Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
okasaputra
New Contributor II

FortiManager - How to change FMG IP on Fortigate

Hi Team,

 

So I plan to move Fortimanager to DRC with a different IP segment
Is there a way to push the FMG IP with the new segment to Fortigate?


I have done this command with push on FMG by script, the result of that script is success but there is no change on Fortigate:

config global
config system central-management
set fmg 10.100.100.59
end

 

9 REPLIES 9
AEK
SuperUser
SuperUser

Hi

If I understand well the logic, this should be done directly on FGT, this way:

config sys central

    set type none

end

 

Then:

config sys central

    set type fortimanager

    set fmg new-IP

end

 

If it doesn't work, try first unregister it from FMG.

AEK
AEK
okasaputra
New Contributor II

Thanks for replying,

The problem is we have more than 200 branch with Fortigate, is there any way to do it by Fortimanager?

Toshi_Esumi

You can always create the script at the FMG and run it against each individual FGT. But of course, one by one.
If you want to do it in more elegant way, you can create a CLI template or a CLI template group having the template in, then assign it to individual FGT, then you can push it from Device Manager by checking all of them to push only once. But set it up for all of them would need more work than executing the script 200 times.

 The templates are more effective if similar changes happen again in the future for the same section of config. So the next time, it would be much easier. But your situation seems to be only one time and would never need to change again.


But those would be the options from FMG.

 

Toshi

Toshi_Esumi

Correction: To run the script against FGTs, you can select multiple devices then run at the same time. So that would be much faster, which I would do.
Just be aware that the FMG takes quite long time to prepare after you hit "OK" button if you select many of them. You need to be patient.

 

Toshi

Toshi_Esumi

Below is an example I ran "get sys arp" script against three devices.
script.png

okasaputra

I have done that method, here is the script that I tried

test script.png

the result was successful, but on the Fortigate the FMG IP did not change

test1.png

Toshi_Esumi

I don't know why but I confirmed the same behavior with our FMG. My guess is changing "central-management" config is "self destructive" so it may be prohibited to change from the managing FMG.
If nobody from FTNT in this community can't answer, you probably need to open a ticket at TAC to ask why.

 

Toshi

AEK

I also think it can't be done with FMG.

If I had many FGT I'd do it with a script (shell or python) without using FMG.

AEK
AEK
dcoffel
Staff
Staff

You can create a CLI Script in FMG to set 2 IP addresses.  The first would be the current FMG IP and the second would be the new IP.  Once the FMG swap is complete, the first tunnel should time out and the second IP attempted.  The doc below talks about the FGT behavior when configured with multiple IPs.  

 

You can also do it via the FMG "set mgmt-addr <ip>" but I did not try that method.  It is supposed to update the FGT with the additional IP without needing to do an install.  
https://docs.fortinet.com/document/fortimanager/7.4.2/administration-guide/522489/configuring-the-ma...

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors