Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
okasaputra
New Contributor II

FortiManager - How to change FMG IP on Fortigate

Hi Team,

 

So I plan to move Fortimanager to DRC with a different IP segment
Is there a way to push the FMG IP with the new segment to Fortigate?


I have done this command with push on FMG by script, the result of that script is success but there is no change on Fortigate:

config global
config system central-management
set fmg 10.100.100.59
end

 

8 REPLIES 8
AEK
Honored Contributor II

Hi

If I understand well the logic, this should be done directly on FGT, this way:

config sys central

    set type none

end

 

Then:

config sys central

    set type fortimanager

    set fmg new-IP

end

 

If it doesn't work, try first unregister it from FMG.

AEK
AEK
okasaputra
New Contributor II

Thanks for replying,

The problem is we have more than 200 branch with Fortigate, is there any way to do it by Fortimanager?

Toshi_Esumi
Esteemed Contributor III

You can always create the script at the FMG and run it against each individual FGT. But of course, one by one.
If you want to do it in more elegant way, you can create a CLI template or a CLI template group having the template in, then assign it to individual FGT, then you can push it from Device Manager by checking all of them to push only once. But set it up for all of them would need more work than executing the script 200 times.

 The templates are more effective if similar changes happen again in the future for the same section of config. So the next time, it would be much easier. But your situation seems to be only one time and would never need to change again.


But those would be the options from FMG.

 

Toshi

Toshi_Esumi
Esteemed Contributor III

Correction: To run the script against FGTs, you can select multiple devices then run at the same time. So that would be much faster, which I would do.
Just be aware that the FMG takes quite long time to prepare after you hit "OK" button if you select many of them. You need to be patient.

 

Toshi

Toshi_Esumi
Esteemed Contributor III

Below is an example I ran "get sys arp" script against three devices.
script.png

okasaputra

I have done that method, here is the script that I tried

test script.png

the result was successful, but on the Fortigate the FMG IP did not change

test1.png

Toshi_Esumi
Esteemed Contributor III

I don't know why but I confirmed the same behavior with our FMG. My guess is changing "central-management" config is "self destructive" so it may be prohibited to change from the managing FMG.
If nobody from FTNT in this community can't answer, you probably need to open a ticket at TAC to ask why.

 

Toshi

AEK
Honored Contributor II

I also think it can't be done with FMG.

If I had many FGT I'd do it with a script (shell or python) without using FMG.

AEK
AEK
Labels
Top Kudoed Authors