Technical Tip: Replacing VPN manager devices via CLI script (ADOM Database)

Prerequisites

Before executing the script, ensure the following requirements are met:

• Device presence: New FortiGate devices are added to the FortiManager Device Database.
• Interface mapping: The normalized interface (for example, wan1) used in VPN Manager is correctly mapped to the physical interface of the new devices using Per-Device Mapping.
• ADOM lock: If ADOM Workspace mode is enabled, ensure the ADOM is locked before executing scripts.

1. Identify Existing VPN Node IDs.

Before modifying the database, VPN Manager Node IDs assigned to existing Hub devices must be identified to ensure correct targeting.

Use the following command:

execute fmpolicy print-adom-object <ADOM_ID> 1005 all`

• ADOM_ID: The numerical ID of your ADOM (e.g., `3`). It is possible to find this by running 'diagnose dvm adom list'.
• 1005: This is the internal object ID for 'vpnmgr node'.

Example output:

FMG # execute fmpolicy print-adom-object 3 1005 all
...
    edit "1"
        set vpntable "VPN-TMR"
        set _scope "FWTMR-101"-"root"
    next
    edit "6"
        set vpntable "VPN-TMR"
        set _scope "FWORM-101"-"root"
    next

2. Prepare the CLI script.

After identifying the Node IDs, create a script to be executed on the ADOM Database. The script updates the device association while preserving VPN Phase1/Phase2 configuration mapped to the same Node ID.

Script content:

config vpnmgr node
    edit "1"
        set _scope "NEW-DEVICE-NAME01"-"root"
    next
    edit "6"
        set _scope "NEW-DEVICE-NAME02"-"root"
    next
end

3. Execution and verification.

• Execute script: Navigate to Device Manager -> Scripts, create the script, and ensure Run on: ADOM Database is selected.
• Interface validation: Confirm that wan1 (or the configured VPN interface) on NEW-DEVICE-NAME01 is correctly mapped under Per-Device Mapping in Normalized Interface settings.
• Install preview: In Policy & Objects, perform Install Config (Install Check) and verify that VPN Manager generates IPsec tunnels for the updated device serial numbers.

Important:

When replacing the underlying device reference for a Hub, Spoke devices associated with Node IDs (for example, 1 and 6) automatically reference the updated gateway defined in _scope.

If the public IP address has changed, ensure that local-gw or external-resource parameters are updated accordingly within the script to reflect the new Hub WAN IP.