FortiManager Integration Steps for FortiGate Centralized Management
An administrator is configuring a FortiGate to use FortiManager for centralized management. Which three steps are required?
Quick Answer
The answer is ensuring network connectivity between the FortiGate and FortiManager on TCP port 541, followed by discovering the FortiGate and then authorizing it. This sequence is critical because the FortiGate-FortiManager (FGFM) protocol relies on TCP 541 for secure communication; without this port open, the FortiGate cannot be discovered or managed. After discovery, the administrator must explicitly authorize the device in the FortiManager GUI under Device Manager > Unregistered Devices, a mandatory step that establishes a trusted management relationship—without it, the FortiGate remains unmanaged and cannot receive configuration or policy updates. On the Fortinet NSE 4 exam, this tests your understanding of centralized management workflows, often appearing as a multi-step scenario where a common trap is assuming discovery alone is sufficient. Remember the memory tip: “Connect, Discover, Authorize”—or “CDA”—to lock in the three required steps for FortiManager integration.
⚠ Common exam trap
Many candidates confuse 'registration' (step C) with 'authorization' (step B), thinking one step suffices, when in fact both are required sequentially, and they may also incorrectly assume a local admin account (step D) is needed for authentication.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Authorize the FortiGate in the FortiManager GUI.
After the FortiGate is discovered by FortiManager (via FGFM protocol), the administrator must explicitly authorize the device in the FortiManager GUI under 'Device Manager > Unregistered Devices'. This step is mandatory to establish a trusted management relationship; without authorization, the FortiGate remains in an unmanaged state and cannot receive configuration or policy updates.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Enable VDOMs on the FortiGate.
Why it's wrong here
VDOMs are not required for FortiManager integration.
- ✓
Authorize the FortiGate in the FortiManager GUI.
Why this is correct
Authorization is needed to accept management.
- ✓
Register the FortiGate to the FortiManager using the registration code.
Why this is correct
Registration is required for management.
- ✗
Create a local admin account on the FortiGate for FortiManager to use.
Why it's wrong here
FortiManager uses its own authentication.
- ✓
Ensure network connectivity between FortiGate and FortiManager on TCP port 541.
Why this is correct
Port 541 is used for management communication.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
2 more ways this is tested on NSE4
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. An administrator needs to integrate a FortiGate with FortiManager for centralized management. Which two steps are required? (Choose two.)
medium- A.Enable SNMP on the FortiGate to allow FortiManager to monitor.
- ✓ B.Configure a firewall policy allowing traffic from FortiGate to FortiManager on port 541 (FGFM).
- C.Configure a VPN tunnel between FortiGate and FortiManager.
- ✓ D.Configure the FortiGate to connect to FortiManager using the 'execute fortimanager register' command.
- E.Set the FortiGate's operation mode to transparent.
Why B: FortiGate and FortiManager communicate using the FortiGate-to-FortiManager (FGFM) protocol over TCP port 541. A firewall policy must be configured on the FortiGate to allow outbound traffic to the FortiManager on this port, enabling registration and ongoing management. Option D is correct because the 'execute fortimanager register' command is the standard CLI method to initiate the registration process, providing the FortiManager IP address and optional registration code.
Variation 2. An administrator is configuring a new FortiGate and wants to ensure it can be managed centrally via FortiManager. Which TWO steps are required?
medium- A.Enable HTTPS access on the management interface.
- B.Configure SNMP community for FortiManager to poll.
- ✓ C.Enable FortiManager on the interface used for management.
- ✓ D.Set the FortiManager IP address under 'config system central-management'.
- E.Create a firewall policy allowing FortiManager access from the management subnet.
Why C: FortiGate requires the 'FortiManager' feature to be explicitly enabled on the management interface to allow FortiManager to establish a connection. Option D is correct because the FortiManager IP address must be set under 'config system central-management' to define the central management server. Without these two steps, FortiManager cannot discover or manage the FortiGate.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.