FortiManager - Diff between Template and Device settings

[bbartik]

I have a few questions about device settings and provisioning templates. I will explain the scenario then put questions below. 

Example:

I have a CLI template which configures interfaces with IP addresses, using a meta variable:

config system interface
edit "port2"
set ip 192.168.10{{branch_id}}.2 255.255.255.252
next

If I override this by configuring the IP address locally on the FortiGate, the config status is auto-updated in FMG and the template does not take effect anymore.

If I run the Install Wizard, FMG will not run any commands on the device even though the CLI template would revert the IP address back to what it was.

If I make a change to another template for the device and run install wizard then this CLI template does take effect again.

Questions:

1. How can I see the diff between what the device level settings and what the templates would install? In this case, I cannot see the diff in the Install Wizard because the Install Wizard would not push any changes. If I run Quick Install, all the templates take effect again but I cannot see a diff.

2. Is there a way to enforce that the templates over the device level settings? My concern is someone changing a setting locally and then not realizing a later template install is going to revert it back unless they reconcile it in the template manually.

Thanks.

[bbartik]

Looks like what I am after is under the Dashboard of the device in FortiManager. This allows me to see the diff, etc.

[Toshi_Esumi]

First until I see your post I didn't know there was another syntax {{variable_name}} in addition to $(variable_name) described in the 7.2 admin guide.
https://docs.fortinet.com/document/fortimanager/7.2.0/administration-guide/629522/using-meta-field-v...

We use CLI templates/CLI template groups as well with those variables. Device templates' sync status is not evaluated when you make a change at the device itself (that's why you get a warning when you log in). I asked about this with a TAC case but was told "that's the way the FMG's device templates work". So there seems to be no way to know when the device config was modified by somebody that doesn't match any templates.

What we do if we definitely need to check the preview of one device is to unassign the template group once then re-assign it, which would cause the status to be "Modified". Then run the Install Wizard to see the preview. With this way, you don't have to re-install (with "no preview" in the preview) the template group to all devices that use it.

Toshi

[asrour]

Hello,

You can un-assign the provisioning templates after first install so you will not have to worry about changes done on the device or device manager later.

Thanks,