Fortinet FortiManager 7.6 Administrator (FCP_FMG_AD-7.6)

The correct two conditions that trigger FortiManager to create a new revision history are A and C.

A. When FortiManager installs device-level changes on a managed device

C. When FortiManager is auto-updated with configuration changes made directly on a managed device

When a global policy package is assigned to an ADOM (ADOM1 in this case), it appears in that ADOM's policy package list. If an administrator then creates a new policy package within ADOM1, this new package will be a local policy package. During the creation or subsequent configuration of this new local policy package, the administrator will be presented with options to define its relationship and interaction with other existing policy packages, including the global one. This typically involves setting the installation order, determining if the new package's policies apply before or after the global policies. Therefore, the administrator actively selects how the global policy package's context is integrated with the new local policy package, rather than it being automatic or requiring re-assignment.

The FortiGate GUI (Exhibit 1) displays the current IPS Definitions version as 6.00741. In contrast, the FortiManager GUI (Exhibit 2) shows much newer versions available for IPS signatures, such as 'Signature Meta Data (IPS Regular)' and 'Signature Meta Data (IPS Extended)' with versions like 29.0906. This significant discrepancy indicates that the FortiGate's IPS database is outdated compared to what is available on the FortiManager, which acts as the local FortiGuard Distribution Server (FDS). Consequently, the FortiGate cannot recognize newer IPS signatures that exist in the FortiManager's updated database but are absent from its own.

Why the other choices are incorrect:

• A: FortiGate must enable rating for the FortiManager IP address, 192.168.1.120, in server list 1. Rating services (e.g., web filtering or application control) are distinct from IPS signature updates. The issue is with IPS signature recognition, not rating.
• C: The administrator must enable IPv6 connections for FortiGuard services on FortiManager. The FortiGate's update server is configured with an IPv4 address (192.168.1.120) in the server list. There is no indication that IPv6 connectivity is required or that the lack of it is causing the signature recognition problem.
• D: The administrator must enable the fortiguard-anycast option to correctly download all signatures from the local FDS. The fortiguard-anycast option is used for connecting to the nearest FortiGuard cloud server in a distributed environment. In a closed network with a specific local FDS configured via a server list, anycast is not relevant or necessary for downloading signatures. The problem is a version mismatch, not a connection issue to the FDS.

When managing a high volume of logs in a network, the recommended approach is to leverage FortiAnalyzer. FortiManager is primarily a centralized management platform for Fortinet devices, while FortiAnalyzer is purpose-built for high-performance log collection, storage, analysis, and reporting. Integrating FortiAnalyzer with FortiManager allows FortiManager to offload the intensive task of log management to a dedicated system, thereby maintaining optimal performance for configuration management and orchestration, while FortiAnalyzer handles the large volume of log data efficiently and provides advanced analytics and reporting capabilities. FortiManager can then retrieve necessary log information or reports from FortiAnalyzer.

• Option A is incorrect: Storing high volumes of logs directly on FortiManager can strain its resources, negatively impacting its primary management functions and leading to performance degradation. FortiManager's storage is not optimized for high-volume, long-term log retention and analysis compared to FortiAnalyzer.
• Option C is incorrect: Enabling advanced ADOM mode on FortiManager is a feature for logical segmentation of devices and administrators within FortiManager. It does not address the underlying challenge of managing high volumes of log data; it's a management organizational feature, not a log processing solution.
• Option D is incorrect: Forwarding logs from FortiAnalyzer to FortiManager daily is counterproductive. FortiAnalyzer is designed to process and store logs efficiently. Sending high volumes of logs from FortiAnalyzer back to FortiManager would impose an unnecessary burden on the FortiManager, defeating the purpose of using a dedicated log management solution.

Why this fixes the error:

When you run a CLI script in FortiManager, you have two primary options for where it executes: the Device Database or the Remote Device (directly via CLI).

The Problem: When you try to push a configuration script via a Policy Package or run it directly on the remote device, FortiManager attempts to apply the syntax immediately. If the script contains references to objects or configurations that only exist in the local FortiManager database but haven't been compiled/synchronized yet, the FortiGate or the policy compiler will reject it as an "unrecognized object."

FortiManager excels in mass provisioning by centralizing device management and configuration deployment. Its primary method for achieving this is through the use of templates. Administrators can create standardized configurations or common settings within templates (e.g., Device Templates, CLI Templates, Policy Packages) and then apply these templates to multiple FortiGate or FortiAP devices simultaneously. This significantly streamlines the deployment process, ensures consistency across the network, and reduces manual configuration errors when managing a large number of devices.

The correct answer is D. ADOM revisions in FortiManager serve as snapshots, saving the complete state of all policy packages, objects, and configuration data within a specific ADOM at a given point in time. This functionality is crucial for version control, allowing administrators to create restore points before major changes or to revert to a previous, known-good configuration. It acts as a safety mechanism, enabling efficient recovery from misconfigurations or unwanted alterations.

Why the other choices are incorrect:

• A is incorrect: ADOM revisions are not primarily for finding unused, duplicate, or unnecessary firewall policies and objects; that's typically done by auditing tools or policy analysis features.
• B is incorrect: While revisions indirectly help track changes, their main purpose isn't to show specific changes during installation. They save the state of the ADOM's configuration.
• C is incorrect: Comparing previous snapshots with device-level databases is a function that can be performed using revisions, but it is not the primary purpose of creating a revision itself. A revision's fundamental purpose is to save the state.

The installation preview shows two key configurations:

1. config system central-management and set server-type update rating: This command configures the FortiGate to use the FortiManager as its source for FortiGuard updates and ratings. This means the FortiGate will contact the FortiManager (acting as a FortiGuard Distribution Server or proxy) to download security updates like antivirus, IPS definitions, web filtering, and application control ratings. This aligns with Option B.
2. config vpn certificate ca and edit "root_CA3": This command installs a Certificate Authority (CA) certificate named 'root_CA3' onto the FortiGate. In a FortiManager-FortiGate deployment, installing a trusted CA on the FortiGate often serves to enable the FortiGate to authenticate the FortiManager's own certificate during the establishment of the secure FortiGate-to-FortiManager (FGFM) communication tunnel. This ensures that the FortiGate trusts the FortiManager it is communicating with, aligning with Option D.

✅ Option A (Correct)
Meta fields in FortiManager are specifically designed to extend standard configuration objects, such as firewall addresses, services, or policies, with custom attributes. This functionality allows administrators to add unique descriptive or functional properties to objects, enhancing organization, search capabilities, and enabling more dynamic configuration based on these custom data points.

❌ Why the other choices are incorrect:

• Option B is incorrect: Meta fields are typically ADOM-specific. There is no direct, native export/import mechanism to transfer meta field definitions between different ADOMs in FortiManager.
• Option C is incorrect: While meta field values associated with objects can be leveraged in policy package templates or scripts that process those objects, they are not directly used as general-purpose variables within scripts in the same manner as global or device variables.
• Option D is incorrect: The '$' character is primarily used to invoke system-defined or global variables (e.g., $adom_name, $__device_name). Meta fields are custom attributes of objects and are referenced contextually through object properties, not by direct '$' invocation as standalone variables.

When a FortiGate device is located behind a Network Address Translation (NAT) device and FortiManager needs to push updates, two key configurations are essential:

• Option C: Configure Virtual IP (VIP) on the NAT device: The NAT device must have a Virtual IP (VIP) configured. This VIP maps an external public IP address and port (e.g., TCP 8890) to the FortiGate's internal private IP address and the corresponding management port. This allows the FortiManager, located on the external network, to initiate a connection to the FortiGate.
• Option A: Configure FortiManager with the NAT device's external IP: FortiManager needs to know the reachable IP address of the FortiGate. In a NAT scenario, this will be the external public IP address of the NAT device (the VIP) that is configured to forward traffic to the FortiGate. The FortiManager's device settings for the FortiGate must specify this public IP address and the correct management port (typically 8890).

Without both these settings, FortiManager will not be able to establish a connection to the FortiGate to push updates.