FortiManager adding excising firewalls

Question

Hi,

I do have existing FortiGate HQ 7.4 and 7 remote branches 7.6, all configured and running.

Recently, I added FortiManager to my environment. I added all Firewalls to the Manager with two ADOMs, one for 7.4 and another for 7.6.

Now, I want to achieve centralized management for my Firewall. On each Firewall, I have almost 1,000 objects, 50 policies, SD-WAN, and VPN.

I checked with ChatGPT to determine the best option for promoting the configuration from local on each firewall to be shared for all devices within the same ADOM.

But I need to understand if that's double or there is anyone has faced the same scenario.

thanks

:keycap_1: Use “Bulk Move / Promote” in FortiManager

Instead of promoting objects one by one:

Go to ADOM 7.6 → Policy & Objects → Addresses / Services / VIPs
Click More → Bulk Move / Promote
Select all objects you want to centralize
- Filter by type (Address, Service, VIP)
- Filter by usage (used in multiple firewall packages)
Choose Promote to ADOM Objects
Map similar objects to a single ADOM object
- FMG can detect duplicate IPs, names, or service definitions
FMG will automatically replace all references in each firewall package
Preview changes → Confirm → Apply

:white_heavy_check_mark: This replaces hundreds of objects at once safely.

funkylicious · Accepted Answer

https://docs.fortinet.com/document/fortimanager/7.6.4/administration-guide/261636/find-and-merge-duplicate-objects

also, you can create a single object and add per device mapping, https://community.fortinet.com/t5/FortiManager/Technical-Tip-Per-Device-mapping-behaviour/ta-p/264862 , for example object LAN which on FGT-1 has 10.0.0.0/24 and on FGT-2 10.1.0.0/24 and use that object in a single/common firewall policy rule but on install it will be visibile with its mapped value on the FGT.

farhanahmed · Answer

The promote thing you should use if you are using Global DB.

But you can simply Import the config for all FGTs and the objects with same config will be fine, and objects with same name but different config you can have per-device mapping but for security profiles (which do not have per-device mapping) if the profiles have same name but different config then you will have to rename the profile on the FGTs with different config.

https://docs.fortinet.com/document/fortimanager/7.6.4/administration-guide/180515/managing-objects-and-dynamic-objects
https://docs.fortinet.com/document/fortimanager/7.6.4/administration-guide/337348/importing-policies-and-objects

:keycap_1: Use “Bulk Move / Promote” in FortiManager

Sign up

Login with SSO

Login to the community

Login with SSO