Device revision provenance should remain linked to the hardware identity that produced it. This mechanism instead applies when a branch firewall was replaced but historical revisions still describe the retired serial number. The current correction relies on restored central data may predate the live device revision and needs reconciliation.

Revision histories reflect observed configuration collection events, not every keystroke in a CLI session. This mechanism instead applies when an engineer assumes FortiManager automatically captures a new device revision immediately after every unsaved local CLI command. The current correction relies on restored central data may predate the live device revision and needs reconciliation.

Configuration retrieval refreshes FortiManager's observed copy of managed-device settings. This mechanism instead applies when a firewall's local administrator modified interface settings during an outage, but central Device Manager did not refresh them. The current correction relies on restored central data may predate the live device revision and needs reconciliation.

Revision histories reflect observed configuration collection events, not every keystroke in a CLI session. This mechanism instead applies when an engineer assumes FortiManager automatically captures a new device revision immediately after every unsaved local CLI command. The current correction relies on revision history and task logs reconstruct device configuration transitions.

Historical snapshots are useful only when their collection timing is understood. This mechanism instead applies when an engineer uses an old revision snapshot as evidence that no rules changed in the last week. The current correction relies on revision history and task logs reconstruct device configuration transitions.

Revision comparison provides configuration-level evidence beyond revision numbering. This mechanism instead applies when a maintenance team finds two revisions that look similar but differ in VPN interfaces used by an HA cluster. The current correction relies on revision history and task logs reconstruct device configuration transitions.

FortiGate uses configured central management endpoints to communicate with FortiManager. This mechanism instead applies when a new FortiGate cannot contact its FortiManager because the device was configured with the wrong central manager address. The current correction relies on managed device registration and policy package target assignment are distinct steps.

FortiManager provisioning must align template syntax and capabilities to target device software. This mechanism instead applies when a team attempts to provision an unsupported FortiGate model with a template built for a different firmware family. The current correction relies on managed device registration and policy package target assignment are distinct steps.

Template portability does not remove the need to validate destination-specific configuration. This mechanism instead applies when a provisioning engineer copies a system template from a retail ADOM into a finance ADOM without checking environment differences. The current correction relies on managed device registration and policy package target assignment are distinct steps.

Resource monitoring identifies the process or scheduled load responsible for the slowdown. That observation is relevant for the separate case the FortiManager GUI becomes slow while CPU usage spikes during a large scheduled operation. Here the decisive evidence is the replacement serial receives the approved policy package and appears online.

Collected diagnostics identify the component responsible or justify the controlled restart. That observation is relevant for the separate case an operator sees high memory usage but immediately reboots FortiManager without collecting diagnostic evidence. Here the decisive evidence is the replacement serial receives the approved policy package and appears online.

Disk utilization returns to a supported level without deleting current management databases. That observation is relevant for the separate case a FortiManager VM approaches full disk capacity after accumulating backups and operational logs. Here the decisive evidence is the replacement serial receives the approved policy package and appears online.

Inspect the dynamic mapping table for each logical interface and test every intended installation target. This can be appropriate when a policy package includes two similarly named interface mappings and engineers are unsure which target uses each one. It does not directly address the present situation, where the required correction is configure and validate the target-specific dynamic interface mapping for the policy package.

Create a reusable FortiManager policy package and assign the approved installation targets. This can be appropriate when a company needs a consistent internet-access rule set across six FortiGate branches with distinct device addresses. It does not directly address the present situation, where the required correction is configure and validate the target-specific dynamic interface mapping for the policy package.

Inspect package installation status and compare the intended central and installed revisions. This can be appropriate when an imported firewall policy package is marked modified after central editing but the operator assumes the target is synchronized. It does not directly address the present situation, where the required correction is configure and validate the target-specific dynamic interface mapping for the policy package.

Backup ADOMs collect revisions while Normal ADOMs permit read-write central management. This mechanism instead applies when an administrator attempts to modify a managed FortiGate through an ADOM configured in Backup mode. The current correction relies on installation targets are maintained in ADOM-scoped policy management records.

Session monitoring links concurrent administrative activity to resource lock state. This mechanism instead applies when a user needs to identify which administrator session holds a lock before emergency maintenance. The current correction relies on installation targets are maintained in ADOM-scoped policy management records.

ADOM membership determines the configuration database and policy scope of a managed device. This mechanism instead applies when a device needs to move from one customer ADOM to another due to a contract transfer. The current correction relies on installation targets are maintained in ADOM-scoped policy management records.

Compare the import summary and unresolved objects before performing any subsequent installation. This can be appropriate when a policy import finishes but the device's latest configuration still contains objects not represented in FortiManager. It does not directly address the present situation, where the required correction is use the supported Re-install Policy operation for that package after comparing target configuration.

Supply the missing target-specific dynamic mapping and revalidate the installation. This can be appropriate when an operator attempts to deploy a security policy with a dynamic address object that has no mapping for one target. It does not directly address the present situation, where the required correction is use the supported Re-install Policy operation for that package after comparing target configuration.

Update and verify package installation targets before executing the installation wizard. This can be appropriate when a security team installs a new policy on only one of three approved branches because the installation target list is outdated. It does not directly address the present situation, where the required correction is use the supported Re-install Policy operation for that package after comparing target configuration.

Both intended targets validate with their own physical interface assignments. That observation is relevant for the separate case a central policy package validates for one FortiGate but not for another due to a missing interface alias. Here the decisive evidence is the imported package retains the intended rule semantics and all mappings validate.

The destination ADOM package resolves only its expected objects and authorized device targets. That observation is relevant for the separate case an administrator moves a FortiGate to another ADOM and then installs an old package that still contains source-ADOM objects. Here the decisive evidence is the imported package retains the intended rule semantics and all mappings validate.

The task log lists all three intended branches and each reports the new policy revision. That observation is relevant for the separate case a security team installs a new policy on only one of three approved branches because the installation target list is outdated. Here the decisive evidence is the imported package retains the intended rule semantics and all mappings validate.

Script history and task output provide per-execution diagnostics for managed commands. This mechanism instead applies when an administrator cannot explain why a CLI script partially applied to one FortiGate. The current correction relies on FortiManager scripts apply managed configuration operations across explicitly selected targets.

Scripts run within defined ADOM or global database contexts and selected targets. This mechanism instead applies when a team runs a global-database script and assumes it targets every FortiGate in every ADOM automatically. The current correction relies on FortiManager scripts apply managed configuration operations across explicitly selected targets.

Script execution uses target-device command syntax and must account for product versions. This mechanism instead applies when a FortiManager script succeeds on one test firewall but fails on an older FortiOS version in another site. The current correction relies on FortiManager scripts apply managed configuration operations across explicitly selected targets.

The chosen package has one valid global assignment and policy installation validates. That observation is relevant for the separate case an administrator attempts to assign two separate global policy packages to one individual local policy package simultaneously. Here the decisive evidence is only assigned ADOM packages include the new global rule during installation.

The resulting installed policy has reviewed tenant rules followed by global footer policy. That observation is relevant for the separate case a service provider needs global mandatory cleanup rules to appear after a customer's local firewall policy. Here the decisive evidence is only assigned ADOM packages include the new global rule during installation.

Policy preview includes the central global rules for the authorized tenant installation. That observation is relevant for the separate case a global policy is created in FortiManager but is not visible when installing a tenant ADOM package. Here the decisive evidence is only assigned ADOM packages include the new global rule during installation.

The managed device database reflects the current approved interface configuration. That observation is relevant for the separate case an operations engineer expects changes to FortiGate interfaces to appear in Policy & Objects without maintaining the device database. Here the decisive evidence is finance devices receive only reviewed settings consistent with their own network requirements.

The registered device belongs to the authorized tenant and its package targets have been reviewed. That observation is relevant for the separate case an administrator imports a FortiGate into the wrong tenant ADOM and later notices a policy scope mismatch. Here the decisive evidence is finance devices receive only reviewed settings consistent with their own network requirements.

Each target receives equivalent intended settings mapped to its own interface and platform capabilities. That observation is relevant for the separate case a provider wants a single baseline template to configure devices with different interface names and hardware platforms. Here the decisive evidence is finance devices receive only reviewed settings consistent with their own network requirements.