Merge local Fortigate setting with fortimanager Policy package

[Dopin]

Hello, Is it possible to simply merge a retrieved configuration from a fortigate with a fortimanager policy package? I have modify setting that are not available from the GUI and I have retrieve my modification as decribed here but now, policy package status is out of sync. Now, when I' m trying to install the policy package, I can see in the preview that fortimanager drop all my local configuration. Regards

[Sean_Toomey_FTNT]

Hi Dopin, It is important to understand that there are two types of configuration. DEVICE CONFIG - interfaces, routes, VPN' s, anything on Device Manager POLICY CONFIG - policy packages, objects etc, anything under the Policy & Objects tab. For anything that is device config, you can configure FortiManager to accept those local changes automatically or on a case by case basis. In addition, if you select a firewall and on the Dashboard on the right, go to Revisions, there is a Retrieve button at the top right that will manually sync any device level config. However, policy is very intentionally meant to be pushed down only from the FMGR. If you have made changes to objects or policy on the local FortiGate, you have two options. One is to replicate those changes like-for-like in FortiManager, and the other is to re-import the policy from the FW in question and use it instead of the policy package you were using (you can delete the old one if you are not going to use it). A utility you can use if it helps - for objects mostly - is that you can take the CLI portion of that config and use the Script feature in FortiManager to run the script against your policy package. This is a good way to help you make like-for-like changes quicker in FortiManager. Because of the way Policy is designed (and it makes a lot of sense when you start thinking about different kinds of firewalls and how policies can apply to different models and such), there is no easy " Sync" button between local FortiGate and FortiManager when it comes to policy and objects. Just use some of the tools mentioned above and you should be in better shape. Cheers!

[proxymoron]

We also have the same issue, especially with Objects. We have a number of firewalls which have a different configuration that what it is there in the policy package in Fortimanager. The retrieval options being a risky on a production machine and bit too tedious, and these firewalls are out of sync and work like stand alone firewalls. We have already instructed the support team members not to make changes directly in the firewall. However the existing out of sync ones still needs to be taken care.

Can we just delete these device and policy packages from Fortimanager and add them back?

[laf]

proxymoron wrote:

We also have the same issue, especially with Objects. We have a number of firewalls which have a different configuration that what it is there in the policy package in Fortimanager. The retrieval options being a risky on a production machine and bit too tedious, and these firewalls are out of sync and work like stand alone firewalls. We have already instructed the support team members not to make changes directly in the firewall. However the existing out of sync ones still needs to be taken care.

Can we just delete these device and policy packages from Fortimanager and add them back?

Yes. You can overwrite FGM configuration with your FGT running-config.