Course contents

Module 9: Scripts and AutomationLesson 9.1 (1 of 1 in this module)12 of 17 in the FortiManager Administration course

Scripts and automation

CLI scripts and their run targets, the device database versus the remote FortiGate, script history and safe testing.

Advanced · 20 min read

Written for FortiManager 7.6 · FortiManager 7.4: not yet reviewed

Exam domain: NSE 6 FortiManager (7.6) · Advanced Configuration

Before this: Adding FortiGates to FortiManager

You'll learn to write a CLI script, choose the right run target, and read the script history.

The same command on many devices

Sometimes no template covers a setting, or you need a one-time change on twenty devices. A scriptis a list of FortiOS commands that FortiManager runs on the devices you choose.

Choose the run target

Where a script can run
Where a script can runA script runs against the device database, the policy package or ADOM database, or directly on the remote FortiGate.ScriptCLI commandsDevice database: staged, install laterPolicy package or ADOM database: staged, install laterRemote FortiGate CLI: applied immediately

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Running against the device database is the safe default: the change is staged in FortiManager and reaches the FortiGate when you install. Running on the remote FortiGate applies it at once.
  • Device database stages the change in FortiManager. You see it as Modified, preview it and install it with the rest.
  • Policy package or ADOM database applies to the objects and policies FortiManager holds.
  • Remote FortiGate directly runs on the device now. Use it when you need an immediate effect and accept that the change is applied at once.
config system dns set primary 198.51.100.53 set secondary 198.51.100.54 end

A small CLI script. Run it against the device database for two lab devices first, check the install preview, then install.

Test on one device first

A script that contains a typo or the wrong object name can break many devices at once. Run it on one lab or low-risk device, read the result, and keep the undo script ready before you widen the scope.

Script history

FortiManager records each run, the devices it touched and whether it succeeded. Use it to answer the question "what changed on FGT2 last Tuesday" and keep it with your change records.

Check your understanding

Predict · scenario 1

You want to review a script's effect before it reaches the FortiGate. Which target?

Predict · scenario 2

A script run directly on the remote FortiGate fails halfway. What is the risk?

Predict · scenario 3

Which is better for a setting that must stay consistent over time?

Further reading in Fortinet's documentation

Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.

FAQ

What kinds of script are there?
CLI scripts of FortiOS commands, Tcl scripts for logic and loops, and Jinja scripts in newer releases for per-device variation. Start with CLI scripts.
Is a script reversible?
Not automatically. A script against the device database is staged and visible before install. A script run directly on the FortiGate takes effect at once, so write the undo script before you run the change.
Where do I see what ran?
Script history in FortiManager lists each run with its target and result. Keep it as part of your change record.