FCSS_LED_AR-7.6 · Question #49
A network engineer is deploying FortiGate devices using zero-touch provisioning (ZTP). The devices must automatically connect to FortiManager and receive their configurations upon first boot…
The correct answer is D. The FortiManager IP address is not reachable over TCP port 541. Zero-Touch Provisioning (ZTP) for FortiGate devices is handled throughFortiDeploy, which automatically connects a FortiGate toFortiManagerso the device can download configuration templates and be centrally managed. For ZTP to work, the newly booted FortiGate must successfully…
Question
A network engineer is deploying FortiGate devices using zero-touch provisioning (ZTP). The devices must automatically connect to FortiManager and receive their configurations upon first boot. However, after powering on the devices, they fail to register with FortiManager. What could be a possible cause of this issue?
Options
- AThe FortiGate device requires manual intervention to accept the FortiManager connection.
- BIn this scenario, the ZTP process works only when devices are connected using a console cable.
- CThe FortiGate device must be preloaded with a configuration file before ZTP can function.
- DThe FortiManager IP address is not reachable over TCP port 541.
How the community answered
(34 responses)- A3% (1)
- B6% (2)
- C12% (4)
- D79% (27)
Explanation
Zero-Touch Provisioning (ZTP) for FortiGate devices is handled throughFortiDeploy, which automatically connects a FortiGate toFortiManagerso the device can download configuration templates and be centrally managed. For ZTP to work, the newly booted FortiGate must successfully reach FortiManager. One of thecritical requirementsis connectivity over theFGFM (FortiGate-FortiManager) management protocol, which uses: This is clearly stated in multiple Fortinet documents: FortiGate Cloud Admin Guidelists port541as the management channel used for FortiGate FortiManager / FortiGate Cloud communications:"Management... Protocol: TCP, Port:541" FortiOS Administration Guidealso confirms this:"FortiManager provides remote management of FortiGate devices overTCP port 541." Since ZTP uses FortiDeploy to push the FortiManager IP to the device and relies on FGFM (port 541) for registration and configuration delivery,any failure on this port breaks the entire ZTP Why option D is correct If the FortiGate cannot reach FortiManager onTCP/541, itcannot register, cannot be authorized, and cannot receive its configuration -- leading to a ZTP failure. This is themost common causein real deployments: Firewall blocking TCP/541 Upstream NAT device not forwarding 541 ISP restrictions Incorrect FortiManager IP or routing issue ZTP device behind a network that does not allow outbound 541
Topics
Community Discussion
No community discussion yet for this question.