Configuring central management

The Central Management Fabric connector card on the root FortiGate is used to configure the FortiManager settings, which includes on-premises FortiManager, FortiGate Cloud, and FortiManager Cloud. After the Central Management connector is configured, it automatically synchronizes with any connected downstream devices.

This topic covers the following central management aspects:

• Configuring FortiManager

• Configuring FortiManager Cloud

Configuring FortiManager

Once the Central Management Fabric connector is configured, the root FortiGate pushes this configuration to downstream FortiGates. FortiManager provides remote management of FortiGate devices over TCP port 541. The FortiManager must have internet access for it to join the Security Fabric.

Once configured, the FortiGate can receive antivirus and IPS updates, and allows remote management through FortiManager or the FortiGate Cloud service. The FortiGate management option must be enabled so that the FortiGate can accept management updates to its firmware and FortiGuard services.

Adding a FortiManager device to the Security Fabric requires the following steps in FortiOS, which can be completed in the GUI or CLI:

• Specify the FortiManager IP address or domain name.

• Approve the FortiManager serial number returned by the FortiManager server certificate. This ensures that the administrator is connecting the FortiGate to the desired FortiManager.

After completing the steps in FortiOS, go to FortiManager to complete the process by authorizing the FortiGate.

To add a FortiManager to the Security Fabric in the GUI:

1. On the root FortiGate, go to Security Fabric > Fabric Connectors and double-click the Central Management card.

2. Set the Status to Enabled.

3. Set the Type to On-Premises.

   

4. Enter the IP/Domain Name of the FortiManager.

5. Click OK.

   The Verify FortiManager Serial Number pane appears.

   

6. Review the serial number, and click Accept.

   The Request Sent & Received pane appears, indicating the FortiGate must be authorized on FortiManager.

   

7. Go to FortiManager and authorize the FortiGate. See Authorizing the FortiGate in FortiManager.

8. After the FortiGate is registered, log in to FortiGate again as either read-only or read/write.

9. Go to Security Fabric > Fabric Connectors and double-click the Central Management card. The Connection Status is updated to Connected.

   

To add a FortiManager to the Security Fabric in the CLI:

1. Enter the FortiManager connection information:

   config system central-management
       set type fortimanager
       set fmg {<IP_address> | <Domain name>}
       set serial-number <FMG serial number>
   end

2. Approve the returned FortiManager serial number.

   When configuring the FortiManager connection from the CLI, no prompt is available to approve the returned FortiManager serial number. Enter the following:

   # execute central-mgmt <fmg-serial-no> <PSK>

   If you have not previously configured a model device in FortiManager and leveraged a pre-shared key for registration, you can enter any character for the PSK field in the execute central-mgmt command.

3. Go to FortiManager and authorize the FortiGate. See Authorizing the FortiGate in FortiManager.

4. If necessary on FortiGate, use the diagnose fdsm central-mgmt-status command to diagnose the connection.

   • If the connection is not yet successful because the FortiManager serial number is not verified, the following information is displayed:

     # diagnose fdsm central-mgmt-status
     Connection status: Handshake
     Registration status: Unknown
     Serial: FMGVMSTM2300xxxx

   • If the connection is up, but the FortiGate has not been authorized by FortiManager, the following information is displayed:

     # diagnose fdsm central-mgmt-status
     Connection status: Up
     Registration status: Unregistered
     Serial: FMGVMSTM2300xxxx

   • If the connection is up, and the FortiGate has been authorized, the following information is displayed:

     # diagnose fdsm central-mgmt-status
     Connection status: Up
     Registration status: Registered
     Serial: FMGVMSTM2300xxxx

Authorizing the FortiGate in FortiManager

After completing the GUI or CLI steps in FortiOS, go to FortiManager to authorize the FortiGate to complete the process.

To authorize the FortiGate in FortiManager:

1. On FortiManager, go to Device Manager and find the FortiGate in the Unauthorized Devices list.

   The unauthorized device list is located in the root ADOM, regardless of the firmware version of the root ADOM or FortiOS.

2. Select the FortiGate device or devices, and click Authorize in the toolbar.

3. In the Authorize Device pop-up, adjust the device names as needed, select the appropriate ADOM (if applicable), and click OK.

For more information about using FortiManager, see the FortiManager Administration Guide.

Configuring FortiManager Cloud

This cloud-based SaaS management service is available through FortiManager. This service is included in FortiCloud accounts with a FortiManager Cloud account level subscription (ALCI).

Configuring a per-device license

Once the FortiGate has acquired a contract named FortiManager Cloud, FortiCloud creates a cloud-based FortiManager instance under the user account. You can launch the portal for the cloud-based FortiManager from FortiCloud, and its URL starts with the User ID.

You can use a FortiGate with a contract for FortiManager Cloud to configure central management by using the FQDN of fortimanager.forticloud.com. A FortiGate-FortiManager tunnel is established between FortiGate and the FortiManager instance.

After the tunnel is established, you can execute FortiManager functions from the cloud-based FortiManager portal.

To configure FortiManager Cloud central management:

1. Enable FortiManager Cloud.

   1. Go to Security Fabric > Fabric Connectors and double-click the Central Management card.

   2. Set the Status to Enabled.

   3. Set the Type to FortiManager Cloud.

      

   4. Click OK.

      The FortiManager Cloud button can only be selected if you have a FortiManager Cloud product entitlement.

2. In the FortiManager Cloud instance, go to Device Manager and authorize the FortiGate. See Authorizing devices for more information.

   When using the FortiGate to enable FortiManager Cloud, the FortiGate appears as an unauthorized device. After authorizing the FortiGate, it becomes a managed device.

   In FortiOS, the Security Fabric > Fabric Connectors page now displays green arrow in the Central Management card because FortiManager Cloud is registered.

Diagnostics

To verify the contract information:

# diagnose test update info contract
...
System contracts:
    ...
Account contracts:
    FMGC,Thu Dec  2 16:00:00 2022
...

To verify the FortiManager Cloud instance has launched and the FortiGate is registered:

# diagnose fdsm central-mgmt-status
Connection status: Up
Registration status: Registered
Serial: FMGVMSTM2300xxxx