Missing or delayed keepalives can mark otherwise functioning gateways disconnected. That consequence is more specific to multiple managed FortiGates disconnect periodically but no physical interface alarms exist on FortiManager. For this case, the most direct exposure is a working device management session does not prove internet update service connectivity.

Unbounded concurrent tasks can overwhelm management services and delay policy deployment. That consequence is more specific to a central management appliance exhausts resources during a firmware rollout because all managed devices were scheduled at once. For this case, the most direct exposure is a working device management session does not prove internet update service connectivity.

Incomplete diagnostic evidence can encourage unnecessary broad configuration changes. That consequence is more specific to an administrator reviews an unfamiliar FortiManager error but only has a screenshot of the management GUI. For this case, the most direct exposure is a working device management session does not prove internet update service connectivity.

The device establishes its FGFM management connection and becomes eligible for registration. That observation is relevant for the separate case a new FortiGate cannot contact its FortiManager because the device was configured with the wrong central manager address. Here the decisive evidence is a permitted registration attempt completes after the authorized control path is restored.

The HA cluster inventory contains the correct primary and replacement secondary identities. That observation is relevant for the separate case a FortiGate HA cluster adds a replacement secondary member, but FortiManager still displays the old member inventory. Here the decisive evidence is a permitted registration attempt completes after the authorized control path is restored.

The replacement device is managed under the authorized record with current configuration restored. That observation is relevant for the separate case a FortiGate was replaced after hardware failure, and the new unit is still associated with a stale device identity. Here the decisive evidence is a permitted registration attempt completes after the authorized control path is restored.

FortiManager supports scheduling script runs separately from authoring script content. This mechanism instead applies when a scheduled script changes a network parameter outside an authorized maintenance window. The current correction relies on FortiManager workspace permissions and locking also apply to script authoring workflows.

FortiManager script run targets govern which devices receive the chosen commands. This mechanism instead applies when a support engineer reruns an old script against the entire ADOM instead of the one affected device. The current correction relies on FortiManager workspace permissions and locking also apply to script authoring workflows.

FortiManager scripts apply managed configuration operations across explicitly selected targets. This mechanism instead applies when an engineer plans to change the same NTP server on 60 gateways using manual command-line sessions. The current correction relies on FortiManager workspace permissions and locking also apply to script authoring workflows.

ADOMs separate devices, policy packages, objects and delegated administrative authority. This mechanism instead applies when an MSSP wants different customers' FortiGates to have separate object libraries and administrator privileges. The current correction relies on the device inventory links managed FortiGates to their administrative domains and ownership.

ADOM revisions capture snapshots of policy and object management state. This mechanism instead applies when an ADOM backup was restored but some custom objects appear missing from the active policy view. The current correction relies on the device inventory links managed FortiGates to their administrative domains and ownership.

FortiManager combines per-role permissions with ADOM scoping for access control. This mechanism instead applies when a partner cannot change its delegated device because the assigned administrator profile omits device permissions. The current correction relies on the device inventory links managed FortiGates to their administrative domains and ownership.

Unsupported or unlicensed capacity can interrupt centralized device onboarding. That consequence is more specific to a FortiManager virtual appliance starts but license activation has not been completed. For this case, the most direct exposure is untested backups can create a false recovery guarantee after management-database loss.

Unchanged default administrative access increases the risk of management-plane compromise. That consequence is more specific to an administrator leaves a factory default management account unchanged after initial deployment. For this case, the most direct exposure is untested backups can create a false recovery guarantee after management-database loss.

Leaving factory connectivity settings unchanged can block remote management and platform updates. That consequence is more specific to a newly deployed FortiManager appliance is reachable only through an unplanned factory addressing scheme. For this case, the most direct exposure is untested backups can create a false recovery guarantee after management-database loss.

Eligible FortiGates retrieve current antivirus and IPS packages through the approved local server. That observation is relevant for the separate case a group of isolated FortiGates should retrieve signature updates through a centrally controlled management network instead of each using the internet. Here the decisive evidence is the FortiGuard status confirms active entitlement and successful package retrieval after correction.

Rating queries use the approved FortiGuard endpoint and produce expected replies. That observation is relevant for the separate case a FortiGate downloads antivirus updates but its administrator assumes that proves its web filtering queries are correctly routed. Here the decisive evidence is the FortiGuard status confirms active entitlement and successful package retrieval after correction.

FortiGuard service tests successfully retrieve updates through the approved proxy path. That observation is relevant for the separate case a FortiManager in a restricted site must download FortiGuard updates through an enterprise web proxy. Here the decisive evidence is the FortiGuard status confirms active entitlement and successful package retrieval after correction.

Confirm the installed target policy includes the specified security profile and effective inspection action. This can be appropriate when a new administrator relies on the policy preview alone and fails to verify that an inspection profile is applied after installation. It does not directly address the present situation, where the required correction is use the unused-object analysis and check cross-package references before removal.

Refresh device information and update the dynamic interface mapping to the current interface identity. This can be appropriate when a FortiGate's interface is renamed locally, leaving a centrally managed policy with an outdated interface mapping. It does not directly address the present situation, where the required correction is use the unused-object analysis and check cross-package references before removal.

Configure and validate the target-specific dynamic interface mapping for the policy package. This can be appropriate when a FortiManager policy package uses a zone name that does not exist on one target FortiGate. It does not directly address the present situation, where the required correction is use the unused-object analysis and check cross-package references before removal.

FortiManager global objects distribute common definitions across assigned ADOM policies. This mechanism instead applies when a provider wants to share a mandatory address object across customer ADOMs but maintain tenant-specific optional objects. The current correction relies on global policy assignment depends on supported version relationships across databases.

Global policy header sections precede inserted local ADOM policy rules after assignment. This mechanism instead applies when an enterprise requires every tenant ADOM policy to start with centrally mandated deny rules. The current correction relies on global policy assignment depends on supported version relationships across databases.

Global package assembly inserts ADOM rules into a reserved local-policy block. This mechanism instead applies when a FortiManager Global Database policy must allow tenant-specific firewall rules to be inserted between corporate baselines. The current correction relies on global policy assignment depends on supported version relationships across databases.

Policy installation resolves the logical interface to an existing interface or zone on the target. That observation is relevant for the separate case a FortiManager policy package uses a zone name that does not exist on one target FortiGate. Here the decisive evidence is deployment substitutes the expected site-specific values without changing the shared rule structure.

The FortiGate running configuration and controlled traffic reflect the intended inspection behavior. That observation is relevant for the separate case a new administrator relies on the policy preview alone and fails to verify that an inspection profile is applied after installation. Here the decisive evidence is deployment substitutes the expected site-specific values without changing the shared rule structure.

The matching traffic hits the reviewed deny rule before broader permission is considered. That observation is relevant for the separate case a security engineer adds a deny rule under a broad permissive rule but sees no change in traffic decisions. Here the decisive evidence is deployment substitutes the expected site-specific values without changing the shared rule structure.

Workspace locking and workflow approval serve different governance functions. This mechanism instead applies when an engineer claims workspace and workflow modes are identical and chooses the mode without considering approval needs. The current correction relies on FortiManager supports applying workspace or workflow settings at appropriate ADOM scopes.

Workflow mode adds proposal and approval states to central configuration management. This mechanism instead applies when an operator enables workflow mode and immediately installs a policy package without submitting the session for approval. The current correction relies on FortiManager supports applying workspace or workflow settings at appropriate ADOM scopes.

Workspace locks serialize supported configuration edits on shared policy resources. This mechanism instead applies when two administrators edit one FortiManager policy package simultaneously and overwrite each other's work. The current correction relies on FortiManager supports applying workspace or workflow settings at appropriate ADOM scopes.

Disk utilization returns to a supported level without deleting current management databases. That observation is relevant for the separate case a FortiManager VM approaches full disk capacity after accumulating backups and operational logs. Here the decisive evidence is integrity reports pass and subsequent package operations complete without database faults.

Support evidence identifies the precise subsystem and time of the reproducible fault. That observation is relevant for the separate case an administrator reviews an unfamiliar FortiManager error but only has a screenshot of the management GUI. Here the decisive evidence is integrity reports pass and subsequent package operations complete without database faults.

Collected diagnostics identify the component responsible or justify the controlled restart. That observation is relevant for the separate case an operator sees high memory usage but immediately reboots FortiManager without collecting diagnostic evidence. Here the decisive evidence is integrity reports pass and subsequent package operations complete without database faults.