FortiOS Manager: FortiGate firewall policies, objects and VPNs

FortiOS Manager is 2501's specialty for FortiGate firewalls: it creates objects, manages policies and configures VPNs from your tickets, in the same FortiOS command line your engineers use. It acts only as far as you allow.

Firewall requests are small and exact: open this flow, add this address, bring up a tunnel. The risk is in the details. An object that already exists under another name, a rule below one that matches first, or two tunnel ends that disagree can each leave a request looking done when it is not.

What 2501 does

The FortiOS specialty takes these requests from your ticketing system. It checks what already exists, reuses objects rather than duplicating them and follows your naming conventions. New rules respect rule order, since the first match wins, and each change is verified once made. It also investigates blocked traffic and tunnels that are down. It never guesses: a missing detail is reported back rather than invented, and without a VPN's pre-shared key it configures the rest and leaves the key to your team.

You stay in control

• You choose the level, per specialty: investigate only, act after a person confirms, or act on its own within your rules.
• The device account is the hard limit: give the agent its own administrator profile, and a read-only one for investigation.
• Existing policies stay as they are unless a ticket explicitly asks for a change, and destructive commands can be blacklisted outright.
• On-prem, cloud or hybrid: 2501 runs wherever you do, including fully air-gapped on-prem networks.

Frequently asked

Which Fortinet devices does it cover? It is built for FortiGate appliances. 2501 agents also work on FortiSwitch and FortiAP through the same FortiOS shell.

What if the object already exists? It reports what is there and asks whether to change it instead.

Related

• PaloAlto Manager: PAN-OS security policy, NAT and VPNs
• Guardrails: what an agent may never touch