Unsupported template commands can cause partial provisioning and configuration drift. That consequence is more specific to a team attempts to provision an unsupported FortiGate model with a template built for a different firmware family. For this case, the most direct exposure is manual per-device settings lead to unnoticed configuration drift among branches.

Duplicate model identity metadata can cause ambiguous registration and provisioning results. That consequence is more specific to an offline branch uses a model device entry, but two appliances share a reused blueprint identifier in a batch import. For this case, the most direct exposure is manual per-device settings lead to unnoticed configuration drift among branches.

An incorrect identity match may leave the intended blueprint unused or applied incorrectly. That consequence is more specific to an offline model device has no known serial number and the selected onboarding method requires a serial match. For this case, the most direct exposure is manual per-device settings lead to unnoticed configuration drift among branches.

Create or reconcile the appropriate supported security profile reference before policy installation. This can be appropriate when a managed firewall requires IPS protection but the policy package references a profile missing from the ADOM object inventory. It does not directly address the present situation, where the required correction is compare the complete policy matching criteria and security actions before consolidating.

Inspect package installation status and compare the intended central and installed revisions. This can be appropriate when an imported firewall policy package is marked modified after central editing but the operator assumes the target is synchronized. It does not directly address the present situation, where the required correction is compare the complete policy matching criteria and security actions before consolidating.

Review the per-policy or package installation targets before scheduling the change. This can be appropriate when a policy administrator copies a new rule but forgets to identify which FortiGate devices should receive it. It does not directly address the present situation, where the required correction is compare the complete policy matching criteria and security actions before consolidating.

FortiGuard service and license indicators confirm the selected host can distribute updates. That observation is relevant for the separate case a FortiManager-VM trial license is deployed as a local FortiGuard server for dozens of production devices. Here the decisive evidence is eligible FortiGates retrieve current antivirus and IPS packages through the approved local server.

Rating queries use the approved FortiGuard endpoint and produce expected replies. That observation is relevant for the separate case a FortiGate downloads antivirus updates but its administrator assumes that proves its web filtering queries are correctly routed. Here the decisive evidence is eligible FortiGates retrieve current antivirus and IPS packages through the approved local server.

The local package list refreshes and downstream clients receive the intended version. That observation is relevant for the separate case a FortiManager local FDS reports old IPS packages despite FortiGate clients being able to reach it. Here the decisive evidence is eligible FortiGates retrieve current antivirus and IPS packages through the approved local server.

Use revision diffs and task history to correlate the before-and-after configuration states. This can be appropriate when a help desk ticket claims a firewall setting vanished after a central install and asks for the responsible change. It does not directly address the present situation, where the required correction is verify the supported revision retrieval triggers and explicitly retrieve the configuration when needed.

Compare revisions to isolate the affected object and use a scoped approved recovery action. This can be appropriate when after a configuration outage, an engineer wants to restore one changed object but proposes replacing all FortiManager device records. It does not directly address the present situation, where the required correction is verify the supported revision retrieval triggers and explicitly retrieve the configuration when needed.

Run a supported device configuration retrieval before evaluating the latest device revision. This can be appropriate when a firewall's local administrator modified interface settings during an outage, but central Device Manager did not refresh them. It does not directly address the present situation, where the required correction is verify the supported revision retrieval triggers and explicitly retrieve the configuration when needed.

Inspect ADOM policy validity independently from the device-level configuration synchronization indicator. This can be appropriate when a managed FortiGate reports a policy-check warning while its device configuration status appears healthy. It does not directly address the present situation, where the required correction is retrieve the current device configuration and decide whether to adopt or replace the local difference.

Review and clean up approved package target associations and retain audit history as required. This can be appropriate when a branch FortiGate is removed from FortiManager but its policy package installation target remains in historical reports. It does not directly address the present situation, where the required correction is retrieve the current device configuration and decide whether to adopt or replace the local difference.

Target the responsible system template or device database layer rather than rolling back unrelated policies. This can be appropriate when an administrator performs an ADOM database revision rollback to correct a wrong NTP server stored only in a device template. It does not directly address the present situation, where the required correction is retrieve the current device configuration and decide whether to adopt or replace the local difference.

A syntactically valid central rule may still be ineffective if its profile is not deployed correctly. That consequence is more specific to a new administrator relies on the policy preview alone and fails to verify that an inspection profile is applied after installation. For this case, the most direct exposure is mistaking a modified package for an installed one leaves new controls inactive.

Ambiguous logical-to-device mappings can cause inconsistent deployment across branches. That consequence is more specific to a policy package includes two similarly named interface mappings and engineers are unsure which target uses each one. For this case, the most direct exposure is mistaking a modified package for an installed one leaves new controls inactive.

Persistent emergency broad access creates long-lived unintended exposure. That consequence is more specific to a security review finds a policy package has an unapproved accept-any temporary rule left from testing. For this case, the most direct exposure is mistaking a modified package for an installed one leaves new controls inactive.

Use the supported FortiGate HA cluster onboarding process and confirm member identities. This can be appropriate when two new FortiGates in a high-availability pair are being registered independently with conflicting configuration records. It does not directly address the present situation, where the required correction is enable or execute the supported device configuration retrieval and revision retention workflow.

Organize eligible FortiGates into appropriate device groups inside the existing authorized ADOM. This can be appropriate when an MSP needs to filter the device inventory by business unit for maintenance without creating a new ADOM. It does not directly address the present situation, where the required correction is enable or execute the supported device configuration retrieval and revision retention workflow.

Refresh cluster discovery and verify the member serials and HA topology in Device Manager. This can be appropriate when a FortiGate HA cluster adds a replacement secondary member, but FortiManager still displays the old member inventory. It does not directly address the present situation, where the required correction is enable or execute the supported device configuration retrieval and revision retention workflow.

Apply narrowly scoped per-policy installation targeting for that sensitive rule. This can be appropriate when a security team wants a single policy package to serve three device populations, but only two are approved for a sensitive rule. It does not directly address the present situation, where the required correction is refresh device information and update the dynamic interface mapping to the current interface identity.

Use FortiManager object reference and usage views before making the change. This can be appropriate when a company has multiple address objects with similar labels and needs to understand which rules reference one object. It does not directly address the present situation, where the required correction is refresh device information and update the dynamic interface mapping to the current interface identity.

Retrieve or refresh supported policy hit-count information before considering cleanup. This can be appropriate when a network team wants to compare expected policy use across several branches but never reviews rule hit counts. It does not directly address the present situation, where the required correction is refresh device information and update the dynamic interface mapping to the current interface identity.

No fallback route may leave update and rating lookups unavailable during a private server outage. That consequence is more specific to a managed firewall is configured to query a private FortiGuard service but the local FDS is unreachable during an outage. For this case, the most direct exposure is ignoring the site's proxy requirement can prevent the local server from refreshing updates.

Expired FortiGuard rights can block expected content even when transport connectivity works. That consequence is more specific to an operator sees FortiGuard license-expired warnings but continues treating signature download failures as network-only issues. For this case, the most direct exposure is ignoring the site's proxy requirement can prevent the local server from refreshing updates.

Trial FortiManager VM limitations can make the planned local FortiGuard service unavailable. That consequence is more specific to a FortiManager-VM trial license is deployed as a local FortiGuard server for dozens of production devices. For this case, the most direct exposure is ignoring the site's proxy requirement can prevent the local server from refreshing updates.

Review disk usage and retention settings and remove only approved obsolete data. This can be appropriate when a FortiManager VM approaches full disk capacity after accumulating backups and operational logs. It does not directly address the present situation, where the required correction is collect relevant Task Monitor details, system logs and supported debug output for the failing operation.

Test outbound FortiGuard and proxy connectivity independently of FGFM device sessions. This can be appropriate when a FortiManager cannot download updates after a proxy configuration change, while device management over FGFM remains healthy. It does not directly address the present situation, where the required correction is collect relevant Task Monitor details, system logs and supported debug output for the failing operation.

Review FGFM keepalive messages, session health and management path stability. This can be appropriate when multiple managed FortiGates disconnect periodically but no physical interface alarms exist on FortiManager. It does not directly address the present situation, where the required correction is collect relevant Task Monitor details, system logs and supported debug output for the failing operation.

Separate unmanaged records for one HA pair can create inconsistent member targeting. That consequence is more specific to two new FortiGates in a high-availability pair are being registered independently with conflicting configuration records. For this case, the most direct exposure is incorrect management addressing prevents discovery even if the firewall's data interfaces are healthy.

Unreviewed import differences can overwrite local configuration or central assumptions. That consequence is more specific to a FortiGate has been discovered, but its import report shows inconsistent settings compared with the planned baseline. For this case, the most direct exposure is incorrect management addressing prevents discovery even if the firewall's data interfaces are healthy.

Incorrect ADOM membership can expose customer configuration to unrelated administrators. That consequence is more specific to an administrator imports a FortiGate into the wrong tenant ADOM and later notices a policy scope mismatch. For this case, the most direct exposure is incorrect management addressing prevents discovery even if the firewall's data interfaces are healthy.