Course contents

Module 5: Policy and ObjectsLesson 5.2 (2 of 2 in this module)8 of 17 in the FortiManager Administration course

Objects and dynamic mapping

Shared address, service and profile objects, and dynamic mapping so one object means a different value on each FortiGate.

Advanced · 25 min read

Written for FortiManager 7.6 · FortiManager 7.4: not yet reviewed

Exam domain: NSE 6 FortiManager (7.6) · Policy and Objects

Before this: Policy packages and firewall policies

You'll learn to create shared objects, explain when dynamic mapping is needed, and map an object per device.

Technical definition

Dynamic mapping lets one object name carry a different value for each device or interface. The policy refers to the name once and FortiManager installs the right value on each FortiGate.

The same rule on firewalls with different addresses

A branch policy says allow LAN-subnet to the Internet. At HQ the LAN is 10.0.1.0/24 and at the branch it is 10.0.2.0/24. If the policy hard-coded one subnet, it would be wrong everywhere else.

Dynamic mapping: one object, a different value per device
Dynamic mapping: one object, a different value per deviceThe address object LAN-subnet maps to 10.0.1.0/24 on FGT1 and 10.0.2.0/24 on FGT2. Both use the same policy that names LAN-subnet.Object LAN-subnetused in HQ-pkg policy 1Mapped on FGT110.0.1.0/24Mapped on FGT210.0.2.0/24The policy is written once and installs correctly on both

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Use dynamic mapping when the name should be the same everywhere but the real value differs, such as an internal subnet or an interface.

Shared objects first

Objects are the building blocks policies use: addresses, address groups, services, schedules and security profiles. In an ADOM they are shared across all packages, so one change updates every policy that uses the object. That is powerful and worth reviewing before editing.

Map what differs per device

  1. Create the object once with a clear name such as LAN-subnet.
  2. Add a mapping for each device or device group, with the real value for that device.
  3. Use the object in the shared policy. FortiManager resolves it during install.
  4. Check the install preview for each device to confirm the right value appears.
Interfaces and zones
Policies refer to interface names. A normalised interface object, mapped per device, lets one policy mean "the LAN side" on devices where that port is named differently. The menu location varies by release.

Check your understanding

Predict · scenario 1

One shared policy must use each site's own LAN subnet. What do you use?

Predict · scenario 2

You edit a shared address object. What is affected?

Predict · scenario 3

An install to a new device reports a missing mapping. What is the fix?

Further reading in Fortinet's documentation

Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.

FAQ

When do I need dynamic mapping?
When a shared policy must refer to something that differs by device: the LAN subnet, the internal interface name, a VPN peer address or a local server.
What happens if a mapping is missing for a device?
The install preview or validation reports the missing mapping for that device, and the install can fail or skip the policy. Check mappings before installing to a new device.
Can interfaces be mapped too?
Yes. Policies use interface names, and FortiManager maps a normalised interface name to the real port on each device.