An administrator wants to create a policy on an ADOM that is in backup mode and install it on a FortiGate device in the same ADOM. How can the administrator perform this task?
A.
The administrator must use the Policy & Objects section to create a policy first.
B.
The administrator must use a FortiManager script.
C.
The administrator must disable the FortiManager offline mode first.
D.
The administrator must change the ADOM mode to Advanced to bring the FortiManager online.
The official documentation of FortiManager indicates that when an ADOM is in backup mode (offline mode), you cannot use the regular "Policy & Objects" + "Install Wizard" workflow to apply changes to FortiGate. The only way to push configurations to devices is through scripts. This includes, among other things, creating or modifying firewall rules (policies) directly in the CLI of the managed FortiGate.
How is this actually done with a script?
A script in FortiManager can contain CLI commands that will execute on the FortiGate, for example:
config firewall policy
edit 100
set name "Mi-Policy-desde-Script"
set srcintf "port1"
set dstintf "port2"
set srcaddr "all"
set dstaddr "all"
set action accept
set schedule "always"
set service "ALL"
next
end
When running this script from FortiManager (even with the ADOM in backup mode) against the FortiGate, the policy is effectively created on the device. It is not the usual "graphical" procedure (you won't see it in the ADOM's "offline" policy database), but in practice you are installing (or modifying) a policy on the FortiGate.
"To make configuration changes from FortiManager to managed devices while in backup mode, you must use the script feature." - page 43 of FMG study guide
A is false, as no conf changes possible using policy package panel when in backup mode
C is false, as there is no relationship between offline mode and this case
D is false as no relationship here too
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
darco
1 month, 1 week agopfeast420
2 months, 2 weeks agoLAFNELL
5 months, 1 week agoNightwolf33
5 months, 1 week agoeamstar
5 months, 2 weeks agoYgrec
5 months, 2 weeks agoYgrec
5 months, 2 weeks agoMahfoud_31
5 months, 3 weeks agoBIGFATNUTS
5 months, 4 weeks ago