T Techclick ← All lessons
Fortinet · FortiManager · Interactive lesson

Policy package preview then install

Ticket: Noida LAN shrink is in the package, Task Monitor is green — and Pune lost internet. FortiManager does not push because you clicked OK on an address. It pushes when a policy package in the correct ADOM is installed to its Installation Targets. Install Preview is the CLI you will send. A revision is the rollback. Lab: FMG 10.20.20.5, ADOM BRANCH, package PKG_BRANCH, FGT-NOIDA 10.20.20.1, FGT-PUNE 10.20.30.1.

16 min read · L2 primary · Quiz at end

After this page you can

Lessons · FortiGate · FMG · FAZ · Policy package workflow

This page vs FortiGate policy and VDOM

This lesson is how FortiManager turns an ADOM edit into a FortiGate running config: policy package, Installation Targets, Install Preview, then revision. Packet allow/deny still lives on the FortiGate. Tenant split on the firewall is VDOM — ADOM is the FortiManager isolation, not a VDOM.

Zone, policy, NAT · VDOMs · FortiManager interview

Hero · one ADOM, two gates, preview in the middle
Laptop editing an ADOM, policy package passing a Preview pane, then two branch firewalls
Mood, not a wiring diagram. Exact path is in the SVG: ADOM BRANCH holds PKG_BRANCH, Install Preview lists FGT-NOIDA and FGT-PUNE, then Install writes a revision. Saving LAN_NET is not a push.
Quick answer

Switch to ADOM BRANCH. Edit the policy package and ADOM objects, not the FortiGate GUI. Add devices under Installation Targets. Run Device Manager › Install Wizard › Install Policy Package & Device Settings. Tick Create ADOM Revision. Open Install Preview, download the CLI, confirm the device list. Only then Install. Proof: diagnose dvm device list shows pkg:[installed]PKG_BRANCH, conf: in sync, dm: installed. Lab: FMG 10.20.20.5, FGT-NOIDA 10.20.20.1, FGT-PUNE 10.20.30.1.

Why a GUI save is not an install

The day-one ticket is always the same: “I saved the object on FortiManager, so the firewall has it.” Wrong. Policy & Objects writes the ADOM database. The FortiGate still runs whatever was last installed. Three silent-wrong states look identical from the branch:

Task Monitor green is not “only Noida changed”

Green means the selected targets accepted the script FortiManager built. If FGT-PUNE was in that list, Pune took the same object. Proof is Install Preview per device, not the task colour.

Concept — ADOM, package, device DB

An ADOM (administrative domain) is the FortiManager tenant. Policy packages, ADOM objects and VPN console settings live here. Switch ADOM in the header before you touch Policy & Objects. Installing from the wrong ADOM is how root objects land on a branch.

A policy package is the central policy set assigned to one or more FortiGates (and VDOMs) as Installation Targets. Objects used by that package are ADOM-level unless you give them a per-device mapping. One object, many packages — one edit, many next installs.

Path · ADOM, then package, then preview, then install
Four glass panels labeled ADOM, Package, Preview, Install
Feel of the order. Exact FortiManager sequence — ADOM DB copy into Device DB, then CLI preview, then push — is in the SVG below. Do not read the Install panel as “OK on the address.”

ADOM

Tenant. Lab: BRANCH. Header switch. Policy & Objects, Device Manager and ADOM Revisions are per ADOM.

Policy package

PKG_BRANCH. Firewall policies + Installation Targets. Status: Modified / Imported / Synchronized / Out of Sync / Unknown / Installed.

Device database

FMG’s copy of each FortiGate. Install copies ADOM objects here first (VDOM copy), then diffs against the live box.

Revision

ADOM revision = snapshot of packages + objects. Device revision = created on install, retrieve, auto-update — not on import.

Say this out loud

The ADOM holds the objects. The policy package names the targets. Install copies into the device database, then preview shows the CLI. A revision is the rollback. No preview, no install.

Path — preview then install

Healthy change: edit package and objects → FortiManager validates policy, objects and interface mapping → Install Preview (download the text) → Install → review ADOM revision and device revision. If a user report says “it is broken”, find the stage where evidence stops. Author centrally. Push only what preview listed.

Flow 1 · lab change LAN_NET on PKG_BRANCH
1 ADOM BRANCH · LAN_NET 2 Package PKG_BRANCH 3 Device DB VDOM copy 4 Preview CLI per device 5 Install then revision 6 Proof · pkg:[installed]PKG_BRANCH · conf: in sync · dm: installed ADOM revision BRANCH-CHG-041 · device revision on FGT-NOIDA and FGT-PUNE Task Monitor success is not the device list. Preview named both gates. Skip preview: LAN_NET edit on PKG_BRANCH also hits FGT-PUNE. Stop. Download preview. Remove the extra target or split the object. Do not Install. Validation errors skip that device. Empty Installation Targets → No Preview / No record found. Source: FortiManager Administration Guide — Installing policy packages and device settings; Sequence of operations.

Read left → right, then the gold bar. ADOM DB is not the FortiGate. Preview is the last chance to see FGT-PUNE in the blast radius.

ObjectLab valueIf missing
ADOMBRANCH (header switch)You edit root. Wrong objects, wrong package list.
Policy packagePKG_BRANCHInstall Wizard has nothing to select, or the wrong package.
Installation TargetsFGT-NOIDA, FGT-PUNE (VDOM root)Preview: No Preview / No record found. Device never gets the package.
ADOM objectLAN_NET = 10.20.20.0/24Shared by every package in BRANCH that references it. Edit once, install many.
Normalized interfaceLAN / WAN mapped per deviceValidation fails; that device is skipped for install.
Proofdiagnose dvm device listGUI “Modified” yellow is pending, not installed.

Install vs Import vs Retrieve

Pick the operation the ticket actually needs. Mixing them is the usual “pkg unknown after rollback” case.

Flow 2 · three operations, three databases
Install FMG → FortiGate package + device settings creates device revision Retrieve FortiGate → device DB running config copy creates device revision Import FortiGate → package DB policies + objects only no device revision Auto-update also writes a device revision when the FortiGate is edited locally. Rollback of a device revision: Restore, then Install Device Settings Only. Policy Package & Device Settings merges the current package. After that restore, pkg is often unknown until you Import from the gate, then Install again to mark synchronized. Source: FortiManager — Operations (Install / Import / Retrieve); Community technical guide on device DB and pkg status.

Three columns, three tickets. Import is not a push. Retrieve is not a package update.

NeedUseSkip
Push approved policy to FGT-NOIDAInstall Wizard → Install Policy Package & Device Settings → Preview → InstallSaving the address and walking away. That is ADOM DB only.
Push only interfaces / routes / systemInstall Device Settings Only (or Quick install device DB)Re-installing the whole package to fix a static route.
FortiGate was edited locally; FMG should learn policiesRetrieve (device DB + revision), then Import into the packageInstall — that overwrites the local edit with the ADOM copy.
Rollback last bad pushDevice revision Restore + Install Device Settings Only; or ADOM Revisions Restore then previewInstall Policy Package & Device Settings onto a restored device revision (merges current package).

Do — Side A / B / C

Side A is ADOM, package and targets. Side B is the edit and Install Preview. Side C is status plus revision. Do not start at C.

Side A — ADOM, package, targets

  1. Switch ADOM BRANCH

    Header ADOM selector → BRANCH. If ADOMs are off you are in a single global space — enable them before you pretend you have tenants. Source: FortiManager Administration Guide — Switching between ADOMs.

  2. Package and Installation Targets

    Policy & Objects › Policy Packages › PKG_BRANCH › Installation Targets. Both FGT-NOIDA and FGT-PUNE must sit in Selected. Empty list = No Preview later. Workspace mode: lock the ADOM, or lock the device and the package, or Install Wizard stays grey / the package is missing from the list.

https://10.20.20.5/ · ADOM BRANCH · Policy & Objects › Policy Packages › PKG_BRANCH › Installation Targets
Training mock · not live

ADOM BRANCH › Policy Packages › PKG_BRANCH › Installation Targets

PKG_BRANCH targets

FGT-NOIDA (root) · conn up
Modified
FGT-PUNE (root) · conn up
Synchronized

Source: FortiManager Administration Guide — Policy package installation targets. Config status and policy package status are separate columns. Modified on the package means FMG has pending policy/object changes — not that the FortiGate has them.

CLI — Side A, before the edit 
diagnose dvm adom list
# BRANCH  … mode=normal

diagnose dvm device list
# FGT-NOIDA  10.20.20.1  ADOM BRANCH
# |- STATUS: dev-db: not modified; conf: in sync; cond: OK; dm: installed; conn: up
# |- vdom:[3]root flags:0 adom:BRANCH pkg:[installed]PKG_BRANCH
# FGT-PUNE   10.20.30.1  ADOM BRANCH
# |- … pkg:[installed]PKG_BRANCH

Side B — edit, then preview, then install

  1. Edit the object in the ADOM

    Policy & Objects › Object Configurations › Addresses — LAN_NET stays 10.20.20.0/24 for this lab. If Noida really needs a different subnet, do not reuse LAN_NET on Pune: clone a per-site object or a dynamic mapping. Where-used / object references before you save.

  2. Install Wizard

    Device Manager › Device & Groups › Install Wizard (or Install › Install Wizard). Choose Install Policy Package & Device Settings. Package PKG_BRANCH. Tick Create ADOM Revision, name BRANCH-CHG-041, comment the change ticket. Next. Validation covers policy/object, interface mapping, install prep. Devices that fail validation are skipped.

https://10.20.20.5/ · ADOM BRANCH · Device Manager › Install Wizard › Install Preview
Training mock · not live

Install Wizard › Install Policy Package & Device Settings › Preview

Install Preview — PKG_BRANCH

PKG_BRANCH
BRANCH-CHG-041
FGT-NOIDA · FGT-PUNE
config firewall address / LAN_NET on both

Source: FortiManager Administration Guide — Installing policy packages and device settings. Install Preview is optional in the GUI and mandatory in this lesson. Download the text. If FGT-PUNE shows the same LAN_NET CLI and that was not the ticket, stop — do not click Install.

CLI — Side B, after the ADOM edit (still not on the gate) 
diagnose dvm device list
# FGT-NOIDA … pkg:[modified]PKG_BRANCH
# FGT-PUNE  … pkg:[modified]PKG_BRANCH
# Modified = ADOM/package pending. FortiGate still has the last install.

diagnose fmpolicy print-adom-package BRANCH PKG_BRANCH
# ADOM copy of the package — not proof the gate has it

Side C — prove install and revision

  1. Task Monitor, then dvm list

    System Settings › Task Monitor (or diagnose dvm task list). Then diagnose dvm device list. You want pkg:[installed]PKG_BRANCH, conf: in sync, dm: installed, conn: up. Source: FortiManager — Viewing policy package status; Community technical guide on diagnose dvm device list.

  2. ADOM revision and device revision

    Policy & Objects › ADOM Revisions — BRANCH-CHG-041 exists; Summary / CLI Diff vs current database. Device revision: Device Manager › FGT-NOIDA › Revision History (CLI diagnose dmserver revlist). Install, retrieve and auto-update add a row. Import does not.

  3. Spot-check the FortiGate

    On FGT-NOIDA: show firewall address LAN_NET. That is the running config. FMG GUI objects are not.

CLI — Side C proof (after Install) 
diagnose dvm device list
# FGT-NOIDA 10.20.20.1 ADOM BRANCH
# |- STATUS: dev-db: not modified; conf: in sync; cond: OK; dm: installed; conn: up
# |- vdom:[3]root flags:0 adom:BRANCH pkg:[installed]PKG_BRANCH
# FGT-PUNE  10.20.30.1 … pkg:[installed]PKG_BRANCH

diagnose dvm task list
diagnose dmserver revlist FGT-NOIDA
# newest row = this install, not the last retrieve
Green proof

Preview downloaded, device list matches the ticket, Task Monitor success, pkg:[installed]PKG_BRANCH, ADOM revision named, FortiGate show matches. That is the close — not “I clicked OK on LAN_NET.”

One flow after go-live

Engineer in ADOM BRANCH edits LAN_NET on PKG_BRANCH. Package status goes Modified on every target. Install Wizard copies ADOM objects into each device database (VDOM copy). Device DB shows Modified. FortiManager diffs that DB against the live FortiGate and builds CLI. Install Preview for FGT-NOIDA and FGT-PUNE both list the address change. If Pune is not in the ticket, remove it from this install or split the object. Then Install. ADOM revision BRANCH-CHG-041 is created. Each gate gets a device revision. diagnose dvm device list flips to pkg:[installed].

Local FortiGate GUI edit later: auto-update may refresh the device DB and add a revision; package can go Out of Sync. Retrieve if you want FMG to learn device settings. Import if you want those policies in the package. Install if you intend to overwrite the box with the ADOM copy — that is a different ticket.

Proof · preview on the glass, then the revision row
Engineer reviewing an install preview with checkmarks and a diff panel
Ops feel. Actual evidence is Install Preview CLI per device, Task Monitor, diagnose dvm device list pkg/conf/dm fields, and ADOM Revisions. Artwork checkmarks are not FortiManager.
Workspace lock — when Install Wizard is grey 
# Workspace mode on: lock ADOM BRANCH, or:
# Device Manager › FGT-NOIDA › Lock
# Policy & Objects › PKG_BRANCH › Lock
# Device unlocked → Install Wizard grey. Package unlocked → missing from the package list.
# Source: Fortinet Community — Policy Package installation with Workspace Mode enabled

Traps + proof

SymptomLikely causeProof
Object saved, gate unchangedADOM DB only. Package Modified. No Install.pkg:[modified]. FortiGate show still old.
Noida change killed PuneShared ADOM object and/or shared Installation Targets. Preview skipped.Preview CLI for FGT-PUNE lists the same LAN_NET. Where-used on the object.
Install Preview empty / No record foundDevice not in Installation Targets.Policy Packages › Installation Targets. Add, then preview again.
Device skipped during wizardValidation: policy/object, interface mapping, or install prep failed.Wizard validation pane. Normalized interface mapping for that serial.
Install Wizard grey / package missingWorkspace mode: device or package not locked.Lock ADOM, or lock device + package.
pkg unknown after rollbackRestored a device revision then used Install Policy Package & Device Settings (merged current package), or restore without Import.Restore + Install Device Settings Only, Import from gate, then Install to mark synchronized.
Edited in ADOM rootHeader still on root. BRANCH package never saw the object.ADOM selector. diagnose dvm adom list.
Do not share LAN_NET across sites “to keep objects tidy”

ADOM objects are global to the ADOM. One CIDR change is every package that references it, on the next install of those targets. Clone per site, or use dynamic mappings. Preview is how you see the extra CLI before it is too late.

Pilot checklist

Knowledge check

Six judgment items. Submit once. Reasons point back at the section to re-read.

Q1

What is a policy package, relative to an ADOM?

Correct: b. ADOM isolates devices and objects. The package is what you assign and install. Saving Policy & Objects is not a push. Re-read Concept.
Q2

You edited LAN_NET on PKG_BRANCH. What must you do before Install?

Correct: c. Preview is the CLI FortiManager will send after the VDOM copy. Download it. Extra device in Assigned Devices = stop. Re-read Path and Side B.
Q3

Noida LAN shrink is installed. Pune also lost the old LAN_NET. First cause?

Correct: a. Shared object plus shared targets. Preview per device is the catch. Re-read Why a GUI save is not an install and Traps.
Q4

Which statement about Import, Retrieve and Install is true?

Correct: d. Device revisions: install, retrieve, auto-update. Import fills the package DB only. Re-read Install vs Import vs Retrieve.
Q5

What is the proof that PKG_BRANCH actually landed on FGT-NOIDA?

Correct: b. Modified is pending on FMG. Installed + in sync + revision + gate show is the wire. Re-read Side C and Traps.
Q6

You restored a device revision on FGT-NOIDA to undo a bad push. How do you install it without merging today’s policy package?

Correct: c. Policy Package & Device Settings combines the restored device config with the current package. Device Settings Only pushes the revision. Re-read Choose and Traps.

Sources

Related: FortiManager interview · FortiGate · FMG · FAZ architecture · Zone, policy, NAT · FortiAnalyzer logs and hunt · VDOMs