Stackvora.tech

Manage 50 FortiGates From One Pane With FortiManager

Consolidating the management of numerous FortiGate firewalls is a critical task for maintaining security posture, ensuring policy consistency, and…

Consolidating the management of numerous FortiGate firewalls is a critical task for maintaining security posture, ensuring policy consistency, and streamlining operational workflows. FortiManager provides a centralized platform to manage hundreds or even thousands of FortiGates, offering capabilities far beyond individual device logins. This article details the core functionalities and best practices for managing a medium-scale FortiGate deployment (approximately 50 devices) using FortiManager, focusing on administrative domains, policy management, and firmware lifecycle.

FortiManager 7.x (e.g., 7.0.x, 7.2.x) is the version referenced for all commands and features discussed. While core functionalities remain consistent across major versions, specific UI elements or CLI parameters might vary slightly in older or newer releases.

Establishing Administrative Domains (ADOMs)

ADOMs are the fundamental segmentation mechanism within FortiManager. They allow you to logically group devices and delegate administrative access, isolating configurations and policies. For 50 FortiGates, effective ADOM design is crucial.

ADOM Design Strategies

  • By Tenant: If you're an MSSP or manage distinct business units, each tenant gets its own ADOM. This ensures strict separation of policies and objects.
  • By Region/Geography: For distributed organizations, grouping devices by data center, country, or region simplifies localized policy application and troubleshooting.
  • By Function: Separate production firewalls from development/test, or internet-facing from internal segmentations.
  • By FortiGate OS Version: While FortiManager can manage different OS versions within an ADOM, separating them can simplify policy package management due to potential feature differences. This is less common for 50 devices unless there's a significant legacy component.

For our 50 FortiGates, a common approach would be a hybrid model. For instance, "ADOM_DC1_Prod", "ADOM_DC1_Dev", "ADOM_BranchOffices", etc.

Creating an ADOM and Assigning Devices

ADOMs are created under System > ADOMs. After creation, devices are assigned during the initial FortiGate registration or moved between ADOMs later.

config system adom
    edit "ADOM_BranchOffices"
        set mgmt-mode normal
        set oss-adom disable
        set default-obj-adom root
        set fortios-version 7.0
    next
end

When adding a device, specify the target ADOM:

config system csf
    edit "FG-Branch-01"
        set ip 10.10.1.1
        set adom "ADOM_BranchOffices"
        set serial "FGXXXFXXXXXXXXXX"
        set admin "admin"
        set password "your_password"
        set retrieve-config enable
    next
end

Or move an existing device via GUI: Device Manager > Device & Groups > Move Device. Select the device(s) and the target ADOM.

Centralized Policy Management with Policy Packages

Policy Packages are the cornerstone of consistent policy deployment. Instead of configuring each firewall's policy individually, you define a set of rules once and apply it to multiple devices within an ADOM.

Designing Policy Packages

For 50 FortiGates, you'll likely have a combination of global and device-specific policies:

  • Global Policy Package: Contains rules common to all devices within an ADOM (e.g., standard outbound internet access, DNS, NTP, management access).
  • Per-Device Mapping: Within a Policy Package, you can create "Install Targets." Each FortiGate will be an install target for a Policy Package.
  • Per-Device Rules: For rules unique to a single FortiGate, you can add them directly within the "Policy & Objects" section for that specific device, or, more commonly, use Policy Package variables and dynamic objects to achieve device-specific behavior within a common package.

Creating and Installing a Policy Package

Navigate to Policy & Objects > Policy Packages. Create a new package, e.g., "Branch_Standard_Policies." Add firewall policies, NAT policies, and objects within this package.

To assign to devices, go to Policy & Objects > Policy Package > [Your Policy Package] > Installation Targets and add the relevant FortiGates.

When ready to deploy:

  1. Go to Device Manager > Device & Groups > Managed Devices.
  2. Select the FortiGates you want to update.
  3. Click Install > Install Policy & Objects.
  4. Review the "Install Wizard" steps, especially the "Preview" stage. This critical step shows the exact CLI commands that will be pushed to each device, highlighting any differences. Always review the preview to avoid unintended changes.

The preview is invaluable for detecting configuration drift or errors before they impact production. Look for unexpected additions or deletions of objects/policies.

# Example: Policy package installation preview snippet (abbreviated)
# Firewall 'FG-Branch-01' (vdom 'root') will receive the following configuration:
config firewall policy
    edit 10
        set name "Outbound-Internet"
        set srcintf "port1"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set service "web" "webfilter" "dns"
        set action accept
        set schedule "always"
        set nat enable
    next
    ...
end

# Firewall 'FG-Branch-02' (vdom 'root') will receive the following configuration:
config firewall policy
    edit 10
        set name "Outbound-Internet"
        set srcintf "port1"
        set dstintf "wan1"
        set srcaddr "all"
        set dstaddr "all"
        set service "web" "webfilter" "dns"
        set action accept
        set schedule "always"
        set nat enable
    next
    ...
end

Using Policy Package Variables and Dynamic Objects

To achieve device-specific policies within a common package, use:

  • Variables: Define variables like `_interface_wan_` or `_ip_lan_`. These are assigned specific values per device in Device Manager > Devices > [Device] > CLI Configuration > Variables.
  • Dynamic Objects: Objects like "firewall.address" can have dynamic mappings to actual IP addresses based on the device's configuration, or you can use "FortiGate Interface" objects which automatically resolve to the interface IP of the target device.

Firmware Management

Managing firmware updates across 50 FortiGates individually is time-consuming and error-prone. FortiManager automates this process.

Firmware Upgrade Steps

  1. Upload Firmware: Download the desired FortiOS firmware image (e.g., 7.0.12, 7.2.5) from FortiSupport and upload it to FortiManager under System > Firmware & Device Configuration > Firmware Images. Ensure compatibility with your FortiGate models.
  2. Create a Task: Go to Device Manager > Device & Groups > Managed Devices. Select the target FortiGates.
  3. Click More > Upgrade FortiGate.
  4. Select the firmware image and schedule the upgrade. You can choose to upgrade immediately or at a specific date/time.
  5. FortiManager will handle the upload, reboot, and verification process. It monitors the upgrade status and reports success or failure.

Consider upgrading in batches or using maintenance windows. Always check the Fortinet Upgrade Path Tool to ensure direct upgrade compatibility. For example, upgrading from FortiOS 6.4.x to 7.2.x might require an intermediate upgrade to 7.0.x first.

Common Pitfalls

  • ADOM Version Mismatch: If you add a FortiGate with FortiOS 7.0 to an ADOM configured for 6.4, FortiManager will warn you. It's best to keep ADOMs consistent with the dominant OS version or create new ADOMs for significant version jumps.
  • Installation Preview Neglect: Rushing through installations without reviewing the preview can lead to unexpected policy changes, service interruptions, or even device reboots if the installation involves critical system-level changes. Always review!
  • Lost Device Connection: After pushing configuration or firmware, a FortiGate might lose connectivity to FortiManager due to misconfigured interfaces, routing, or management access policies. Ensure your FortiManager access policy (on the FortiGates) is robust.
  • Object Name Collisions: If you manually create objects on FortiGates that are also managed by a FortiManager Policy Package, you can get collisions or unexpected behavior. Strive to manage all objects centrally.
  • Insufficient FortiManager Resources: A single FortiManager VM/appliance needs adequate CPU, RAM, and disk I/O to manage 50 devices efficiently, especially during installations, logs retrieval (if FortiAnalyzer is co-located), and policy package compilation. For 50 FortiGates, a FortiManager-VM100 or FortiManager 1000E appliance is usually sufficient, but monitor resource usage.
  • VLAN & Interface Mapping: If using a common Policy Package across devices with differing interface names (e.g., "port1" vs "internal"), ensure your policy package uses "any" or FortiManager's interface mapping features under Device Manager > Interface Mapping or dynamic interface objects.

Back to the knowledge base · Ask the AI assistant