| Description | This article describes how to remedy when the FortiGate Central Management: FortiGate Cloud connection status shows 'Not Managed.' |
| Scope | FortiGate. |
| Solution |
The connection status 'Not Managed' indicates that the FortiGate is not connected to the FortiGate Cloud management server.
Make sure that FortiGate is under the Product Lists of the FortiCloud Account. Sometimes, FortiGate can be under decommissioned units. In this case, the FortiGate should be moved back to the Product Lists:
At the FortiGate end, make sure FortiGate is logged in to the proper FortiGate Cloud account and the correct region is configured on both ends.
Even if the FortiGate Cloud status shows Activated, the Central Management status will show 'Not Managed' if there is an issue building the TCP port 541 connection to FortiGate Cloud.
Validating connection to FortiGuard rating servers with 'diagnose debug rating' can be useful to quickly verify connection to FortiGuard servers, although it does not directly test the reachability of the FortiGate Cloud management servers. diagnose debug rating
If the output shows an 'F' flag for all servers, as in the screenshot below, this likely indicates there is an issue reaching FortiGuard servers.
Validate the FortiGate connection status to FortiGuard servers.
If the error 'Unable to connect to FortiGuard servers' is displayed as above, troubleshoot further to fix the FortiGuard reachability issue. Refer to the article below for the same: Troubleshooting Tip: Unable to connect to FortiGuard servers
After fixing the FortiGuard reachability issue, validate the FortiGate Cloud management connection status. diagnose fdsm central-mgmt-status Server: manager, task=0/100, watchdog is off
Check the DNS settings and make sure that the DNS servers are not 'Unreachable':
From the Firewall CLI:
config system dns set primary 96.45.45.45 end
config system dns set primary 96.45.45.45 end
After the DNS comes up, the connection status will show 'connected.'
If the above commands do not resolve the issue and logs are still not sent to the FortiCloud, restart the FortiGate log daemon by running the command:
fnsysctl killall forticldd
Note: The 'fnsysctl' command requires Super_admin (administrator account with super_admin permission profile) access to execute. FortiGate will produce an error otherwise. The error will also be produced if the system is running in FIPS-CC mode as the command is intentionally disabled. For further information, see the following KB articles:
FortiGate central-management connections to FortiGate Cloud or FortiManager require outbound TCP port 541 needs to be allowed on the upstream device; see FortiOS v7.6.0 FortiOS Ports | Outgoing Ports.
To confirm if a TCP 541 connection between the FortiGate and FortiGate Cloud is working, run a packet capture in FortiGate while executing the following command:
fnsysctl killall fgfmd
To capture the relevant packets, run below CLI commands below or use the Packet Capture feature on the GUI.
CLI:
diagnose sniffer packet any 'port 541' 4 0 l
Or:
diagnose sniffer packet any 'port 541' 6 0 l
If the issue persists, create a Technical Support ticket with the FortiGate serial number: Fortinet Support.
For example, when running the following debug commands on the Firewall:
diagnose debug console time enable
If the output shows 'fgfm_fqdn_connect fail,' this indicates a connection issue between FortiGate and FortiGate Cloud.
2025-08-29 11:36:32 FGFMs: Timeout for sock.
If a packet sniffer shows small TCP packets receiving responses but large ones receiving no response, there may be an MTU issue on the firewall's WAN interfaces.
If an MTU issue is indicated, set a lower MTU on the device's WAN interfaces as follows.
config system interface edit <port_ID> set mtu-override enable set mtu 1460 end
When the SSL connection to the FortiGate Cloud management server succeeds, the fgfmd debug shows 'fgfm_fqdn_connect successful':
2025-09-12 09:58:21 FGFMs: client:
The packet sniffer also reflected the results:
Reprovisioning FortiGate in FortiGate Cloud.
If all the steps above are correct, reprovisioning the FortiGate in FortiGate Cloud may clear the error.
De-provision the FortiGate:
Provision the FortiGate again:
Re-enter the FortiGate Cloud credentials under Security Fabric -> Fabric connectors -> Central management.
Note: Since February 28th, 2025, free FortiGate Cloud accounts without an active subscription: Subscription types will only communicate with FortiOS devices running the latest firmware release of the locally installed version within 7 days of a new GA patch release. For example, if v7.4.X is installed, free FortiGate Cloud expects the latest version of the 7.4 release to be installed in order for the FortiGate Cloud services to be functional. For more details, see the following article: Technical Tip: Security enforcement change for FortiGates provisioned to FortiGate Cloud without act...
Related articles: Technical Tip: FortiGuard Flags and Meanings Troubleshooting Tip: Unable to connect to FortiGuard servers |
