Appendix C - Re-establishing the FGFM tunnel after VM license migration

When migrating a FortiManager to a new license type, the serial number associated with the FortiManager is also changed. This impacts the FGFM (FortiGate to FortiManager) tunnel that exists between FortiManager and its managed FortiGate devices.

Depending on how the FortiGate was initially added to the FortiManager (through the FortiManager or through the FortiGate), you may need to manually update the username and password of FortiGate devices in the FortiManager database before the FGFM tunnel can be re-established.

Follow the steps below to re-establish the FGFM connection with managed FortiGate devices.

• FGFM connection established through FortiManager

• FGFM connection established through FortiGate

FGFM connection established through FortiManager

If the device was added from the FortiManager using the Add Device wizard, after the migration the FortiManager will automatically have the correct device's username and password and the FGFM tunnel can be immediately re-established.

To re-stablish the FGFM tunnel:

1. In the FortiManager CLI, execute the following to bring the tunnel up:

   execute fgfm reclaim-dev-tunnel

   If the execute fgfm reclaim-dev-tunnel fails to establish a connection between the FortiManager and one or more FortiGate device, it is likely because the FGFM connection was originally established through the FortiGate for those devices. See FGFM connection established through FortiGate.

FGFM connection established through FortiGate

If the FGFM tunnel was initialized through the FortiGate, and FortiManager was used to promote (authorize) the device, the FortiManager may not have the device's administrator username and password. You can configure the credentials required for the FGFM tunnel through the FortiManager GUI, CLI, or through the FortiGate CLI. See Step 1: Configure the FGFM credentials

After updating the FGFM credentials, perform the execute fgfm reclaim-dev-tunnel command to bring the tunnel up. See Step 2: Re-establish the FGFM tunnel.

Step 1: Configure the FGFM credentials

Configure the FGFM credentials through one of the following methods:

• Configure the FGFM credentials using the FortiManager GUI

• Configure the FGFM credentials using the FortiManager CLI

• Configure the FGFM credentials using the FortiGate CLI

To configure the FGFM credentials using the FortiManager GUI:

1. Log in to the FortiManager.

2. In the GUI, go to Device Manager, select the FortiGate device in the list of managed devices, and click Edit.

3. Update the FGFM credentials by using a valid super admin account for the FortiGate.
   

4. Click OK.

5. Repeat this process for each FortiGate that needs to be updated.

To update the device's FGFM credentials in the CLI:

1. In the FortiManager CLI, enter the following commands:
   

   execute device replace user <device name> <user>
   

   execute device replace pw <device name> <password>.

2. Repeat this process for each FortiGate that needs to be updated.

To configure the device's FGFM credentials in the FortiGate CLI:

1. In the FortiGate CLI, enter the following command:
   

   execute central-mgmt register-device <FMG Serial Number> <FGT admin password>.

2. Repeat this process for each FortiGate that needs to be updated.

Step 2: Re-establish the FGFM tunnel

To re-establish the FGFM tunnel after the FGFM credentials are updated:

1. Enter the following command in the FortiManager CLI to re-establish the FGFM tunnel:
   

   execute fgfm reclaim-dev-tunnel