Adding multiple FortiGates to FortiManager with identical objects but different subnets

Question

Hi,

We have a number of FortiGate firewalls which range from SMB 60C (being migrated to 51E) to large 1000D. We have purchased FortiManager and installed version 5.4.3 as it covers most of our firewalls firmware.

I have recently learnt FortiManager can not manages all firewalls which are on different majour and minor release versions and this can only be managed under a single ADOM - is this correct, as I would under the impression FortiManager would provide a single manage plane for all the firewalls?

Around 30% of the configuration on the FortiGates are similar i.e. VPN tunnel to a main FortiGate firewalls. However, the naming convention used to reference these objects is different and in some cases the subnets could be different using identical object naming standards.

My understanding, is if I import the first FortiGate into the FortiManager under the same ADOM it will import the policies and objects within the ADOM database. If I then import the second firewall under the same ADOM, and the objects are named identical but configured with different IP or subnet it will become an issue. This is because FortiManager will replace the object it has within its database from the first firewall import and replace the subnet with the second firewall import. If later down the line, we update the first imported firewall it will change the subnet address on the firewall causing the incorrect subnet to be replace under the object - is this correct? What would be the recommended method on importing these firewalls into FortiManager?

My plan before learning the above was to import the firewalls into FortiManager and then work with making the objects and policies consistent, however, this is going to be impossible unless I check each firewalls for its objects?

Would appreciate any thoughts and advice.

Thanks,

Sam.

emnoc · Accepted Answer

I have recently learnt FortiManager can not manages all firewalls which are on different majour and minor release versions and this can only be managed under a single ADOM - is this correct, as I would under the impression FortiManager would provide a single manage plane for all the firewalls?

Yes, you need multiple adom

Around 30% of the configuration on the FortiGates are similar i.e. VPN tunnel to a main FortiGate firewalls. However, the naming convention used to reference these objects is different and in some cases the subnets could be different using identical object naming standards. My understanding, is if I import the first FortiGate into the FortiManager under the same ADOM it will import the policies and objects within the ADOM database. If I then import the second firewall under the same ADOM, and the objects are named identical but configured with different IP or subnet it will become an issue. This is because FortiManager will replace the object it has within its database from the first firewall import and replace the subnet with the second firewall import. If later down the line, we update the first imported firewall it will change the subnet address on the firewall causing the incorrect subnet to be replace under the object - is this correct? What would be the recommended method on importing these firewalls into FortiManager?

Again, use multi-adoms to get around this or find duplicated objects and rename-them

My plan before learning the above was to import the firewalls into FortiManager and then work with making the objects and policies consistent, however, this is going to be impossible unless I check each firewalls for its objects?

Some time you have to bite bullet and do the hard-work up front to have a better solution.

I would diff and find duplicates across the multiple FGTs

if you stay or want to stay in a single-adom concept, than standardize on one fortiOSversion

drop all un-used objects

chall_FTNT · Answer

Sam.S wrote:My understanding, is if I import the first FortiGate into the FortiManager under the same ADOM it will import the policies and objects within the ADOM database. If I then import the second firewall under the same ADOM, and the objects are named identical but configured with different IP or subnet it will become an issue. This is because FortiManager will replace the object it has within its database from the first firewall import and replace the subnet with the second firewall import. If later down the line, we update the first imported firewall it will change the subnet address on the firewall causing the incorrect subnet to be replace under the object - is this correct? What would be the recommended method on importing these firewalls into FortiManager?  Many objects support dynamic mapping, including firewall address objects.  In fact, the Import Policy step should automatically enable "Per-Device Mapping" for the relevant objects for you.   (Be sure to save a copy of the Import Policy report so you have a record of the changes made.) Dynamic mapping allows you to use the same name for those objects but they can map to different IP addresses or subnets.

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded