Managing shared and device-specific policies with FortiManager

[Vaito]

I'm planning a deployment to migrate stateless router ACLs centrally managed by Ansible to FortiGates/FortiManager. I'm experienced with FortiOS but new to FortiManager and I'm trying to solve a policy management problem. We have multiple sites and we'll have one FortiGate at each site. Each FortiGate will have about 70 rules in common, but most of the sites additionally have between five and a dozen site-specific rules.

To manage this, I'd hoped to be able to layer multiple policy packages accordingly on each FortiGate. For example:

• Rules 1-70 - Shared policy package
• Rules 71-85 - Site-specific policy package
• Implicit deny

This is trivial with Juniper's Security Director, which allows you to apply as many "group policies" to a firewall as you want and commingle them with device-specific policies. I was expecting similar functionality from FortiManager, but, as I learn the platform, I find that it doesn't really work that way, and you're not supposed to apply multiple policy packages to a single firewall. So how do I do this? I'm only aware of two options:

1. Create a separate policy package for each/most of the FortiGates. This means that when a new shared rule is created, it has to be created in every individual policy package, defeating the purpose of centralized management.
2. Create one giant policy package with all rules for all sites and overlook the fact that a bunch of the firewalls will have red-herring rules that have nothing to do with the networks they're routing. Preferable to #1, but hardly a clean solution.

Am I overlooking a feature? Does anyone have any better ideas?