You'll learn to create a policy package, assign it to devices, and edit policies centrally in a way that stays readable.
Technical definition
Policy package is a named set of firewall policies stored in FortiManager. It is assigned to one or more devices and installed to them.
Write the rule once
Branch firewalls usually enforce the same rules with only the addresses differing. A policy package lets you keep one rule book and use it for all of them. Everything you learned about firewall policies on the FortiGate still applies: match criteria, top-down order and the implicit deny. FortiManager adds where the rules live and who they reach.
One policy package, assigned to one or more devices
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Several devices can share a package. Each device installs the package's policies with its own interfaces and addresses, resolved through dynamic mapping.
Anatomy of a package
Anatomy of a policy package
On small screens, swipe sideways or focus the diagram and use the arrow keys.
Order matters in a package for the same reason it matters on a FortiGate: the first match decides. Put exceptions in the header and the catch-all deny in the footer.
Header policies come first and are used for rules that must apply before everything else.
Policies are the normal rules, in order, like a FortiGate policy list.
Footer policies come last, for example a final deny with logging.
Install targets are the devices the package is assigned to.
Create and assign
In Policy & Objects, create a new package in the ADOM, or import one from a device.
Add policies with names, source and destination interfaces, addresses, services and profiles.
Assign the package to the right devices (the install targets).
Use the install preview before installing for the first time.
Keep names meaningful, use sections or folders to group rules, and avoid long lists of near-duplicates. A readable package is easier to review and to troubleshoot.
Check your understanding
Predict · scenario 1
You want a corporate rule evaluated before every other rule. Where do you put it?
Predict · scenario 2
Five branch FortiGates should enforce identical rules. What is the simplest design?
Predict · scenario 3
What does an install target define?
Further reading in Fortinet's documentation
Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.
FAQ
One package for all devices, or one per device?
Share a package where the devices should enforce the same rules, such as all branch firewalls. Use separate packages where rules differ. Sharing reduces work and the chance of drift.
What are header and footer policies?
Fixed groups of policies placed before and after the others, often used for corporate rules that must run first and cleanup rules that run last.
Are policy IDs the same as on the FortiGate?
Not necessarily. FortiManager assigns its own ids in the package, and the FortiGate receives its own. Use names to talk about policies.