How to Setup Fortimanager in IT for Cloud connection and second Fortimanager in DMZ to fortigates

[Leopold]

We placed a Fortimanager in IT network and a second Manager in DMZ. Configuration of Fortigates should be done via manager in DMZ. For updates we placed a  fortimanager in IT segment with ability to cloud connection. This works

What is the right way to connect the 2de fortimangers to the IT fortimanager. So we can update licenses and firmware of this fortimanager in DMZ and our fortianalyzer, fortigates in industrial network behind FW.

We use VM's.Do we need to change the serialnumbers?

What is the basic settings for Setup of multiple Managers in network.

wfg.

[Anthony_E]

Hello Leopold,

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible.

Thanks,

[Anthony_E]

Hello Leopold,

We are still looking for someone to help you.

We will come back to you ASAP.

Regards,

[Anthony_E]

@ozkanaltas Do you have an idea? :)

[ozkanaltas]

Hello @Leopold ,

If I understand correctly, you have installed two FortiManagers in your IT environment and in your DMZ network used for OT. You want to manage the FortiGates in the OT network via the FortiManager in the DMZ and also use it as an update server.

If this is the case, you can use the FortiManager in the IT network as an FDS proxy for the FortiManager located in the DMZ. To configure this, you can follow the documentation below.

https://docs.fortinet.com/document/fortimanager/7.4.3/administration-guide/581288/configure-a-fortim...

Since we generally do not want to provide internet access to the OT environment, this setup is the ideal solution for OT environments.

As you are using both devices virtually, I believe the safest way to connect these devices is to create a /30 network and establish an interface that allows them to communicate only with each other. If this is not possible, you can also establish communication through management interfaces by restricting it with firewall rules.