You'll learn to work from connection to status to installed configuration, and use the right diagnose command at each step.
A method before commands
FortiManager faults look different but follow the same order: can the two talk, do they agree, and did the configuration arrive? Work through those and the cause usually announces itself.
Three questions in order
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Each question needs the one before it.
Four symptoms and where to look first
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Work from the bottom of the stack up: connectivity first, then status, then the installed configuration.
1. Can they talk?
Checking connectivity
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Start with the network, then the service.
Is the connection status Up? If not, check routes, firewalls and the FGFM port (TCP 541).
On the FortiGate, does get system central-management show the right type and address?
On FortiManager, does the interface the device reaches allow FGFM access?
Are both clocks correct? Certificate checks fail when time is wrong.
FMG1. Debug output can be heavy, so keep it short and turn it off. On the FortiGate the equivalent application is fgfmd. Application names can differ by release.
2. Do they agree?
What must agree
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Compare each item.
Example output · based on Fortinet documentation; exact format varies by model and FortiOS version
FMG1 # diagnose dvm device list
NAME: FGT1 ADOM: root IP: 10.0.1.1
|- STATUS: dev-db: modified; conf: out of sync; cond: pending; dm: installed; conn: up
The connection is up, but the configuration is out of sync: the FortiGate was changed locally. Decide whether to retrieve its configuration or reinstall FortiManager's.
3. Did the configuration arrive?
Did the configuration arrive
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Confirm on the device itself.
Open the install task and read the first error line.
Use the install preview to see what would be sent and whether objects or mappings are missing.
On the FortiGate, confirm the policy or setting exists with the expected name and values.
Check the package is assigned to the device and the device is an install target.
Database checks
FortiManager has CLI commands to check the integrity of its policy package database (diagnose cdb check ...). Use them when the GUI shows inconsistent packages, and read the output for your release before acting on it.
Check your understanding
Predict · scenario 1
FGT1 shows connection Down. Traffic through it is normal. What is the best first check?
Predict · scenario 2
The status shows connection up and configuration out of sync. What does it mean?
Predict · scenario 3
You enabled debug and found the cause. What next?
Further reading in Fortinet's documentation
Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.
FAQ
A device shows Down but the FortiGate works. Why?
Down means the FGFM management connection is not up. Traffic does not use it. Check reachability on TCP 541, the central management setting on the FortiGate, certificates and time.
Which side do I debug first?
Start from the status in FortiManager, then confirm the central management setting on the FortiGate, then debug FGFM on whichever side fails to connect.
Are the debug commands the same on every release?
Mostly, but application names and output differ. Use ? and the documentation for your version, and turn debug off when finished.