Technical Tip: How to check the FGFM tunnel IP addresses

For the FGFM tunnel, FortiManager assigns a link-local IP address.

FortiManager's FGFM tunnel IP can be checked using the command below in FortiManager CLI:

diagnose fmnetwork interface list

[OUTPUT OMITTED]
....
svr_fgfm Link encap:UNSPEC HWaddr 00-00-00-00-00-00-00-00-00-00-00-00-00-00-00-00
         inet addr:169.254.0.1 P-t-P:169.254.0.1 Mask:255.255.0.0
         inet6 addr: fe80::2e25:f181:cf8a:3a31/64 Scope:Link
         UP POINTOPOINT RUNNING NOARP MULTICAST MTU:1492 Metric:1
         RX packets:0 errors:0 dropped:0 overruns:0 frame:0
         TX packets:12 errors:0 dropped:0 overruns:0 carrier:0

Managed FortiGates FGFM IP address can be checked using the command below in FortiManager CLI:

diagnose fgfm session-list

FGT-60E(2035) sn(FGT60E4QXXXXXXXX) ip(10.119.210.19) conn:0
        state(tunnel) tunnel(169.254.0.2) uptime:Thu Feb 19 09:49:24 2026
FGVM04TMXXXXXXXX(2061) sn(FGVM04TMXXXXXXX) ip(10.128.210.178) conn:0
        state(tunnel) tunnel(169.254.0.3) uptime:Thu Feb 19 09:49:24 2026
Session count = 2 (tunnel 2)

Related documents:

Protocol operation on FortiManager

FGFM - FortiGate to FortiManager Protocol