Course contents

Module 2: Installation and ConfigurationLesson 2.1 (1 of 1 in this module)3 of 17 in the FortiManager Administration course

Installing FortiManager and first configuration

A virtual machine or appliance, the first login, the management interface, hostname, time, administrators and FortiGuard, and a safe first backup.

Intermediate · 20 min read

Written for FortiManager 7.6 · FortiManager 7.4: not yet reviewed

Exam domain: NSE 6 FortiManager (7.6) · Administration

Before this: What FortiManager is and how it manages FortiGates

You'll learn to bring a new FortiManager to a reachable, safe starting state: interface, route, hostname, time, administrators and a first backup.

A manager that is itself well managed

A FortiManager can change every firewall it manages, so its own security matters more than any single FortiGate. The first hour should leave it reachable, correctly named, on the right time and protected by named administrator accounts.

A well-managed manager
A well-managed managerIt holds every firewall configuration, so protect it.FortiManager itselfSecure accessnamed admins,trusted hostsRight timeNTP for logsand certificatesBackupsoff the system

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Secure and back it up before adding devices.
What a new FortiManager needs around it
What a new FortiManager needs around itA new FortiManager at 10.255.9.10 is set up with its own management address, a default gateway, DNS and a time source. Administrators reach it from the admin network. It backs itself up to a backup server, and it reaches Fortinet's update service for firmware and signatures. If time or DNS is wrong, certificates and updates fail in confusing ways.FortiManager10.255.9.10Admin networknamed administratorsNTP and DNS10.255.0.53, pool.ntp.orgBackup serverscheduled, testedFortinet updatesfirmware, signaturesconfig system global and config system interface set the first values.

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Treat the manager like any critical server: fixed address, correct time, named administrators and a backup that has been tested.

First CLI configuration

After deployment, sign in on the console. The management interface, default route and hostname come first. The addresses below are the course lab: FMG1 at 10.0.1.31.

First configuration
First configurationSet the interface, the route, then the system name.Interfaceaddress and maskDefault routenext hopHostnameFMG1Testping a FortiGate

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Prove reachability before adding devices.
config system global set hostname "FMG1" set timezone "Europe/London" end config system interface edit "port1" set ip 10.0.1.31 255.255.255.0 set allowaccess https ssh ping next end config system route edit 1 set gateway 10.0.1.1 set device "port1" next end

Console, configuration mode. Allow only what you need on the management interface. Time zone names and some option names vary by release, so use ? at a prompt to see the choices on yours.

Example output · based on Fortinet documentation; exact format varies by model and FortiOS version
FMG1 # get system status
Platform Type                   : FMG-VM64
Version                         : v7.6.x-buildxxxx
Hostname                        : FMG1
Admin Domain Configuration      : Disabled
HA Mode                         : Stand Alone
System Time                     : Mon Nov  2 09:30:00 2026
Check hostname, version, ADOM state and HA mode. The version and build here are placeholders; yours will show the real release.

Time, administrators and backup

Setup that is easy to forget
Setup that is easy to forgetDo these before production use.Time and NTPCorrect logs and device syncAdministratorsNamed accounts and limited rightsBackupRegular, stored elsewhere

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Each protects the system in a different way.
  • Time: set NTP so the clock follows a reliable source. Confirm it before adding any device.
  • Administrators: create named accounts with the least rights each person needs, and change or disable any default account.
  • Trusted hosts: limit which source addresses may sign in as an administrator.
  • FortiGuard: configure connection to FortiGuard so FortiManager can obtain updates and firmware information.
  • Backup: export the FortiManager configuration now and after major changes, and keep it away from the unit.

Protect the manager

Anyone who can install from FortiManager can change every managed firewall. Limit access to its GUI and SSH to a management network, use named accounts and keep backups of its configuration.

Check your understanding

Predict · scenario 1

Why is time configured before adding devices?

Predict · scenario 2

Which setting limits who can sign in as an administrator by source address?

Predict · scenario 3

What should you do before the first big change to FortiManager itself?

Further reading in Fortinet's documentation

Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.

FAQ

Should FortiManager sit on the same network as the FortiGates?
It needs a route to them, or a way for them to reach it. Put it on a management network, restrict who can reach its GUI and SSH, and allow only the management protocols it needs.
Why set the time before adding devices?
Certificates, logs and revisions all depend on correct time. A wrong clock can make connections fail validation and makes revision history hard to read.
Where do the licence and VM files come from?
From your Fortinet account. Follow the documentation for your platform and release; this lesson covers what to configure once the system boots.