Course contents

Module 8: TemplatesLesson 8.1 (1 of 1 in this module)11 of 17 in the FortiManager Administration course

Provisioning templates and template groups

System templates, CLI templates, SD-WAN and other templates, template groups, and how they combine with the policy package.

Advanced · 25 min read

Written for FortiManager 7.6 · FortiManager 7.4: not yet reviewed

Exam domain: NSE 6 FortiManager (7.6) · Advanced Configuration

Before this: Installing policy packages and device settings

You'll learn to explain what templates configure, choose between template types, and combine templates into groups for new devices.

Technical definition

Provisioning template is a reusable block of device configuration in FortiManager, such as system settings, NTP, DNS, SD-WAN, static routes or a CLI snippet, assigned to many FortiGates and installed with them.

Fifty branches, one setup

Every new branch needs a hostname, DNS and NTP servers, an admin banner, a default route and an SD-WAN configuration. Typing them fifty times invites variation. Templates capture the common parts and let each device supply only what is different.

Templates and policy packages configure different things
Templates and policy packages configure different thingsA policy package carries firewall policies and objects. Provisioning templates carry device settings such as system, NTP, DNS, SD-WAN and static routes. Both install to the same FortiGate.Policy packageFirewall policiesObjects, security profilesProvisioning templatesSystem, NTP, DNSSD-WAN, routes, CLIFortiGate FGT2one install, both applied

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The package decides what is allowed. Templates decide how the device itself is set up. Template groups bundle several templates.

Template types you will meet

  • System templates for general settings such as DNS, NTP and administration options.
  • CLI templates for any FortiOS CLI you want to apply, for settings that have no dedicated template.
  • SD-WAN, static route and similar templates for networking features that repeat across branches.
  • Template groups that bundle several templates so one assignment applies the lot to a new device.

Available template types depend on the release and the licence, so check the Device Manager provisioning menu on your FortiManager.

Metadata variables
Templates can contain variables whose value is set per device, such as a site name or a management address. The editor shows the variable syntax for your release. Set the values before installing, or the install preview will show them missing.

A sensible rollout

One template group, many branches
One template group, many branchesA template group such as Branch-standard bundles system, CLI and SD-WAN templates. It is assigned to each branch FortiGate. Each device supplies its own variable values such as site name and management address. FortiManager previews the install, then pushes it.Template groupBranch-standardSystem templateCLI templateSD-WAN templateFGT-B1assignedvariablesite=PuneFGT-B2assignedvariablesite=DelhiFGT-B3assignedvariablesite=ChennaiRollout: test on one lab device, build the group, set values, preview the install, install, then check status and a real flow

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Build and test on one lab device first. Set the per-device values before installing, or the preview will show them missing.
  1. Build and test templates on one lab device.
  2. Combine them into a template group named for the role, such as Branch-standard.
  3. Assign the group to each branch, set the per-device variable values and preview the install.
  4. Install, then check the device status and a real flow.

Check your understanding

Predict · scenario 1

You want every branch to have the same NTP and DNS settings, tracked by FortiManager. What fits best?

Predict · scenario 2

What gives each device its own site name in a shared template?

Predict · scenario 3

What bundles several templates for a new branch?

Further reading in Fortinet's documentation

Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.

FAQ

Templates or scripts?
Templates are assigned and tracked: FortiManager knows which devices use which template and reapplies it. Scripts are run once as an action. Use templates for settings that should stay consistent.
Where do per-device values come from?
Metadata variables. A template contains a variable, and each device supplies its own value, such as a hostname or a management address.
Do templates replace policy packages?
No. Packages carry firewall policy and objects. Templates carry device settings. A new branch usually needs both.