FortiManager - How to change FMG IP on Fortigate

[okasaputra]

Hi Team,

So I plan to move Fortimanager to DRC with a different IP segment
Is there a way to push the FMG IP with the new segment to Fortigate?

I have done this command with push on FMG by script, the result of that script is success but there is no change on Fortigate:

config global
config system central-management
set fmg 10.100.100.59
end

[AEK]

Hi

If I understand well the logic, this should be done directly on FGT, this way:

config sys central

    set type none

end

Then:

config sys central

    set type fortimanager

    set fmg new-IP

end

If it doesn't work, try first unregister it from FMG.

[okasaputra]

Thanks for replying,

The problem is we have more than 200 branch with Fortigate, is there any way to do it by Fortimanager?

[Toshi_Esumi]

You can always create the script at the FMG and run it against each individual FGT. But of course, one by one.
If you want to do it in more elegant way, you can create a CLI template or a CLI template group having the template in, then assign it to individual FGT, then you can push it from Device Manager by checking all of them to push only once. But set it up for all of them would need more work than executing the script 200 times.

 The templates are more effective if similar changes happen again in the future for the same section of config. So the next time, it would be much easier. But your situation seems to be only one time and would never need to change again.

But those would be the options from FMG.

Toshi

[Toshi_Esumi]

Correction: To run the script against FGTs, you can select multiple devices then run at the same time. So that would be much faster, which I would do.
Just be aware that the FMG takes quite long time to prepare after you hit "OK" button if you select many of them. You need to be patient.

Toshi

[Toshi_Esumi]

Below is an example I ran "get sys arp" script against three devices.

[okasaputra]

I have done that method, here is the script that I tried

the result was successful, but on the Fortigate the FMG IP did not change

[Toshi_Esumi]

I don't know why but I confirmed the same behavior with our FMG. My guess is changing "central-management" config is "self destructive" so it may be prohibited to change from the managing FMG.
If nobody from FTNT in this community can't answer, you probably need to open a ticket at TAC to ask why.

Toshi

[AEK]

I also think it can't be done with FMG.

If I had many FGT I'd do it with a script (shell or python) without using FMG.

[dcoffel]

You can create a CLI Script in FMG to set 2 IP addresses.  The first would be the current FMG IP and the second would be the new IP.  Once the FMG swap is complete, the first tunnel should time out and the second IP attempted.  The doc below talks about the FGT behavior when configured with multiple IPs.  

You can also do it via the FMG "set mgmt-addr <ip>" but I did not try that method.  It is supposed to update the FGT with the additional IP without needing to do an install.  
https://docs.fortinet.com/document/fortimanager/7.4.2/administration-guide/522489/configuring-the-ma...