Skip to main content
cdemar
Staff
cdemar
Staff
December 22, 2021

Technical Tip: How to register a FortiGate to a FortiManager from the CLI

  • December 22, 2021
  • 0 replies
  • 48825 views
Description

This article describes how to register a FortiGate to FortiManager from the CLI.
Scope FortiGate, FortiManager.
Solution

Start by setting up the configuration on the FortiGate with the following commands:

 

config system central-management
    set type fortimanager
    set fmg <FortiManager IP>
end

 

The FortiGate will then be visible in the FortiManager in the Root ADOM under the Unauthorized Devices:

 

cdemar_0-1640184168445.png

 

cdemar_1-1640184168448.png

 

cdemar_2-1640184168450.png

 

It is now possible to authorize the unit on the FortiManager.

 

Starting from version 6.0, FortiManager will use the default admin/<blank password> to contact the FortiGate by default.

Therefore, if the FortiGate admin password is not blank, FortiManager will be unable to authorize the device, and authorization will fail.

 

Also, an error might be seen in the FortiGate CLI as below :


config system central-management
    set type fortimanager
    set serial-number "FMG-VMTMXXXXXXX"
    set fmg "ip/fqdn"
    set interface-select-method sdwan
end

(central-management) $ end
Fortimanager Serial Number is not matching
object set operator error, -651, roll back the setting
Command fail. Return code -651

 

These 2 possibilities to work around this issue:

 

  1. Forcing the addition of the FortiManager serial number in the unit central-management via a batch script on the FortiGate:

 

execute batch start
config system central-management
    set type fortimanager
    set fmg "<FortiManager IP"

end
execute batch end

 

  1. For the latest FortiGate firmware versions 7.4.3 and 7.6.0 onwards, it is possible to assign the FortiManager serial number directly without access to batch config.

    

config system central-management

    set serial-number "FMG_SN"

end

 

  1. Forcing the FortiGate to send an authorization request:                                                                                     

    execute central-mgmt register-device        <- FortiManager serial number <dummy password>.

 

Once one of the workarounds has been applied, it will be possible to authorize the FortiGate from the FortiManager GUI.

 

Alternatively, it is possible to configure the FortiManager to automatically accept registration requests from the FortiGate.

 

On the FortiManager:

 

config system admin setting
    set allow_register enable
    set register_passwd <password>

end

 

On the FortiGate:

 

config system central-management
    set type fortimanager`
    set fmg <FMG_IP>        <- FortiManager IP.
end

 

execute central-mgmt register-device          <- FortiManager serial number, password on the FortiManager.

 

Note: If the FortiManager is connected to the FortiGate over the IPsec tunnel source IP address needs to be configured under FortiGate central-management.

 

config system central-management
    set fmg-source-ip <FGT_Interface_IP>
end

 

The FortiGate will then be automatically registered on the FortiManager. If ADOM is enabled, it will be added to the root ADOM. 

 

  1. Use this command to check the connection and registration status on the FortiGate:

     

diagnose fdsm central-mgmt-status

 

From FortiManager v7.6.3, a new control feature has been introduced. It will disable new VMs from registering to FortiManager. By default, registration of new FortiGate-VMs is disabled (refer to Security enhancement to control new VM device registration to FortiManager | FortiManager 7.6.0 New ...).

 

To allow VMs to be managed by FortiManager, run the following configuration:

 

config system global

    set fgfm-allow-vm enable

end

 

Related articles:
    Terms & ConditionsAccessibility statement