FortiManager discovery relies on a functioning approved device management communication path. This mechanism instead applies when a device registration wizard cannot discover a branch gateway because the management path crosses a blocked security segment. The current correction relies on onboarding imports existing device state into FortiManager's device management database.

Device registration associates each FortiGate with an ADOM and its delegated policy database. This mechanism instead applies when an administrator imports a FortiGate into the wrong tenant ADOM and later notices a policy scope mismatch. The current correction relies on onboarding imports existing device state into FortiManager's device management database.

FortiManager device groups simplify inventory organization within an administrative domain. This mechanism instead applies when an MSP needs to filter the device inventory by business unit for maintenance without creating a new ADOM. The current correction relies on onboarding imports existing device state into FortiManager's device management database.

Check the ADOM revision list instead of inferring revisions from completed installation tasks. This can be appropriate when a policy change is made and deployed but the team forgets whether it created a new ADOM snapshot. It does not directly address the present situation, where the required correction is lock the required ADOM revision against automatic deletion under the supported retention settings.

Identify the device-level revision or configuration retrieval appropriate to the interface change. This can be appropriate when an engineer attempts to use an ADOM revision to roll back an out-of-band interface change on one firewall. It does not directly address the present situation, where the required correction is lock the required ADOM revision against automatic deletion under the supported retention settings.

Inspect ADOM revision metadata including author, timestamp and comments. This can be appropriate when a SOC team asks who created a policy baseline revision before a high-risk maintenance event. It does not directly address the present situation, where the required correction is lock the required ADOM revision against automatic deletion under the supported retention settings.

Creating a global package without assignment leaves local policies unchanged. That consequence is more specific to a global policy is created in FortiManager but is not visible when installing a tenant ADOM package. For this case, the most direct exposure is overbroad global policy assignment can change unrelated customer traffic decisions.

Without checking the insertion block, teams may misunderstand rule precedence between global and local policy. That consequence is more specific to a FortiManager Global Database policy must allow tenant-specific firewall rules to be inserted between corporate baselines. For this case, the most direct exposure is overbroad global policy assignment can change unrelated customer traffic decisions.

Incorrect global footer ordering can make intended postlocal enforcement ineffective. That consequence is more specific to a service provider needs global mandatory cleanup rules to appear after a customer's local firewall policy. For this case, the most direct exposure is overbroad global policy assignment can change unrelated customer traffic decisions.

Verify the supported revision retrieval triggers and explicitly retrieve the configuration when needed. This can be appropriate when an engineer assumes FortiManager automatically captures a new device revision immediately after every unsaved local CLI command. It does not directly address the present situation, where the required correction is retrieve fresh device configuration and reconcile it with restored revision history.

Use revision diffs and task history to correlate the before-and-after configuration states. This can be appropriate when a help desk ticket claims a firewall setting vanished after a central install and asks for the responsible change. It does not directly address the present situation, where the required correction is retrieve fresh device configuration and reconcile it with restored revision history.

Run a supported device configuration retrieval before evaluating the latest device revision. This can be appropriate when a firewall's local administrator modified interface settings during an outage, but central Device Manager did not refresh them. It does not directly address the present situation, where the required correction is retrieve fresh device configuration and reconcile it with restored revision history.

The synchronization check identifies matching versions or concrete differences. That observation is relevant for the separate case an auditor asks whether a FortiManager policy database reflects what is actually running on a managed FortiGate. Here the decisive evidence is the final managed state includes the approved postbackup changes with clear provenance.

The chosen revision preserves the correct VPN and interface topology for the current cluster. That observation is relevant for the separate case a maintenance team finds two revisions that look similar but differ in VPN interfaces used by an HA cluster. Here the decisive evidence is the final managed state includes the approved postbackup changes with clear provenance.

The exact changed setting and relevant installation task are linked in the incident record. That observation is relevant for the separate case a help desk ticket claims a firewall setting vanished after a central install and asks for the responsible change. Here the decisive evidence is the final managed state includes the approved postbackup changes with clear provenance.

The active package targets omit the removed device while the historical task remains attributable. That observation is relevant for the separate case a branch FortiGate is removed from FortiManager but its policy package installation target remains in historical reports. Here the decisive evidence is the ADOM mapping resolves to the real device interface for that target.

The intended interface settings and package mappings both validate after adjustment. That observation is relevant for the separate case an engineer changes a FortiGate interface in Device Manager but expects that change to update all firewall rule objects automatically. Here the decisive evidence is the ADOM mapping resolves to the real device interface for that target.

NTP settings are corrected without changing accepted firewall rule packages. That observation is relevant for the separate case an administrator performs an ADOM database revision rollback to correct a wrong NTP server stored only in a device template. Here the decisive evidence is the ADOM mapping resolves to the real device interface for that target.

Structured application errors must guide automation rather than generic HTTP retry logic. This mechanism instead applies when a FortiManager API integration sees a JSON-RPC application error but retries the identical destructive request indefinitely. The current correction relies on FortiManager administrator profiles govern access for interactive and API-driven operations.

FortiManager API calls require authentication and enforcement of administrator authorization. This mechanism instead applies when a developer sends unauthenticated JSON-RPC requests to manage FortiManager policy packages. The current correction relies on FortiManager administrator profiles govern access for interactive and API-driven operations.

FortiManager API transport status and requested operation outcome are separate signals. This mechanism instead applies when an API client treats every HTTP success response as proof that an installation operation completed successfully. The current correction relies on FortiManager administrator profiles govern access for interactive and API-driven operations.

Validate package ownership, device target and object compatibility before any postmove install. This can be appropriate when an administrator moves a FortiGate to another ADOM and then installs an old package that still contains source-ADOM objects. It does not directly address the present situation, where the required correction is supply the missing target-specific dynamic mapping and revalidate the installation.

Review policy import mapping and resolve unresolved interfaces and objects before accepting the package. This can be appropriate when an engineer imports a FortiGate's existing firewall rules into FortiManager but ignores mapping warnings in the wizard. It does not directly address the present situation, where the required correction is supply the missing target-specific dynamic mapping and revalidate the installation.

Correct the target-specific interface mapping before retrying the failed installation. This can be appropriate when a central policy package validates for one FortiGate but not for another due to a missing interface alias. It does not directly address the present situation, where the required correction is supply the missing target-specific dynamic mapping and revalidate the installation.

Blocked management control traffic prevents registration regardless of IP reachability to other services. That consequence is more specific to a device registration wizard cannot discover a branch gateway because the management path crosses a blocked security segment. For this case, the most direct exposure is successful data forwarding does not demonstrate that FortiManager can manage the device.

Incorrect management addressing prevents discovery even if the firewall's data interfaces are healthy. That consequence is more specific to a new FortiGate cannot contact its FortiManager because the device was configured with the wrong central manager address. For this case, the most direct exposure is successful data forwarding does not demonstrate that FortiManager can manage the device.

Unreviewed import differences can overwrite local configuration or central assumptions. That consequence is more specific to a FortiGate has been discovered, but its import report shows inconsistent settings compared with the planned baseline. For this case, the most direct exposure is successful data forwarding does not demonstrate that FortiManager can manage the device.

The required baseline exists as a separate identifiable ADOM revision. That observation is relevant for the separate case a policy change is made and deployed but the team forgets whether it created a new ADOM snapshot. Here the decisive evidence is the restored ADOM contains expected policies and no unapproved loss of newer objects.

The chosen revision remains listed after the automated retention cleanup runs. That observation is relevant for the separate case an ADOM revision was automatically purged even though the audit team needed to preserve it. Here the decisive evidence is the restored ADOM contains expected policies and no unapproved loss of newer objects.

Required snapshots are preserved and obsolete revisions are pruned according to policy. That observation is relevant for the separate case a multi-tenant FortiManager contains old ADOM revisions consuming retention capacity and no retention policy. Here the decisive evidence is the restored ADOM contains expected policies and no unapproved loss of newer objects.

The adjusted package validates against the affected device's supported FortiOS feature set. That observation is relevant for the separate case a security policy installation repeatedly fails only for a device with a much older FortiOS version. Here the decisive evidence is successful targets remain confirmed and the corrected branch passes a separate retry.

The imported central package includes the required group references with equivalent policy semantics. That observation is relevant for the separate case a policy import appears to finish, but its summary reports missing address groups from the device. Here the decisive evidence is successful targets remain confirmed and the corrected branch passes a separate retry.

A targeted correction succeeds while management database integrity remains verifiable. That observation is relevant for the separate case an operator tries to fix a policy installation error by clearing the FortiManager database immediately. Here the decisive evidence is successful targets remain confirmed and the corrected branch passes a separate retry.