Reconcile imported objects and dynamic mappings against the destination network topology. This can be appropriate when an administrator copies a policy rule from another ADOM without updating addresses for the new location. It does not directly address the present situation, where the required correction is create or reconcile the appropriate supported security profile reference before policy installation.

Inspect package installation status and compare the intended central and installed revisions. This can be appropriate when an imported firewall policy package is marked modified after central editing but the operator assumes the target is synchronized. It does not directly address the present situation, where the required correction is create or reconcile the appropriate supported security profile reference before policy installation.

Refresh device information and update the dynamic interface mapping to the current interface identity. This can be appropriate when a FortiGate's interface is renamed locally, leaving a centrally managed policy with an outdated interface mapping. It does not directly address the present situation, where the required correction is create or reconcile the appropriate supported security profile reference before policy installation.

Inspect ADOM policy validity independently from the device-level configuration synchronization indicator. This can be appropriate when a managed FortiGate reports a policy-check warning while its device configuration status appears healthy. It does not directly address the present situation, where the required correction is review device database synchronization and pending ADOM package changes as separate conditions.

Compare device-level interface inventory with the policy's dynamic interface mapping entries. This can be appropriate when a FortiGate uses a different interface alias than the central ADOM policy expects. It does not directly address the present situation, where the required correction is review device database synchronization and pending ADOM package changes as separate conditions.

Confirm whether the object has been installed in the relevant policy package and target device. This can be appropriate when a new policy object is created in an ADOM but the managed FortiGate still shows the original object value. It does not directly address the present situation, where the required correction is review device database synchronization and pending ADOM package changes as separate conditions.

Use the supported FortiGate HA cluster onboarding process and confirm member identities. This can be appropriate when two new FortiGates in a high-availability pair are being registered independently with conflicting configuration records. It does not directly address the present situation, where the required correction is refresh cluster discovery and verify the member serials and HA topology in Device Manager.

Review pending device authorization and approve the intended serial number into its correct ADOM. This can be appropriate when a branch FortiGate requests authorization from FortiManager but does not appear among managed devices. It does not directly address the present situation, where the required correction is refresh cluster discovery and verify the member serials and HA topology in Device Manager.

Use the supported device-replacement or registration workflow and reconcile the new serial record. This can be appropriate when a FortiGate was replaced after hardware failure, and the new unit is still associated with a stale device identity. It does not directly address the present situation, where the required correction is refresh cluster discovery and verify the member serials and HA topology in Device Manager.

Recognize Backup mode as read-only central storage and use a supported device-side change workflow. This can be appropriate when an administrator attempts to modify a managed FortiGate through an ADOM configured in Backup mode. It does not directly address the present situation, where the required correction is inspect restored ADOM revision contents and verify that the intended revision was selected.

Create an ADOM revision and validate its upgrade prerequisites before changing ADOM version. This can be appropriate when an administrator begins a one-click ADOM upgrade without recording pre-upgrade policy or object state. It does not directly address the present situation, where the required correction is inspect restored ADOM revision contents and verify that the intended revision was selected.

Reconcile serial numbers and registered device assignments against the ADOM device inventory. This can be appropriate when an organization operates hundreds of managed devices but cannot determine which FortiManager ADOM is responsible for an orphaned gateway. It does not directly address the present situation, where the required correction is inspect restored ADOM revision contents and verify that the intended revision was selected.

Centralized address objects require ongoing validation of their underlying resources. This mechanism instead applies when an administrator prepares a policy package that contains an object referencing a deleted FQDN resource. The current correction relies on policy reuse requires object and interface compatibility in the receiving ADOM.

Firewall policy equivalence depends on the full match and action configuration. This mechanism instead applies when a security analyst finds two policies with identical source and destination but different services and assumes one is redundant. The current correction relies on policy reuse requires object and interface compatibility in the receiving ADOM.

FortiManager policy targets depend on current device interface information. This mechanism instead applies when a FortiGate's interface is renamed locally, leaving a centrally managed policy with an outdated interface mapping. The current correction relies on policy reuse requires object and interface compatibility in the receiving ADOM.

FortiManager can perform core management in environments with restricted external connectivity. This mechanism instead applies when a deployment in a restricted network has no direct internet access but needs centrally managed device configuration. The current correction relies on FortiManager cloud-service connectivity can depend on DNS as well as network routing.

Certificate validation protects the identity of a privileged management interface. This mechanism instead applies when a new FortiManager installation receives an unexpected system certificate warning from an administrator workstation. The current correction relies on FortiManager cloud-service connectivity can depend on DNS as well as network routing.

Initial FortiManager provisioning establishes network prerequisites for secure centralized administration. This mechanism instead applies when a newly deployed FortiManager appliance is reachable only through an unplanned factory addressing scheme. The current correction relies on FortiManager cloud-service connectivity can depend on DNS as well as network routing.

Exhausted storage can prevent database writes, backups or installation task records. That consequence is more specific to a FortiManager VM approaches full disk capacity after accumulating backups and operational logs. For this case, the most direct exposure is retired device mappings can strand the replacement without current central security settings.

Unbounded concurrent tasks can overwhelm management services and delay policy deployment. That consequence is more specific to a central management appliance exhausts resources during a firmware rollout because all managed devices were scheduled at once. For this case, the most direct exposure is retired device mappings can strand the replacement without current central security settings.

Continuing to write on a corrupt management filesystem can worsen data loss. That consequence is more specific to after unexpected power loss, FortiManager displays inconsistent database errors in installation tasks. For this case, the most direct exposure is retired device mappings can strand the replacement without current central security settings.

The arriving unit matches its model record and receives the planned baseline configuration. That observation is relevant for the separate case an organization wants to preconfigure a FortiGate before hardware reaches a remote branch. Here the decisive evidence is each target receives equivalent intended settings mapped to its own interface and platform capabilities.

Template-assigned devices show the intended common system settings after deployment. That observation is relevant for the separate case a fleet of branch appliances requires identical DNS and NTP settings but is being configured by hand on every unit. Here the decisive evidence is each target receives equivalent intended settings mapped to its own interface and platform capabilities.

The registered device belongs to the authorized tenant and its package targets have been reviewed. That observation is relevant for the separate case an administrator imports a FortiGate into the wrong tenant ADOM and later notices a policy scope mismatch. Here the decisive evidence is each target receives equivalent intended settings mapped to its own interface and platform capabilities.

Review the import failure detail and repair the mapped logical interface before reimport. This can be appropriate when a policy import reports an unresolved interface object after a FortiGate interface was renamed. It does not directly address the present situation, where the required correction is reconcile the missing dependency from the import report before replacing the existing managed package.

Retrieve current device changes and reconcile them with the central database before installing. This can be appropriate when a firewall was modified locally during emergency response and its next central install preview threatens to revert that approved local fix. It does not directly address the present situation, where the required correction is reconcile the missing dependency from the import report before replacing the existing managed package.

Identify the named dependency from the failed task and correct only that referenced object. This can be appropriate when a FortiManager operator sees an install log error mentioning a missing dependency but attempts to change unrelated interface settings. It does not directly address the present situation, where the required correction is reconcile the missing dependency from the import report before replacing the existing managed package.

Management HA takeover quality depends on database convergence and healthy peer state. This mechanism instead applies when a maintenance window requires promoting a secondary FortiManager with unconfirmed synchronized policy data. The current correction relies on FortiManager exposes the same essential HA health information through CLI diagnostics.

FortiManager HA protects the management plane whereas FortiGate HA protects forwarding service. This mechanism instead applies when an operations team confuses a FortiManager HA failover with FortiGate Cluster HA packet-forwarding behavior. The current correction relies on FortiManager exposes the same essential HA health information through CLI diagnostics.

FortiManager HA cluster status reflects heartbeat reception from configured peers. This mechanism instead applies when a FortiManager HA secondary has stopped receiving heartbeat packets but the primary remains online. The current correction relies on FortiManager exposes the same essential HA health information through CLI diagnostics.

Confirm whether the object has been installed in the relevant policy package and target device. This can be appropriate when a new policy object is created in an ADOM but the managed FortiGate still shows the original object value. It does not directly address the present situation, where the required correction is recreate and validate destination ADOM dynamic mappings against actual managed device data.

Compare device-level interface inventory with the policy's dynamic interface mapping entries. This can be appropriate when a FortiGate uses a different interface alias than the central ADOM policy expects. It does not directly address the present situation, where the required correction is recreate and validate destination ADOM dynamic mappings against actual managed device data.

Reconcile interface-level device database edits with dependent policy interface mappings. This can be appropriate when an engineer changes a FortiGate interface in Device Manager but expects that change to update all firewall rule objects automatically. It does not directly address the present situation, where the required correction is recreate and validate destination ADOM dynamic mappings against actual managed device data.