connectivity issues between FortiGate and FortiManager

Usual suspects: TCP ports. Make sure TCP541 is allowed if there are any devices in between with ACLs.

See allowed inbound/outbound ports:

https://docs.fortinet.com...cols/969270/open-ports

Other issues: You might want to check to see if there are fragmentation issues with the connection between FGT and FGM. I've seen it cause issues in FortiGates hosted on DSL lines.

Im my case the soltion was easier. Just wanted to let you know if anyone stumbles across this.

My FGT send Logs to (and communicate with) FMG via an IPSec tunnel that is established by the onsite FGT and the HQ FGT (Where FMG is). Routing and Policies all were fine. 

Finally the packet sniffer showed me the problem: FortiAnalyzer on the FGT was simply using a completely wrong source interface (it was set to auto and detected that for whatever reason) so packets did go the right way to FMG competely but had a totally wrong source ip address due to that.

This however did not affect the rest of FortiManager communication. Rolling out device config or policy package to the FGT or retrieving a config from the FGT worked fine all the time. It only affected the FortiAnalyzer. 

Setting the FMG Source iP on cli did not help at all but once I manually set the correct source interface in the Log settings on the FGT it startet working like a charm...

Sometimes the solution is easier than you think ;)

cheers

Sebastian