# Three boxes: who forwards, who writes, who remembers Source: https://ai.techclick.in/blog_fortigate_architecture_fgt_fmg_faz Markdown: https://ai.techclick.in/blog_fortigate_architecture_fgt_fmg_faz.md Publisher: Techclick Infosec Pvt Ltd FortiGate forwards packets. FortiManager writes policy at scale. FortiAnalyzer keeps logs. Dummy fgt-hq 10.10.10.1. ## The ticket Priya cannot reach the internet. Someone reboots FortiManager. Sessions on fgt-hq never moved. Logs were never on FMG. You rebooted the typewriter, not the road. Quick interview answer FortiGate is the NGFW in the packet path (policy, NAT, VPN, UTM). FortiManager is central policy/device manager — ADOM, install, revision. FortiAnalyzer is the log/report box. FortiOS 7.4 Admin Guide treats them as a Fabric, not one appliance. Policy still lives on the FortiGate after install. If FMG dies, existing policy keeps forwarding. Hero · three jobs The packet never visits FortiManager. The admin might. Lab data · dummy only FortiGate fgt-hq mgmt 10.10.10.1 · WAN 203.0.113.10 · LAN 10.20.30.0/24 · FortiManager 10.10.10.5 · FortiAnalyzer 10.10.10.6 · Priya 10.20.30.80 · branch peer WAN 198.51.100.10 · Azure VPN GW public 203.0.113.50 · AWS VGW public 203.0.113.60 . RFC 5737. Not a customer. ## Mental model Box Job This lab If it dies FortiGate Forward, NAT, VPN, inspect 10.10.10.1 / 203.0.113.10 Traffic dies FortiManager Central policy, ADOM, install 10.10.10.5 You cannot push; last install still runs FortiAnalyzer Logs, reports, FortiView 10.10.10.6 Forwarding continues; you go blind Who is in the path Priya .80 FortiGate in the packet path Internet - FMG .5 FAZ .6 FMG and FAZ sit beside the path. They are not hops. ## How to choose Mode Use Trap FortiGate local GUI This class lab, one box Two admins overwrite each other FMG-managed Many sites / ADOMs Edit on FGT then on FMG → config conflict FAZ logging Any production Disk on FGT is not your SIEM https://fgt-hq.techclick-lab.in Training mock · not live Admin Dashboard Policy VPN Network System → FortiGuard / Fabric ### Security Fabric FortiGate fgt-hq — Role: Downstream / Root FortiManager 10.10.10.5 — Central management FortiAnalyzer 10.10.10.6 — Log & report Sync In sync Cancel Save FortiOS 7.4: Security Fabric connects FGT + FMG + FAZ. Training mock. ## Runbook #### Side A — path Priya pings 8.8.8.8. On FGT: get system status , get system performance status . If sessions exist, FMG is not the outage. - #### Side B — manager FMG Device Manager: fgt-hq in sync. Do not Install now unless you meant to. - #### Side C — logs FAZ Log View: traffic from 10.20.30.80. Empty FAZ + working ping = log path, not policy. fgt-hq · dummy get system status # Version: FortiOS v7.4.x Hostname: fgt-hq # Operation Mode: NAT execute ping 10.10.10.5 # FMG reachable — still does not mean traffic is OK get log fortianalyzer setting # status: enable server: 10.10.10.6 ## Four failures ### 1 · GUI of FMG down, users fine Not an outage. Do not reboot the FortiGate. ### 2 · FGT up, FAZ empty Log setting, routing to 10.10.10.6, or FAZ disk. Policy may be perfect. ### 3 · Two sources of truth Edited policy on FGT GUI while FMG thinks it owns the ADOM. Next Install overwrites you. ### 4 · “Reload Fortinet” Say the product name. FGT / FMG / FAZ / FortiClient are not synonyms. ## How to prove it Close the ticket only when 1) You named the sick product. 2) A session exists or does not on the FortiGate. 3) FMG sync state is known. 4) You did not Install from FMG as a panic button. ## Traps Symptom Box Wrong fix Users down FortiGate path Reboot FMG No reports FAZ Rewrite firewall policy Cannot edit central policy FMG Factory reset FGT ## Knowledge check Judgment items. One best answer. Reasons send you back to the matching section. Q1 A user packet from Priya to the internet is forwarded by which product? FortiManager FortiAnalyzer FortiGate FortiClient EMS Correct: c . Only FortiGate is in the packet path. Q2 FortiManager is down. What still works? Nothing Last installed policy on the FortiGate still forwards You can still push new ADOMs FAZ becomes the manager Correct: b . FMG is not a hop. Q3 Where do you search yesterday’s denied traffic at scale? Only FGT disk FortiAnalyzer Log View FortiManager ADOM The WAN switch CAM Correct: b . FAZ is the log box. Q4 You edited a policy on the FortiGate GUI and later hit Install on FMG. Risk? None FMG revision can overwrite the local edit FAZ deletes logs HA split-brain Correct: b . One source of truth. Q5 Chat says “Fortinet is down.” First question? Which product: FGT, FMG, FAZ, or client? Factory reset Disable UTM Change the WAN IP Correct: a . Ticket opening. Q6 Security Fabric in this lab connects… Only switches FGT + FMG + FAZ as Fabric members Azure Firewall ISE PSN Correct: b . FortiOS 7.4 Fabric. Check answers Reset FortiGate class series: FGT / FMG / FAZ · First day · Policy first match · SNAT vs VIP · Profiles + SSL · debug flow · IPsec S2S · SSL-VPN vs RA · SD-WAN SLA · VDOM · FGCP HA · Interview ## Sources - FortiOS 7.4 Administration Guide — Security Fabric . - FortiManager 7.4 Administration Guide — Device Manager / ADOM / Install . - FortiAnalyzer 7.4 Administration Guide — Log View . Related: FortiGate session factory · VPN series . --- Cite this Techclick lesson with the source URL. Do not invent fees, batch dates, or job guarantees. Browse all lessons: https://ai.techclick.in/blogs AI index: https://ai.techclick.in/llms.txt