# What is FortiManager - Single-pane management and provisioning - Helps maintain compliance - Local [[FortiGuard]] cache server. - Provides centralized device management. - Configuration control tracking and rollback. - Schedule firmware upgrades - Automates device provisioning and maintains policies. - Scripting ## Inside FortiManager ![[Pasted image 20260715101943.png]] ## ADOMs (Administrative Domain) - ADOMs are not enabled by default and can only be enabled by `SUPER_User`. - Group devices logically for management. - A device is assigned to an ADOM and admins are assigned to one or more ADOMs. - ADOMs can work in "normal" or "advanced". - Advanced mode allows each FortiGate VDOM to be assigned to a different ADOM. - `Super_User` profiles can manage devices in all ADOMs. - When creating a new ADOM, VPN management is not enabled. ## FortiAnalyzer - For environments with a high volume of logs, add and manage FortiAnalyzer from FortiManager. - The main benefit of using FortiManager as a local FDN is the reduction of network delays and internet bandwidth use. # Initial Configuration ## Ports ![[Pasted image 20260715103654.png]] ## Security Recommendations • Deploy FortiManager in a protected and trusted private network • Use secure communication, even in a private network (HTTPS or SSH) • Configure trusted hosts • If access from the outside is required: • Open only the ports necessary for secure communications • Set up special users and use only secure protocols (HTTPS/SSH) • Use secure passwords and the password policy feature • Check event logs frequently • Configure the external syslog and email servers for quick notifications ## Network Configuration - Similar to FortiGate. - Enable administrative protocols (HTTP, HTTPS, SSH, Ping, SNMP, etc.) ### Closed Network Topologies ![[Pasted image 20260715105713.png]] # Use Cases ## Retail - Many remote sites and several hub sites and data centers. - Operations team centrally managing firewalls. - Simple initial deployment, phone home configuration. - Shared firewall objects across many firewalls: addresses and services. - Firewall policies common to many sites. - Single ADOM with one policy package for all devices OR Single or multiple ADOMs with multiple policy packages. # MSSP / MSP - Many smaller CPE devices or virtual deivces. - Customers have read-only access to their devices. - Few shared objects between customers. - No direct customer interaction with the managed devices. - Service provider may automate some provisioning. - Pay as you go model pass cost savings to customers. - Each customer has one or more dedicated ADOMs.