Review and use the Local Domain Policies block between appropriate global header and footer rules. This can be appropriate when a FortiManager Global Database policy must allow tenant-specific firewall rules to be inserted between corporate baselines. It does not directly address the present situation, where the required correction is create a supported Global Database header policy and assign its package to the required ADOMs.

Assign the global policy package explicitly to the intended ADOM or local policy package. This can be appropriate when a global policy is created in FortiManager but is not visible when installing a tenant ADOM package. It does not directly address the present situation, where the required correction is create a supported Global Database header policy and assign its package to the required ADOMs.

Define the mandated object in a supported Global Database scope and retain tenant-specific objects locally. This can be appropriate when a provider wants to share a mandatory address object across customer ADOMs but maintain tenant-specific optional objects. It does not directly address the present situation, where the required correction is create a supported Global Database header policy and assign its package to the required ADOMs.

FortiManager installation compares centrally managed desired state with device-level configuration. This mechanism instead applies when a firewall was modified locally during emergency response and its next central install preview threatens to revert that approved local fix. The current correction relies on installation diagnostics provide error context that guides minimal corrective changes.

Import diagnostics describe which device policy objects were not represented centrally. This mechanism instead applies when a policy import appears to finish, but its summary reports missing address groups from the device. The current correction relies on installation diagnostics provide error context that guides minimal corrective changes.

Effective installation validation requires checking the device state against the central package. This mechanism instead applies when an engineer edits the central policy but an installation task shows the same diff repeatedly despite its claimed success. The current correction relies on installation diagnostics provide error context that guides minimal corrective changes.

Parameterize or prepare approved per-device variables rather than hardcoding one route next hop. This can be appropriate when a team wants different static route values in one generic script for multiple remote branches. It does not directly address the present situation, where the required correction is maintain script version comments, expected changes and an approved dry-run or test plan.

Inspect per-device script execution output and the corresponding Task Monitor record. This can be appropriate when an administrator cannot explain why a CLI script partially applied to one FortiGate. It does not directly address the present situation, where the required correction is maintain script version comments, expected changes and an approved dry-run or test plan.

Acquire the supported ADOM or object lock before creating and saving the shared script. This can be appropriate when an administrator edits a script in workspace mode without first obtaining the required creation or editing lock. It does not directly address the present situation, where the required correction is maintain script version comments, expected changes and an approved dry-run or test plan.

Conflating both HA systems can trigger repairs on the wrong components during incidents. That consequence is more specific to an operations team confuses a FortiManager HA failover with FortiGate Cluster HA packet-forwarding behavior. For this case, the most direct exposure is an HA role transition without usable administrator access may still interrupt operations.

Wrong HA membership can prevent proper synchronization or create an unrelated cluster. That consequence is more specific to a replacement FortiManager is added to an HA cluster with an inconsistent group identifier or peer configuration. For this case, the most direct exposure is an HA role transition without usable administrator access may still interrupt operations.

Waiting for GUI access alone delays diagnosis of a management HA incident. That consequence is more specific to a new administrator needs a CLI confirmation of FortiManager HA state when the graphical interface cannot load. For this case, the most direct exposure is an HA role transition without usable administrator access may still interrupt operations.

Administrative session and lock management require controlled recovery when owners disconnect. This mechanism instead applies when an administrator disconnects while holding an ADOM lock and a peer cannot continue urgent work. The current correction relies on workflow mode adds proposal and approval states to central configuration management.

Workspace locks preserve exclusive edit control during an administrative session. This mechanism instead applies when an administrator tries to edit a locked ADOM while another engineer is performing critical maintenance. The current correction relies on workflow mode adds proposal and approval states to central configuration management.

Some FortiManager operations require an ADOM lock even when individual resource locks are supported. This mechanism instead applies when a team wants to create a new device in an unlocked ADOM while only a different package is locked. The current correction relies on workflow mode adds proposal and approval states to central configuration management.

ADOM upgrades alter the management database version and warrant a recovery checkpoint. This mechanism instead applies when an administrator begins a one-click ADOM upgrade without recording pre-upgrade policy or object state. The current correction relies on FortiManager ADOM schema compatibility follows managed FortiOS versions and support rules.

Installation targets are maintained in ADOM-scoped policy management records. This mechanism instead applies when an administrator expects a FortiGate moved between ADOMs to retain an old package's installation targets automatically. The current correction relies on FortiManager ADOM schema compatibility follows managed FortiOS versions and support rules.

Session monitoring links concurrent administrative activity to resource lock state. This mechanism instead applies when a user needs to identify which administrator session holds a lock before emergency maintenance. The current correction relies on FortiManager ADOM schema compatibility follows managed FortiOS versions and support rules.

Disk utilization returns to a supported level without deleting current management databases. That observation is relevant for the separate case a FortiManager VM approaches full disk capacity after accumulating backups and operational logs. Here the decisive evidence is the staged rollout completes with stable management CPU, memory and disk headroom.

The replacement serial receives the approved policy package and appears online. That observation is relevant for the separate case a firewall replacement boots successfully, yet FortiManager continues sending tasks to the failed old serial. Here the decisive evidence is the staged rollout completes with stable management CPU, memory and disk headroom.

Support evidence identifies the precise subsystem and time of the reproducible fault. That observation is relevant for the separate case an administrator reviews an unfamiliar FortiManager error but only has a screenshot of the management GUI. Here the decisive evidence is the staged rollout completes with stable management CPU, memory and disk headroom.

Users assigned to one customer cannot read or modify another customer's ADOM records. That observation is relevant for the separate case an MSSP wants different customers' FortiGates to have separate object libraries and administrator privileges. Here the decisive evidence is the active session list identifies the owner and the policy package or ADOM being held.

The pre-upgrade revision remains available and the upgraded ADOM opens with expected records. That observation is relevant for the separate case an administrator begins a one-click ADOM upgrade without recording pre-upgrade policy or object state. Here the decisive evidence is the active session list identifies the owner and the policy package or ADOM being held.

System-wide settings are denied to the delegated ADOM operator while ADOM tasks work. That observation is relevant for the separate case a restricted administrative team wants to use only one ADOM but its credentials can still view unrelated system settings. Here the decisive evidence is the active session list identifies the owner and the policy package or ADOM being held.

Remote gateways reach the intended manager and finish authorized device registration. That observation is relevant for the separate case FortiManager is located behind a data-center NAT device, and newly installed remote gateways cannot complete registration. Here the decisive evidence is authorized administrators can sign in and registered devices retain only necessary management flows.

Remote devices remain manageable under expected network conditions and a failure drill follows the documented fallback. That observation is relevant for the separate case a deployment plan uses one FortiManager for all regions but never accounts for branch latency and outage links. Here the decisive evidence is authorized administrators can sign in and registered devices retain only necessary management flows.

A management session is established using the approved reachable endpoint across NAT. That observation is relevant for the separate case a FortiGate behind a branch NAT device cannot establish central management to FortiManager at headquarters. Here the decisive evidence is authorized administrators can sign in and registered devices retain only necessary management flows.

The approved FortiGate appears in the appropriate managed device inventory with healthy management status. That observation is relevant for the separate case a branch FortiGate requests authorization from FortiManager but does not appear among managed devices. Here the decisive evidence is the device establishes its FGFM management connection and becomes eligible for registration.

The group contains the intended devices and scoped operations target that group only. That observation is relevant for the separate case an MSP needs to filter the device inventory by business unit for maintenance without creating a new ADOM. Here the decisive evidence is the device establishes its FGFM management connection and becomes eligible for registration.

The managed device database reflects the current approved interface configuration. That observation is relevant for the separate case an operations engineer expects changes to FortiGate interfaces to appear in Policy & Objects without maintaining the device database. Here the decisive evidence is the device establishes its FGFM management connection and becomes eligible for registration.

Validation resolves the selected profile and the target policy installs without unresolved dependencies. That observation is relevant for the separate case a managed firewall requires IPS protection but the policy package references a profile missing from the ADOM object inventory. Here the decisive evidence is the object usage list identifies all relevant policy references for review.

A policy preview shows the obsolete member removed wherever the group is referenced. That observation is relevant for the separate case a shared policy contains an address group with one obsolete member that could allow traffic to a retired server. Here the decisive evidence is the object usage list identifies all relevant policy references for review.

Policy installation resolves the logical interface to an existing interface or zone on the target. That observation is relevant for the separate case a FortiManager policy package uses a zone name that does not exist on one target FortiGate. Here the decisive evidence is the object usage list identifies all relevant policy references for review.