fortigate register & management from a Fortimanager

[Chris_k]

How to register and manage a Fortigate Device behind a dsl router with dynamic ip address?

Fortimanager is in LAN private network of a Fortigate behind a dsl router with static public ip.

FMG(priv ip)-->FortiGate-->(NAT)-->dsl-router(static ip)-->internet 

and

FGT-->(NAT)-->dsl-router(dynamic ip)-->internet

[AEK · Accepted solution]

I recommend to manage it over IPsec.

FGT --------------------- Dial-up IPsec -------------------- FGT --- FMG

[Chris_k]

How secure is to forward tcp 541 to Fortimanger behind Fortigate ?

[AEK]

Please remind me what 541 TCP used for.

Can you provide more explanation on what you want to achieve?

[Chris_k]

the case is i want to replace about 60 branch routers with fortigate appliances.

everything is behind a nated dsl modem with isp's dynamic addresses.

The same for the headquarters Fortigate but with static ip's.

I try to find something as zero touch configuration of the branch devices, and also a safe management of them either through ipsec or fortimanager virtual ip

[AEK]

Please check this link.

https://docs.fortinet.com/document/fortimanager/7.4.3/administration-guide/227089/ipsec-tunnel-templ...

I didn't do it before but I'm sure it will help.

Regarding management, again I think it is safer to manage through IPsec.

[sw2090]

@AEK 541/TCP is used for/by the FGFM Protocol used for communication between FMG and FGT.