My experience after 2 years managing 15 FortiGates: The one feature I can't live without.

After two years of managing a fleet of fifteen FortiGate appliances across multiple environments, ranging from 60F units at branch offices to 600E clusters at our core data centers, I've formed strong opinions on what matters for operational stability at scale. The usual suspects—SD-WAN integration, SSL-VPN, and the threat protection profiles—are all competent, and you'll find ample reviews on those. However, the feature that has fundamentally changed how my team operates, and the one I now consider non-negotiable, is the **FortiManager API and its declarative, model-driven configuration management**.

Let me be blunt: managing more than a handful of FortiGates through the GUI or even ad-hoc CLI scripts is a path to inconsistency, configuration drift, and midnight pages. The FortiManager, when used correctly, shifts the paradigm from device-by-device configuration to a centralized, policy-based model. The true power isn't in the GUI of the Manager itself, but in its comprehensive REST API that exposes this model. This allows you to treat your firewall policy as code, integrate it into your existing CI/CD pipelines, and enforce a single source of truth.

Consider a typical operational task: deploying a new application security profile to a subset of firewalls based on their device group. Without this model, you're looking at manual edits across multiple devices or writing fragile scripts that parse CLI output. With the FortiManager API, you update the central policy package and push the model. The system calculates the delta and applies only the necessary changes. The consistency this guarantees is invaluable.

Here is a simplified example of using the API to add an address object to a central policy package, which can then be installed to assigned device groups. This is far more reliable than pushing raw CLI snippets.

```
# Example using the FortiManager JSON-RPC API (v7.2)
# First, obtain the policy package ID for your central package.
POST /jsonrpc HTTP/1.1
Host: fortimanager.example.com
Authorization: Bearer

{
"method": "add",
"params": [
{
"url": "/pm/config/adom/root/pkg/Central_Policy/firewall/address",
"data": {
"name": "SERVERS-NEW-CIDR",
"type": "ipmask",
"subnet": "10.10.20.0 255.255.255.0",
"comment": "API-created for deployment 2024-05"
}
}
],
"id": 1
}
```

The critical advantages for scalability are:

* **Elimination of Configuration Drift:** The model is the truth. Devices are periodically, and automatically, checked for compliance against the model. Any unauthorized local change can be flagged or reverted.
* **Atomic and Auditable Changes:** Every change via the API is tied to a change request in the FortiManager's audit logs. You know who changed what, when, and why. Rollback is a first-class operation.
* **Integration into GitOps Workflows:** You can store your policy definitions as JSON/YAML in a Git repository. CI pipelines can validate changes, run pre-deployment checks (like policy hit-count analysis), and call the FortiManager API to apply them. This bridges the gap between network security and modern DevOps practices.
* **Handling of Complex Dependencies:** The model understands dependencies between objects. You can't accidentally push a firewall rule that references a non-existent address object; the API call will fail validation at the central point, not break a single remote firewall.

The caveat, because there always is one: the initial setup of FortiManager and the ADOM (Administrative Domain) structure requires careful planning. You must design your device groups and policy packages to mirror your operational boundaries (e.g., production vs. development, region-based). The learning curve for the API is non-trivial, but the long-term payoff in reduced mean time to repair (MTTR) and increased reliability is substantial. If you are managing a distributed FortiGate estate and are not leveraging the FortiManager as a true model-driven control plane via its API, you are operating at a significant and unnecessary disadvantage.

– A