Roll back changes with Fortigates in HA managed by FortiManager

Hi, maybe take a look at the FortiManager Revision History

https://docs.fortinet.com/document/fortimanager/8.0.0/administration-guide/871900/viewing-configuration-revision-history

If you modify the FortiGate directly, the behavior depends on the type of configuration being changed.

• If you modify a policy directly on the FortiGate, the change is not automatically synchronized to FortiManager.
  FortiManager detects a difference and the device becomes Out of Sync.
• If instead you modify device-level settings (such as routing, VPN, interfaces, system settings, etc.), those changes can be detected and synchronized by FortiManager through Auto-Update / device database update.

First, you need to be aware that there are two different databases in FMG: device DB and policy packages.
1. If policy package, right click on the package->Policy Revision->find the revision to go back->Revert
   (you might need to re-install that version of policy package to sync)
2. if the rest (in device DB), device dashbord->configuation and installation→ Revision History (icon)->Retrieve Config to pull from the device if you haven’t installed yet.
  or, go back to whatever you want to go back in the history.

Toshi

Access Revision History: In Device Manager → Device & Groups → Managed FortiGate, select the HA cluster and open the Summary dashboard. In the Configuration and Installation widget, click the icon beside Total Revision to view stored revisions.

Synchronizing Direct FortiGate Changes Back to FortiManage
By Default: Direct FortiGate configuration changes are not automatically synchronized into FortiManager. Devices will show as Modified.
To Sync Manually: In Device Manager, use Import Configuration or Retrieve Config to manually pull changes into FortiManager and update its database.
config system admin setting  
set auto-update enable  
end  
https://docs.fortinet.com/document/fortimanager/8.0.0/administration-guide/229356/auto-update-and-auto-retrieve