Technical Tip :How to capture configuration push from FortiManager on FortiGate CLI

In the below example, a firewall policy configuration is pushed from FortiManager.

To record the configuration change, run the below commands on FortiGate CLI:

diagnose debug reset
diagnose debug cli 7
diagnose debug enable

Below is the output:

To disable the debug, use the following commands:

diag debug disable

diag debug reset

Note:

This will NOT capture the TCL script push from FortiManager because the TCL script uses SSH instead of the regular FGFM tunnel to connect to the FortiGate (which is the case of config/policy/CLI Script push).