The ticket
Priya cannot reach the internet. Someone reboots FortiManager. Sessions on fgt-hq never moved. Logs were never on FMG. You rebooted the typewriter, not the road.
FortiGate is the NGFW in the packet path (policy, NAT, VPN, UTM). FortiManager is central policy/device manager — ADOM, install, revision. FortiAnalyzer is the log/report box. FortiOS 7.4 Admin Guide treats them as a Fabric, not one appliance. Policy still lives on the FortiGate after install. If FMG dies, existing policy keeps forwarding.
FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60. RFC 5737. Not a customer.
Mental model
| Box | Job | This lab | If it dies |
|---|---|---|---|
| FortiGate | Forward, NAT, VPN, inspect | 10.10.10.1 / 203.0.113.10 | Traffic dies |
| FortiManager | Central policy, ADOM, install | 10.10.10.5 | You cannot push; last install still runs |
| FortiAnalyzer | Logs, reports, FortiView | 10.10.10.6 | Forwarding continues; you go blind |
FMG and FAZ sit beside the path. They are not hops.
How to choose
| Mode | Use | Trap |
|---|---|---|
| FortiGate local GUI | This class lab, one box | Two admins overwrite each other |
| FMG-managed | Many sites / ADOMs | Edit on FGT then on FMG → config conflict |
| FAZ logging | Any production | Disk on FGT is not your SIEM |
Security Fabric
Runbook
Side A — path
Priya pings 8.8.8.8. On FGT:
get system status,get system performance status. If sessions exist, FMG is not the outage.Side B — manager
FMG Device Manager:
fgt-hqin sync. Do not Install now unless you meant to.Side C — logs
FAZ Log View: traffic from 10.20.30.80. Empty FAZ + working ping = log path, not policy.
get system status # Version: FortiOS v7.4.x Hostname: fgt-hq # Operation Mode: NAT execute ping 10.10.10.5 # FMG reachable — still does not mean traffic is OK get log fortianalyzer setting # status: enable server: 10.10.10.6
Four failures
1 · GUI of FMG down, users fine
Not an outage. Do not reboot the FortiGate.
2 · FGT up, FAZ empty
Log setting, routing to 10.10.10.6, or FAZ disk. Policy may be perfect.
3 · Two sources of truth
Edited policy on FGT GUI while FMG thinks it owns the ADOM. Next Install overwrites you.
4 · “Reload Fortinet”
Say the product name. FGT / FMG / FAZ / FortiClient are not synonyms.
How to prove it
1) You named the sick product. 2) A session exists or does not on the FortiGate. 3) FMG sync state is known. 4) You did not Install from FMG as a panic button.
Traps
| Symptom | Box | Wrong fix |
|---|---|---|
| Users down | FortiGate path | Reboot FMG |
| No reports | FAZ | Rewrite firewall policy |
| Cannot edit central policy | FMG | Factory reset FGT |
Knowledge check
Judgment items. One best answer. Reasons send you back to the matching section.
FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview
Sources
- FortiOS 7.4 Administration Guide — Security Fabric.
- FortiManager 7.4 Administration Guide — Device Manager / ADOM / Install.
- FortiAnalyzer 7.4 Administration Guide — Log View.
Related: FortiGate session factory · VPN series.