Hi Team,
So I plan to move Fortimanager to DRC with a different IP segment
Is there a way to push the FMG IP with the new segment to Fortigate?
I have done this command with push on FMG by script, the result of that script is success but there is no change on Fortigate:
config global
config system central-management
set fmg 10.100.100.59
end
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Hi
If I understand well the logic, this should be done directly on FGT, this way:
config sys central
set type none
end
Then:
config sys central
set type fortimanager
set fmg new-IP
end
If it doesn't work, try first unregister it from FMG.
Thanks for replying,
The problem is we have more than 200 branch with Fortigate, is there any way to do it by Fortimanager?
You can always create the script at the FMG and run it against each individual FGT. But of course, one by one.
If you want to do it in more elegant way, you can create a CLI template or a CLI template group having the template in, then assign it to individual FGT, then you can push it from Device Manager by checking all of them to push only once. But set it up for all of them would need more work than executing the script 200 times.
The templates are more effective if similar changes happen again in the future for the same section of config. So the next time, it would be much easier. But your situation seems to be only one time and would never need to change again.
But those would be the options from FMG.
Toshi
Correction: To run the script against FGTs, you can select multiple devices then run at the same time. So that would be much faster, which I would do.
Just be aware that the FMG takes quite long time to prepare after you hit "OK" button if you select many of them. You need to be patient.
Toshi
Below is an example I ran "get sys arp" script against three devices.
I have done that method, here is the script that I tried
the result was successful, but on the Fortigate the FMG IP did not change
I don't know why but I confirmed the same behavior with our FMG. My guess is changing "central-management" config is "self destructive" so it may be prohibited to change from the managing FMG.
If nobody from FTNT in this community can't answer, you probably need to open a ticket at TAC to ask why.
Toshi
I also think it can't be done with FMG.
If I had many FGT I'd do it with a script (shell or python) without using FMG.
You can create a CLI Script in FMG to set 2 IP addresses. The first would be the current FMG IP and the second would be the new IP. Once the FMG swap is complete, the first tunnel should time out and the second IP attempted. The doc below talks about the FGT behavior when configured with multiple IPs.
You can also do it via the FMG "set mgmt-addr <ip>" but I did not try that method. It is supposed to update the FGT with the additional IP without needing to do an install.
https://docs.fortinet.com/document/fortimanager/7.4.2/administration-guide/522489/configuring-the-ma...
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1696 | |
1091 | |
752 | |
446 | |
228 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.