Technical Tip: How to register a FortiGate to a FortiManager from the CLI

cdemar · ‎12-22-2021

Description

This article describes how to register a FortiGate to a FortiManager from CLI.

Scope

FortiGate, FortiManager.

Solution

Start by setting up configuration on the FortiGate with the following commands:

config system central-management
set type fortimanager
set fmg <FortiManager IP>
end

The FortiGate will then be visible in the FortiManager in the Root ADOM under the Unauthorized Devices:

It is now possible to authorize the unit on the FortiManager.

From version 6.0, by default, the FortiManager will use the default admin/<blank password> to contact the FortiGate.

Therefore, if the FortiGate admin password is not blank, the FortiManager will be unable to authorize the device and authorization will fail.

These 2 possibilities to work around this issue:

Forcing the addition of the FortiManager serial number in the unit central-management via a batch script on the FortiGate:

execute batch start
config system central-management
set type fortimanager
set fmg "<FortiManager IP>
set serial-number <FortiManager Serial Number>
end
execute batch end

For the latest FortiGate firmware version 7.4.3 and 7.6.0 onwards, it is possible to assign the FortiManager serial number directly without access to batch config.

config system central-management

set serial-number "FMG_SN"

end

Forcing the FortiGate to send an authorization request:

exe central-mgmt register-device <- FortiManager serial number <dummy password>

Once one of the workarounds has been applied, it will be possible to authorize the FortiGate from the FortiManager GUI.

Alternatively, it is possible to configure the FortiManager to accept automatically registration requests from the FortiGate.

On the FortiManager:

config system admin setting
set allow_register enable
set register_passwd <password>

end

On the FortiGate:

config system central-management
set type fortimanager`
set fmg <FMG_IP> <- FortiManager IP.
end

exe central-mgmt register-device <- FortiManager serial number, password on the FortiManager.

Note: If the FortiManager is connected to the FortiGate over the IPsec tunnel source IP address needs to configure under FortiGate central-management.

config system central-management
set fmg-source-ip <FGT_Interface_IP>
end

The FortiGate will then be automatically registered on the FortiManager. If ADOM is enabled, it will be added to the root ADOM.

4. Use this command to check the connection and registration status on the FortiGate:

diag fdsm central-mgmt status

Related article:

Technical Tip: How to register a FortiGate to a FortiManager from the CLI

You are leaving our website