Dynamic adrress ignored

Hello Rizio, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

FortiManager doesn’t fully support dynamic addresses in policy package installations for multiple FortiGates. When you map a dynamic address to a device interface, FortiManager can ignore it because it cannot resolve the IP until runtime.

A few approaches to work around this:

Use IP Pools or VIPs instead of dynamic addresses where possible—these are fully recognized during policy installation.

Create device-specific address objects on each FortiGate and reference them in FortiManager policies rather than relying on a single dynamic object.

If dynamic addresses must be used, consider installing policies directly from the FortiGate GUI or using scripts to update the exempt lists after policy installation.

Unfortunately, there’s no native way to make FortiManager dynamically resolve guest IPs across multiple devices in a single policy package. Device-specific objects or runtime updates are the most reliable solution.