Course contents

Module 1: FortiManager FundamentalsLesson 1.1 (1 of 2 in this module)1 of 17 in the FortiManager Administration course

What FortiManager is and how it manages FortiGates

Central management, the FGFM connection, the device database and the policy database, and where FortiManager fits next to FortiAnalyzer.

Intermediate · 20 min read

Written for FortiManager 7.6 · FortiManager 7.4: not yet reviewed

Exam domain: NSE 6 FortiManager (7.6) · Administration

You'll learn to explain what FortiManager manages, how it reaches a FortiGate, and what its databases hold.

Technical definition

FortiManager is Fortinet's central management system for FortiGates and other Fortinet devices. Configuration is prepared in FortiManager, stored in its databases and installed to the devices over the FGFM protocol.

Fifty firewalls and one change

A company opens a new payment service and every branch firewall needs the same rule. Logging in to fifty FortiGates one by one invites mistakes: a rule in the wrong place, an address typed differently. FortiManager replaces that with one change in one place, checked before it is installed everywhere.

One change on fifty devices
One change on fifty devicesWithout a manager each firewall is edited by hand. With FortiManager one edit is installed to every device.By handLog in to each deviceEasy to miss oneWith FortiManagerEdit onceInstall to all devicesvs

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Fewer manual edits mean fewer differences between devices.

What FortiManager holds

FortiManager manages many FortiGates over FGFM
FortiManager manages many FortiGates over FGFMFMG1 holds a device database, a policy and object database and a revision history. It connects to FGT1, FGT2 and FGT3 over FGFM on TCP port 541.FMG1 10.0.1.31Device databasePolicy and object databaseRevision historyFGT1HQFGT2Branch 1FGT3Branch 2FGFM · TCP 541

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The FortiGate is the one that enforces traffic. FortiManager is where configuration is prepared, stored and pushed from. A FortiGate keeps working if FortiManager is unreachable.

FortiManager keeps three things for the devices it manages. The device database holds each FortiGate's own settings, such as interfaces, routes and system options. The policy and object database holds policy packages, addresses, services and profiles that can be shared. The revision history records what was installed, so you can compare and go back.

What FortiManager holds
What FortiManager holdsIt keeps device records, policy and objects, and history.FortiManager databaseDevicesstatus and settingsPolicy and objectspackages and sharedobjectsHistoryrevisions to compareand roll back

On small screens, swipe sideways or focus the diagram and use the arrow keys.

Think of it as the source of truth.

How it reaches the FortiGate

The two sides talk over FGFM, a TLS-protected protocol on TCP port 541. The FortiGate has a central management setting that names the FortiManager. Once the FortiGate is authorised in FortiManager, FortiManager can read its configuration and install changes.

The management channel
The management channelFortiManager and each FortiGate talk over the FGFM protocol.FortiManagerpushes configFGFM channelTCP 541, encryptedFortiGateapplies and reports

On small screens, swipe sideways or focus the diagram and use the arrow keys.

The FortiGate must allow the management connection.
  • What it can manage: FortiGate firewalls and virtual domains, plus other Fortinet devices in the same Security Fabric.
  • What it adds: central policy, templates, scripts, firmware upgrades and a record of every installation.
  • What it does not do: forward traffic or enforce policy. Only the FortiGate does that.

Is it worth it?

With two or three FortiGates, direct management is often simpler. As the count grows, or when different teams need controlled access and approvals, central management pays off. The rest of this course follows one path: install FortiManager, add devices, build a package, install it and keep control of change.

When a manager pays off
When a manager pays offThe benefit grows with the number of devices and the need for consistent change.Few devicesManual changes aremanageableMany devicesConsistency and historysave timeor

On small screens, swipe sideways or focus the diagram and use the arrow keys.

A few devices may not justify the extra system.

Check your understanding

Predict · scenario 1

FortiManager becomes unreachable. What happens to traffic through the managed FortiGates?

Predict · scenario 2

Which port does FGFM use by default?

Predict · scenario 3

Which database holds shared address and service objects?

Further reading in Fortinet's documentation

Links open the named page in Fortinet's documentation (checked 19 October 2026). RouteLearn is an independent educational resource, not affiliated with or endorsed by Fortinet. Fortinet, FortiGate, FortiOS, FortiManager and FortiGuard are trademarks of Fortinet, Inc. Example output on this page is illustrative.

FAQ

Does the FortiGate stop working if FortiManager goes down?
No. The FortiGate keeps enforcing its installed configuration. You lose central changes, status and installs until FortiManager is reachable again.
Is FortiManager the same as FortiAnalyzer?
No. FortiManager manages configuration. FortiAnalyzer collects and analyses logs. They are often deployed together and can run on the same platform in some licences, but they do different jobs.
Who starts the connection?
Either side can. A FortiManager can reach a FortiGate it knows about, and a FortiGate configured with the FortiManager address connects to it. The FortiGate-initiated option helps when the device is behind NAT.