FortiManager adding excising firewalls

[osaleem2_10]

Hi,

I do have existing FortiGate HQ 7.4 and 7 remote branches 7.6, all configured and running.

Recently, I added FortiManager to my environment. I added all Firewalls to the Manager with two ADOMs, one for 7.4 and another for 7.6.

Now, I want to achieve centralized management for my Firewall. On each Firewall, I have almost 1,000 objects, 50 policies, SD-WAN, and VPN.

I checked with ChatGPT to determine the best option for promoting the configuration from local on each firewall to be shared for all devices within the same ADOM.

But I need to understand if that's double or there is anyone has faced the same scenario.

thanks

:keycap_1: Use “Bulk Move / Promote” in FortiManager

Instead of promoting objects one by one:

1. Go to ADOM 7.6 → Policy & Objects → Addresses / Services / VIPs

2. Click More → Bulk Move / Promote

3. Select all objects you want to centralize

   • Filter by type (Address, Service, VIP)

   • Filter by usage (used in multiple firewall packages)

4. Choose Promote to ADOM Objects

5. Map similar objects to a single ADOM object

   • FMG can detect duplicate IPs, names, or service definitions

6. FMG will automatically replace all references in each firewall package

7. Preview changes → Confirm → Apply

:white_heavy_check_mark: This replaces hundreds of objects at once safely.

[farhanahmed]

The promote thing you should use if you are using Global DB.

But you can simply Import the config for all FGTs and the objects with same config will be fine, and objects with same name but different config you can have per-device mapping but for security profiles (which do not have per-device mapping) if the profiles have same name but different config then you will have to rename the profile on the FGTs with different config.


https://docs.fortinet.com/document/fortimanager/7.6.4/administration-guide/180515/managing-objects-a...
https://docs.fortinet.com/document/fortimanager/7.6.4/administration-guide/337348/importing-policies... 

[osaleem2_10]

Thanks for your replay.

My issue is that all branches' firewall has almost the same configuration with the same value only difference is in the names of the interfaces and IPs.

Now, when I import all firewall policies and objects. The same object will be added multiple times with same name and value.

How can I tell Managet to convert object X ex which was added 8 times, to be shared object on all firewalls withinthe same ADOM and delete all duplicate objects.

Note: I do have almost 1,000 objects.

[funkylicious]

https://docs.fortinet.com/document/fortimanager/7.6.4/administration-guide/261636/find-and-merge-dup...

also, you can create a single object and add per device mapping, https://community.fortinet.com/t5/FortiManager/Technical-Tip-Per-Device-mapping-behaviour/ta-p/26486... , for example object LAN which on FGT-1 has 10.0.0.0/24 and on FGT-2 10.1.0.0/24 and use that object in a single/common firewall policy rule but on install it will be visibile with its mapped value on the FGT.

[farhanahmed]

osaleem2_10
That won't be possible I believe, because FMG distinguishes the objects based on its name. If name is different then it will be added as a separate object. And even if you promote the object to Global DB it will still be the same case because of different name.

Probably what you can do is just import all the objects and for example: a webfilter object names 'abc-filter' is used in one FGT and same config but name 'xyz-filter' is used on another FGT. After import both will be in FMG. Then you can use the 'Find and Replace' option to replace 'xyz-filter' - wherever its been used - with 'abc-filter' then delete the 'xyz-filter'.