FortiManager script operations can execute target-device CLI commands for maintenance and diagnosis. This mechanism instead applies when a network engineer needs a controlled one-time diagnostic command across several managed firewalls without saving a permanent policy. The current correction relies on device database and template authority may reapply settings during installation.

FortiManager script run targets govern which devices receive the chosen commands. This mechanism instead applies when a support engineer reruns an old script against the entire ADOM instead of the one affected device. The current correction relies on device database and template authority may reapply settings during installation.

Script execution uses target-device command syntax and must account for product versions. This mechanism instead applies when a FortiManager script succeeds on one test firewall but fails on an older FortiOS version in another site. The current correction relies on device database and template authority may reapply settings during installation.

The cleanup removes only objects with no required references across the appropriate scope. That observation is relevant for the separate case an object cleanup plan proposes deleting all address objects that are not shown in the first policy table. Here the decisive evidence is validation and test traffic show the FQDN object matches only the intended authorized destination.

Validation resolves the selected profile and the target policy installs without unresolved dependencies. That observation is relevant for the separate case a managed firewall requires IPS protection but the policy package references a profile missing from the ADOM object inventory. Here the decisive evidence is validation and test traffic show the FQDN object matches only the intended authorized destination.

Policy records carry the intended owner attribute and it appears in reporting or review. That observation is relevant for the separate case a global IT team needs to record the business owner of each firewall policy for later audit. Here the decisive evidence is validation and test traffic show the FQDN object matches only the intended authorized destination.

Compare device revision and ADOM revision views separately for the relevant change. This can be appropriate when a security analyst confuses a device configuration revision with an ADOM policy database revision. It does not directly address the present situation, where the required correction is compare the selected snapshot against the current ADOM and approve a scoped restoration plan.

Lock the required ADOM revision against automatic deletion under the supported retention settings. This can be appropriate when an ADOM revision was automatically purged even though the audit team needed to preserve it. It does not directly address the present situation, where the required correction is compare the selected snapshot against the current ADOM and approve a scoped restoration plan.

Configure a documented revision retention strategy while locking legally required checkpoints. This can be appropriate when a multi-tenant FortiManager contains old ADOM revisions consuming retention capacity and no retention policy. It does not directly address the present situation, where the required correction is compare the selected snapshot against the current ADOM and approve a scoped restoration plan.

FortiManager can reinstall an existing managed package when the device requires resynchronization. This mechanism instead applies when a production gateway has an approved policy package that needs reinstallation after an out-of-band device restore. The current correction relies on configuration deployment and functional policy acceptance are separate verification stages.

FortiManager install preview makes targeted configuration changes visible before deployment. This mechanism instead applies when a policy installation preview displays unexpected changes to DNS configuration on a target firewall. The current correction relies on configuration deployment and functional policy acceptance are separate verification stages.

Install Wizard validation reports target-specific problems requiring corrective action. This mechanism instead applies when a FortiManager installation task fails at its validation stage but the operator retries unchanged settings repeatedly. The current correction relies on configuration deployment and functional policy acceptance are separate verification stages.

The target ADOM appears after compatible version planning and the global policy can be assigned. That observation is relevant for the separate case an ADOM is absent from the global-policy assignment dialog after its FortiOS version was upgraded. Here the decisive evidence is each intended tenant receives the global object without losing its local object isolation.

The resulting policy preview places local tenant rules within the designated insertion section. That observation is relevant for the separate case a FortiManager Global Database policy must allow tenant-specific firewall rules to be inserted between corporate baselines. Here the decisive evidence is each intended tenant receives the global object without losing its local object isolation.

The chosen package has one valid global assignment and policy installation validates. That observation is relevant for the separate case an administrator attempts to assign two separate global policy packages to one individual local policy package simultaneously. Here the decisive evidence is each intended tenant receives the global object without losing its local object isolation.

Include administrator access and management-task continuity in the HA acceptance plan. This can be appropriate when an enterprise plans to test FortiManager HA but has not checked how administrative sessions reconnect to the promoted unit. It does not directly address the present situation, where the required correction is distinguish management-server continuity checks from gateway traffic-path failover testing.

Align the HA group and peer membership settings to the approved cluster design. This can be appropriate when a replacement FortiManager is added to an HA cluster with an inconsistent group identifier or peer configuration. It does not directly address the present situation, where the required correction is distinguish management-server continuity checks from gateway traffic-path failover testing.

Configure a supported FortiManager HA pair with proper primary and secondary members. This can be appropriate when two FortiManager appliances must protect centralized policy administration from a single management-server failure. It does not directly address the present situation, where the required correction is distinguish management-server continuity checks from gateway traffic-path failover testing.

Save, submit or discard the session according to change policy and release the lock. This can be appropriate when a policy author leaves an uncommitted workspace session open during a long absence. It does not directly address the present situation, where the required correction is identify the abandoned session and use the approved lock-release procedure with change recovery.

Check whether the device can be locked independently under the configured workspace and ADOM mode. This can be appropriate when a managed device requires a local interface correction, but the policy package is locked by another administrator. It does not directly address the present situation, where the required correction is identify the abandoned session and use the approved lock-release procedure with change recovery.

Obtain the ADOM-level lock required for device creation under the relevant workspace configuration. This can be appropriate when a team wants to create a new device in an unlocked ADOM while only a different package is locked. It does not directly address the present situation, where the required correction is identify the abandoned session and use the approved lock-release procedure with change recovery.

The intended branches enforce the same approved rules with their correct local mappings. That observation is relevant for the separate case a company needs a consistent internet-access rule set across six FortiGate branches with distinct device addresses. Here the decisive evidence is the target firewall reports the installed policy revision containing the intended rule.

The matching traffic hits the reviewed deny rule before broader permission is considered. That observation is relevant for the separate case a security engineer adds a deny rule under a broad permissive rule but sees no change in traffic decisions. Here the decisive evidence is the target firewall reports the installed policy revision containing the intended rule.

Installation preview includes the sensitive rule only on the two approved populations. That observation is relevant for the separate case a security team wants a single policy package to serve three device populations, but only two are approved for a sensitive rule. Here the decisive evidence is the target firewall reports the installed policy revision containing the intended rule.

Device and ADOM states converge to the reviewed expected policy and system configuration. That observation is relevant for the separate case a device was restored from backup and now has an older configuration than the FortiManager ADOM package. Here the decisive evidence is the report correctly identifies that local device settings are current but a central policy install remains pending.

The approved route is represented consistently in the authoritative device database. That observation is relevant for the separate case a FortiManager Device Manager dashboard reports an out-of-sync device configuration after a local FortiGate administrator made a route change. Here the decisive evidence is the report correctly identifies that local device settings are current but a central policy install remains pending.

The corrected policy passes validation and existing device status remains accurately tracked. That observation is relevant for the separate case a managed FortiGate reports a policy-check warning while its device configuration status appears healthy. Here the decisive evidence is the report correctly identifies that local device settings are current but a central policy install remains pending.

Scope the global package assignment to the explicitly approved tenant policy targets. This can be appropriate when a global policy rule is deployed to one customer, but another tenant's policy installation should remain unaffected. It does not directly address the present situation, where the required correction is assign the global policy package explicitly to the intended ADOM or local policy package.

Define the mandated object in a supported Global Database scope and retain tenant-specific objects locally. This can be appropriate when a provider wants to share a mandatory address object across customer ADOMs but maintain tenant-specific optional objects. It does not directly address the present situation, where the required correction is assign the global policy package explicitly to the intended ADOM or local policy package.

Create a supported Global Database header policy and assign its package to the required ADOMs. This can be appropriate when an enterprise requires every tenant ADOM policy to start with centrally mandated deny rules. It does not directly address the present situation, where the required correction is assign the global policy package explicitly to the intended ADOM or local policy package.

Effective policy acceptance requires checking the installed device behavior, not only saved configuration. This mechanism instead applies when a new administrator relies on the policy preview alone and fails to verify that an inspection profile is applied after installation. The current correction relies on FortiManager policy management depends on consistent object and security-profile references.

Dynamic objects resolve device-specific values from a common FortiManager policy object. This mechanism instead applies when a policy rule references the same named address object but the underlying subnet differs at two branches. The current correction relies on FortiManager policy management depends on consistent object and security-profile references.

Dynamic interface mapping adapts a shared logical interface to specific FortiGate interfaces. This mechanism instead applies when a FortiManager policy package uses a zone name that does not exist on one target FortiGate. The current correction relies on FortiManager policy management depends on consistent object and security-profile references.