Course contents

Module 4: Device ManagerLesson 4.1 (1 of 2 in this module)5 of 17 in the FortiManager Administration course

Adding FortiGates to FortiManager

Discovering a FortiGate, authorising it, importing its configuration and policies, and the central-management setting on the FortiGate side.

Intermediate · 25 min read

Written for FortiManager 7.6 · FortiManager 7.4: not yet reviewed

Exam domain: NSE 6 FortiManager (7.6) · Device Manager

Before this: Administrative domains (ADOMs)

You'll learn to add a FortiGate by discovery or by registration from the device, import its configuration, and check the connection.

Take over without breaking anything

Most FortiGates already have a working configuration before FortiManager arrives. Adding one safely means reading that configuration into FortiManager first, so the first install does not replace it with an empty package.

Take over safely
Take over safelyCheck, add, import, then install.Checkreachability and versionAddthe deviceImportexisting policyInstallonly after import

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Import before install, so the existing configuration is not overwritten.
Two ways to bring a FortiGate under FortiManager
Two ways to bring a FortiGate under FortiManagerFortiManager at 10.255.9.10 can add a FortiGate by discovering it from the manager, using the device address and an administrator login. Or the FortiGate can register itself, with its central management setting pointed at FortiManager. Either way, import the existing configuration before installing anything.FortiManager10.255.9.10FGT1203.0.113.2FGT2198.51.100.2Method 1: discoverMethod 2: registerThen: import the device configuration, review it, and only then install

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Discovery needs FortiManager to reach the device. Registration works when the device can reach FortiManager, which suits branches behind NAT. The import step keeps the current policy from being overwritten.

Method 1: discover from FortiManager

In the ADOM, open Device Manager and start the Add Device wizard with Discover Device. Enter the FortiGate's IP address and administrator credentials. FortiManager connects, reads the model and firmware, and adds it. The wizard then offers to import the policies and objects.

Discover from FortiManager
Discover from FortiManagerEnter the device address and login, then add it.Add deviceaddress and loginConnectFGFM channelDevice appearsstatus unknown yetImportnext step

On small screens, swipe sideways or focus the diagram and use the arrow keys.

FortiManager connects out to the device.

Method 2: register from the FortiGate

Point the FortiGate at FortiManager and let it connect.

Register from the FortiGate
Register from the FortiGateSet the manager address on the FortiGate, then authorise it.On FortiGateset central managementRequestarrives at FortiManagerAuthorisethe deviceImportnext step

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Use it when the device is behind NAT.
config system central-management set type fortimanager set fmg "10.0.1.31" end

On FGT1. The device appears in FortiManager's list of unauthorised devices (the exact name varies by release), where you authorise it into an ADOM. Use this when FortiManager cannot reach the device.

Example output · based on Fortinet documentation; exact format varies by model and FortiOS version
FGT1 # get system central-management
mode                : normal
type                : fortimanager
allow-monitor       : enable
fmg                 : "10.0.1.31"
fmg-source-ip       : 0.0.0.0
This confirms the FortiGate knows where FortiManager is. If the device never appears in FortiManager, the fault is usually network reachability on TCP 541 or an interface that does not allow FGFM.

Import before you install

Import then install
Import then installInstalling before importing replaces the device configuration with an empty package.Install firstOverwrites what is onthe deviceImport firstExisting policy keptin a packagevs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Import brings the existing policy into FortiManager first.
  1. Run the import wizard and choose the policy package folder and objects to bring in.
  2. Review conflicts: objects with the same name and different values need a decision.
  3. Confirm the new package matches the device, then assign it to the device.

Do not install an empty package

If you assign a new, empty policy package to a device and install it, the FortiGate's own policies are replaced. Import first, then use the install preview to confirm the difference is what you expect.

Check your understanding

Predict · scenario 1

A FortiGate behind NAT cannot be reached by FortiManager. What helps?

Predict · scenario 2

Why import before installing?

Predict · scenario 3

Which command shows where a FortiGate sends FGFM?

Further reading in Fortinet's documentation

Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.

FAQ

Which way is better: discover from FortiManager or register from the FortiGate?
Discovery from FortiManager is simple when it can reach the device. Registering from the FortiGate suits devices behind NAT or firewalls, because the FortiGate starts the connection to FortiManager.
What does importing do?
It copies the FortiGate's policies and objects into a policy package and the object database, so FortiManager starts from what the device already has instead of overwriting it.
Can a FortiGate be managed by two FortiManagers?
A FortiGate has one central management target at a time for configuration. Use FortiManager HA for resilience rather than two independent managers.