly configured and accessible**. - If SNMP is not working, check **firewall rules** allowing SNMP traffic. #### **3. Fixing SNMP Trap Issues** 6. What should you check if SNMP traps are not being received by the monitoring system? Answer: 1. Verify SNMP trap configuration: ```bash show system snmp sysinfo ``` 2. Ensure the **SNMP trap destination is correct**: ```bash show system snmp community ``` 3. Check if **SNMP traffic is being blocked by the firewall**. 4. Restart the SNMP service if needed: ````bash execute restart snmpd ``` ```` ### **7.6 FortiManager API Automation – Troubleshooting and Best Practices** #### **1. Testing API Connectivity** 7. What command can be used to test API access to FortiManager? Answer: ```bash curl -k -X GET "https:///api/v2/cmdb/system/status" \ -H "Authorization: Bearer " ``` Explanation: - Confirms that **FortiManager’s API is accessible** and returning data. - If the request fails, ensure **API access is enabled** in FortiManager. #### **2. Troubleshooting API Authentication Errors** 8. What should you check if API authentication fails with an "Unauthorized" error? Answer: 1. Verify that the **API key is correct** and has **sufficient permissions**. 2. Check that the API admin account has **REST API access enabled**. 3. Ensure that API requests are made to the correct URL format: ```bash https:///api/v2/ ``` 4. If using an API token, confirm that it has **not expired**. #### **3. Debugging API Errors in FortiManager** 9. How can you enable API debug logs in FortiManager? Answer: ```bash diagnose debug enable diagnose debug application restapi -1 ``` Explanation: - Provides detailed logs on **API requests and responses**. - Helps troubleshoot **failed API requests**. ### **7.7 Best Practices for HA, SNMP, and API Automation** #### **1. FortiManager HA Best Practices** 10. What are best practices for configuring FortiManager HA? Answer: 1. Ensure **both FortiManager devices** are running the **same firmware version**. 2. Use a **dedicated sync interface** for **fast failover**. 3. Set **different priority values** to define the primary and secondary devices. 4. Regularly **test failover** to ensure HA is working as expected. 5. Monitor **HA sync status** using: ````bash diagnose system ha status ``` ```` #### **2. SNMP Monitoring Best Practices** 11. What are best practices for SNMP configuration in FortiManager? Answer: 1. Use **SNMPv3** for better security. 2. Restrict SNMP access to **trusted IP addresses**. 3. Enable SNMP traps for **critical events** like: - Device disconnects - Policy installation failures - High CPU usage 4. Test SNMP connectivity using: ````bash snmpwalk -v 2c -c ``` ```` #### **3. API Automation Best Practices** 12. What are best practices for using the FortiManager API? Answer: 1. **Use API keys** instead of passwords for authentication. 2. Limit API access to **trusted IPs** for security. 3. Use **FortiManager logs** to monitor API activity: ```bash diagnose debug application restapi -1 ``` 4. Automate repetitive tasks like: - Firewall rule creation - Policy deployment - Device configuration backup 5. Test API requests in a **sandbox environment** before applying to production. ---

Shopping cart

Subtotal:

Examination Introduction

Learning Method

Study Plan

Exam Center