Course contents

Module 12: FortiManager TroubleshootingLesson 12.2 (2 of 3 in this module)16 of 17 in the FortiManager Administration course

Lab: manage two FortiGates from FortiManager

Add two FortiGates, import policies, build a package and a template, install, then fix four faults.

Advanced · 45 min read

Written for FortiManager 7.6 · FortiManager 7.4: not yet reviewed

Exam domain: NSE 6 FortiManager (7.6) · Troubleshooting

Before this: Installing policy packages and device settings

You'll learn to add two FortiGates, import their policies, install a shared package and a template, and fix four typical faults.

The lab

FMG1 (10.0.1.31) manages FGT1 (HQ, 10.0.1.1) and FGT2 (Branch, 10.0.2.1). All addresses are examples on a management network. Both FortiGates already have a working configuration and one policy each.

The lab devices
The lab devicesOne manager and two firewalls.LabFMG1FortiManagerFGT1first FortiGateFGT2second FortiGate

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Addresses are examples.

Try it: Build it

Work through the stages in order and check the status after each one. Do not move on until the previous stage shows what it should.

Stage 1: add and import

Stage 1: add and import
Stage 1: add and importAdd each device, then import its policy.AddFGT1 and FGT2Importexisting policyCheckdevice status

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Import before install.
  1. Set central management on both FortiGates, or discover them from FortiManager.
  2. Authorise each into the root ADOM. The connection status should be Up.
  3. Import each device's policies and objects. Review any naming conflicts.
config system central-management set type fortimanager set fmg "10.0.1.31" end

On FGT1 and FGT2. Skip this if you discover the devices from FortiManager instead.

Stage 2: one package, two devices

Stage 2: one package
Stage 2: one packageAssign the same package to both devices.Create packageAssignFGT1 and FGT2Installpreview first

On small screens, swipe sideways or focus the diagram and use the arrow keys.

One edit now applies to both.
  1. Create a package Shared-pkg and assign both devices to it.
  2. Create the address object LAN-subnet and map it to 10.0.1.0/24 on FGT1 and 10.0.2.0/24 on FGT2.
  3. Add a policy: LAN-subnet to the Internet, with logging.

Stage 3: a template, then install

Stage 3: a template
Stage 3: a templateCreate a template, assign it and install.Create templateAssign to devicesInstalland verify

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Templates hold device-level settings.
  1. Create a system template that sets DNS and NTP, and assign it to both devices.
  2. Run the Install Wizard for both devices and read the preview.
  3. Install. Both devices should return to synchronized and installed.

Four faults to find

Break each one on purpose, read the evidence and decide what is wrong before you open the answer.

Types of fault in this lab
Types of fault in this labEach fault matches a stage.Fault areasConnectionmanagement linkVersionfirmware or ADOMPolicypackage or object

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Use the troubleshooting method.
Fault 1: FGT2 shows connection Down

Check that TCP 541 is reachable between the two and that the central management address on FGT2 is 10.0.1.31. Here the FortiGate pointed at the wrong address. Correct it and the connection returns to Up.

Fault 2: install to FGT2 fails with a missing object

The mapping for LAN-subnet on FGT2 was never created. Add the mapping and run the install preview again. A missing dynamic mapping is a common cause of failed installs on a new device.

Fault 3: after install, the new policy is not on FGT1

FGT1 was not an install target of the package, or was assigned to a different package. Check the assignment and the install target, install again and check the policy list on the device.

Fault 4: FGT1 shows Out of Sync

A local change was made on FGT1. Decide who is right: retrieve the configuration to keep the local change, or install to replace it with FortiManager's version. Read the preview before choosing.

Check what you built

Predict · scenario 1

Why do you import a device's policies before installing a package?

Predict · scenario 2

One install fails on a new device with a missing object. What is the most likely cause?

Predict · scenario 3

What do you read before every install?

Further reading in Fortinet's documentation

Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.

FAQ

What do I need?
A FortiManager VM and two FortiGate VMs or hardware devices that can reach each other on a management network. Evaluation or lab licences from your Fortinet account are enough.
Can I do this without devices?
You can read it, but the faults only make sense when you see the status values change. Use a lab if you can.