Inspect system CPU, memory and active processes before changing device policies. This can be appropriate when the FortiManager GUI becomes slow while CPU usage spikes during a large scheduled operation. It does not directly address the present situation, where the required correction is capture resource trends and process information first, then perform an authorized recovery action.

Inspect service process status and relevant debug output before a controlled service recovery. This can be appropriate when a FortiManager service stops responding while the operating system remains reachable through SSH. It does not directly address the present situation, where the required correction is capture resource trends and process information first, then perform an authorized recovery action.

Run documented filesystem integrity checks and restore affected management databases when justified. This can be appropriate when after unexpected power loss, FortiManager displays inconsistent database errors in installation tasks. It does not directly address the present situation, where the required correction is capture resource trends and process information first, then perform an authorized recovery action.

Review the per-policy or package installation targets before scheduling the change. This can be appropriate when a policy administrator copies a new rule but forgets to identify which FortiGate devices should receive it. It does not directly address the present situation, where the required correction is retrieve or refresh supported policy hit-count information before considering cleanup.

Create a reusable FortiManager policy package and assign the approved installation targets. This can be appropriate when a company needs a consistent internet-access rule set across six FortiGate branches with distinct device addresses. It does not directly address the present situation, where the required correction is retrieve or refresh supported policy hit-count information before considering cleanup.

Complete the approved policy package installation for the affected managed device. This can be appropriate when a newly authored firewall rule is committed centrally but remains absent from the target FortiGate rulebase. It does not directly address the present situation, where the required correction is retrieve or refresh supported policy hit-count information before considering cleanup.

Policy records carry the intended owner attribute and it appears in reporting or review. That observation is relevant for the separate case a global IT team needs to record the business owner of each firewall policy for later audit. Here the decisive evidence is a policy preview shows the obsolete member removed wherever the group is referenced.

The object usage list identifies all relevant policy references for review. That observation is relevant for the separate case a company has multiple address objects with similar labels and needs to understand which rules reference one object. Here the decisive evidence is a policy preview shows the obsolete member removed wherever the group is referenced.

The intended branches enforce the same approved rules with their correct local mappings. That observation is relevant for the separate case a company needs a consistent internet-access rule set across six FortiGate branches with distinct device addresses. Here the decisive evidence is a policy preview shows the obsolete member removed wherever the group is referenced.

Use FortiManager centralized device and policy management with appropriate administrative separation. This can be appropriate when a managed-services provider needs to administer dozens of customer FortiGates without signing into each firewall separately. It does not directly address the present situation, where the required correction is use a supported authenticated FortiManager JSON-RPC API session or correctly authorized API access.

Parse the API error and correct authorization, parameters or object state before bounded retries. This can be appropriate when a FortiManager API integration sees a JSON-RPC application error but retries the identical destructive request indefinitely. It does not directly address the present situation, where the required correction is use a supported authenticated FortiManager JSON-RPC API session or correctly authorized API access.

Create an API integration account with only the privileges required by the inventory workflow. This can be appropriate when a team builds a configuration portal that repeatedly uses administrator credentials with full system permissions for simple inventory queries. It does not directly address the present situation, where the required correction is use a supported authenticated FortiManager JSON-RPC API session or correctly authorized API access.

The promoted unit serves the expected current device and policy database records. That observation is relevant for the separate case a maintenance window requires promoting a secondary FortiManager with unconfirmed synchronized policy data. Here the decisive evidence is the recovered member shows a valid secondary role with required management data up to date.

Authorized users can manage intended devices through the active member after controlled failover. That observation is relevant for the separate case an enterprise plans to test FortiManager HA but has not checked how administrative sessions reconnect to the promoted unit. Here the decisive evidence is the recovered member shows a valid secondary role with required management data up to date.

Pending data reaches the expected synchronized state before a planned changeover. That observation is relevant for the separate case a security administrator sees HA cluster status Up and assumes all FortiManager databases are fully synchronized. Here the decisive evidence is the recovered member shows a valid secondary role with required management data up to date.

Cross-ADOM object mappings do not necessarily carry valid target identities. That consequence is more specific to a policy package is cloned between ADOMs and its dynamic address mappings do not resolve on the destination devices. For this case, the most direct exposure is assuming ADOM object edits are immediately active can leave the firewall enforcing old data.

Unreviewed restoration drift can lead to unexpected security enforcement after recovery. That consequence is more specific to a device was restored from backup and now has an older configuration than the FortiManager ADOM package. For this case, the most direct exposure is assuming ADOM object edits are immediately active can leave the firewall enforcing old data.

Updating one configuration layer without dependent mapping can break a later policy installation. That consequence is more specific to an engineer changes a FortiGate interface in Device Manager but expects that change to update all firewall rule objects automatically. For this case, the most direct exposure is assuming ADOM object edits are immediately active can leave the firewall enforcing old data.

The intended branches enforce the same approved rules with their correct local mappings. That observation is relevant for the separate case a company needs a consistent internet-access rule set across six FortiGate branches with distinct device addresses. Here the decisive evidence is the new rule refers to authorized local addresses and passes target-specific validation.

The matching traffic hits the reviewed deny rule before broader permission is considered. That observation is relevant for the separate case a security engineer adds a deny rule under a broad permissive rule but sees no change in traffic decisions. Here the decisive evidence is the new rule refers to authorized local addresses and passes target-specific validation.

The target firewall reports the installed policy revision containing the intended rule. That observation is relevant for the separate case a newly authored firewall rule is committed centrally but remains absent from the target FortiGate rulebase. Here the decisive evidence is the new rule refers to authorized local addresses and passes target-specific validation.

Missing policy object dependencies can cause installations to fail or omit intended inspection. That consequence is more specific to a managed firewall requires IPS protection but the policy package references a profile missing from the ADOM object inventory. For this case, the most direct exposure is an early allow rule can shadow a later intended restriction in an ordered policy.

Ambiguous logical-to-device mappings can cause inconsistent deployment across branches. That consequence is more specific to a policy package includes two similarly named interface mappings and engineers are unsure which target uses each one. For this case, the most direct exposure is an early allow rule can shadow a later intended restriction in an ordered policy.

Leaving legacy group members can preserve unauthorized access after server decommissioning. That consequence is more specific to a shared policy contains an address group with one obsolete member that could allow traffic to a retired server. For this case, the most direct exposure is an early allow rule can shadow a later intended restriction in an ordered policy.

FortiManager system resource and process diagnostics isolate management-plane performance faults. This mechanism instead applies when the FortiManager GUI becomes slow while CPU usage spikes during a large scheduled operation. The current correction relies on FortiManager troubleshooting combines task, system and process-level information.

Device identity and assignment reconciliation are part of supported managed FortiGate recovery. This mechanism instead applies when a firewall replacement boots successfully, yet FortiManager continues sending tasks to the failed old serial. The current correction relies on FortiManager troubleshooting combines task, system and process-level information.

FortiManager depends on available persistent storage for configuration databases and operational records. This mechanism instead applies when a FortiManager VM approaches full disk capacity after accumulating backups and operational logs. The current correction relies on FortiManager troubleshooting combines task, system and process-level information.

Deleting objects referenced elsewhere can break policy packages or installation validation. That consequence is more specific to an object cleanup plan proposes deleting all address objects that are not shown in the first policy table. For this case, the most direct exposure is ambiguous logical-to-device mappings can cause inconsistent deployment across branches.

Reusing one static subnet for all branches can apply policy to the wrong address space. That consequence is more specific to a policy rule references the same named address object but the underlying subnet differs at two branches. For this case, the most direct exposure is ambiguous logical-to-device mappings can cause inconsistent deployment across branches.

A broadly targeted rule can unintentionally alter gateways outside the change scope. That consequence is more specific to a policy administrator copies a new rule but forgets to identify which FortiGate devices should receive it. For this case, the most direct exposure is ambiguous logical-to-device mappings can cause inconsistent deployment across branches.

The corrected object validates and the intended package installs without the unsupported field. That observation is relevant for the separate case an installation task fails during object-copy processing because the target device rejects an unsupported security profile field. Here the decisive evidence is the pilot validates the intended object references and application behavior.

Successful targets remain confirmed and the corrected branch passes a separate retry. That observation is relevant for the separate case an installation fails on one branch and the administrator assumes every target in the batch failed. Here the decisive evidence is the pilot validates the intended object references and application behavior.

Integrity diagnostics finish without relevant errors before normal management tasks resume. That observation is relevant for the separate case a sudden power failure occurs during FortiManager database writes and later operations report storage corruption. Here the decisive evidence is the pilot validates the intended object references and application behavior.