---
sourceDocument: Brazil IT Operations Management
sourceDocumentLink: https://www.servicenow.com/docs/r/it-operations-management

 Release :

    - brazil

ft:locale :

    - en-US

ft:publication_title :

    - Brazil IT Operations Management

ft:clusterId :

    - itom

bundleId :

    - itom

workflow :

    - Technology


---

# Fortinet FortiManager discovery requirements

# Fortinet FortiManager discovery requirements {#ariaid-title1}

Release version: Brazil  
Updated September 10, 2026  
![](https://www.servicenow.com/docs/portal-asset/ico-clock) 8 minutes to read  
Technical requirements and configuration details for discovering Fortinet FortiManager firewalls using the Firewall Audits and Reporting application.

## Prerequisites {#fortinet-fortimanager-discovery-requirements__section_prerequisites}

Before discovering Fortinet FortiManager firewalls, verify that the Firewall Audits and Reporting application is downloaded from ServiceNow Store and installed.

## Credentials and permissions {#fortinet-fortimanager-discovery-requirements__section_credentials}

Discovery authenticates to FortiManager using an API key. Create a dedicated read-only user account on the FortiManager appliance and generate an API key for that user.

The read-only user account requires the following minimum permissions:
{#fortinet-fortimanager-discovery-requirements__table_permissions__entry__2}

| Permission area | Required access |
|-|-|
| System status | Read |
| ADOM management | Read |
| Device manager | Read |
| Policy \& Objects | Read |
| Policy Package | Read |
| Global objects | Read |
[Table 1. FortiManager user permissions]

{#fortinet-fortimanager-discovery-requirements__table_permissions}

Configure the FortiManager API key in ServiceNow as follows:

1. Navigate to DiscoveryCredentials and create a new API Key credential record with the FortiManager API key value.
2. Create a Credential Alias and associate it with the credential record.
3. In the FortiManager serverless discovery schedule configuration, input the credential alias.

## MID Server configuration {#fortinet-fortimanager-discovery-requirements__section_mid_server}

The MID Server must have HTTPS (TCP 443) network access to the FortiManager management IP address. No agent is installed on FortiManager. All discovery is API-driven from the MID Server over HTTPS using the FortiManager JSON-RPC API.

## MID Server sizing {#fortinet-fortimanager-discovery-requirements__section_mid_sizing}

FortiManager environments can be large, with thousands of firewall objects and policies. The following sizing is recommended:

* **JVM heap size:** Minimum 4 GB RAM per MID Server. Set wrapper.java.maxmemory to <kbd class="ph userinput">4096</kbd> in the MID Server configuration.
* **MID Server cluster:** Deploy a cluster of 3--4 MID Servers each configured with 4 GB JVM heap to distribute the discovery load across concurrent pattern executions. You can increase this allocation if you encounter memory issues even after following the above sizing recommendations.

Warning:  
Running FortiManager discovery on an undersized MID Server (less than 4 GB JVM heap) may result in out-of-memory errors or incomplete discovery, particularly for large deployments with many ADOMs and policy packages.

## API endpoints {#fortinet-fortimanager-discovery-requirements__section_api_endpoints}

All requests use POST to `https://<fortimanager-host>/jsonrpc` with a JSON body. Authentication uses the API key credential alias configured in ServiceNow
Discovery.

Key API endpoints used during discovery:
{#fortinet-fortimanager-discovery-requirements__table_api_endpoints__entry__2}

| Resource | API URL (in params.url) |
|-|-|
| FortiManager system status | /sys/status |
| Firewall policies | /pm/config/adom/{{adom}}/pkg/{{policy-package}}/firewall/policy |
| Global address objects | /pm/config/global/obj/firewall/address |
| Global address groups | /pm/config/global/obj/firewall/addrgrp |
| Global service objects | /pm/config/global/obj/firewall/service/custom |
| Global service groups | /pm/config/global/obj/firewall/service/group |
| Global VIP objects | /pm/config/global/obj/firewall/vip |
| Global VIP groups | /pm/config/global/obj/firewall/vipgrp |
| Global curated ISDB objects | /pm/config/global/obj/_fdsdb/internet-service |
| Global custom ISDB objects | /pm/config/global/obj/firewall/internet-service-custom |
| ADOM list | /dvmdb/adom |
| Devices in ADOM | /dvmdb/adom/{{adom}}/device |
| Policy packages in ADOM | /pm/pkg/adom/{{adom}} |
| ADOM address objects | /pm/config/adom/{{adom}}/obj/firewall/address |
| ADOM address groups | /pm/config/adom/{{adom}}/obj/firewall/addrgrp |
| ADOM service objects | /pm/config/adom/{{adom}}/obj/firewall/service/custom |
| ADOM service groups | /pm/config/adom/{{adom}}/obj/firewall/service/group |
| ADOM VIP objects | /pm/config/adom/{{adom}}/obj/firewall/vip |
| ADOM VIP groups | /pm/config/adom/{{adom}}/obj/firewall/vipgrp |
| ADOM custom ISDB objects | /pm/config/adom/{{adom}}/obj/firewall/internet-service-custom |
[Table 2. FortiManager API endpoints]

{#fortinet-fortimanager-discovery-requirements__table_api_endpoints}

## CMDB CI attributes populated {#fortinet-fortimanager-discovery-requirements__section_cmdb_attributes}

The FortiManager discovery pattern populates comprehensive attributes for all discovered CMDB Configuration Items. The following tables detail all attributes populated for each CI type.
{#fortinet-fortimanager-discovery-requirements__table_fortimanager_attributes__entry__2}

| Attribute | Description |
|-|-|
| Name | Display name of the FortiManager appliance |
| Serial Number | Hardware serial number used as the primary identifier |
| IP Address | Management IP address |
| Is Virtual | Whether the appliance is a virtual deployment |
| Platform Type | Hardware platform model type |
| Time Zone | Configured time zone of the appliance |
| High Availability Mode | HA mode: standalone, active-passive, or active-active |
| Hostname | Configured system hostname |
| ADOM Count | Number of Administrative Domains managed |
| Managed Device Count | Total number of managed FortiGate devices |
| ADOM Enabled | Whether the ADOM feature is enabled on this appliance |
| BIOS Version | BIOS firmware version |
| Build Number | Firmware build number |
| FIPS Mode Enabled | Whether FIPS compliance mode is active |
| Max ADOM | Maximum number of ADOMs supported by the license |
| Offline Mode Enabled | Whether the appliance is operating in offline mode |
| System Part Number | Hardware part number |
[Table 3. FortiManager Network Manager attributes \[cmdb_ci_fortimanager_network_manager\]]

{#fortinet-fortimanager-discovery-requirements__table_fortimanager_attributes}  
Note:  
Discovery populates firmware version information in the Firmware Installation \[cmdb_firmware_install_list\] table instead of directly on the FortiManager CI.
{#fortinet-fortimanager-discovery-requirements__table_adom_attributes__entry__2}

| Attribute | Description |
|-|-|
| Name | Display name of the Administrative Domain |
| UUID | Globally unique identifier |
| Device Count | Number of managed devices in this ADOM |
| Object ID | Unique path to this resource: /dvmdb/adom/{name} |
| ADOM Type | Product type restriction (for example, fos for FortiOS/FortiGate) |
| Target OS Version | FortiOS version that devices in this ADOM are expected to run |
| Policy Package Count | Number of policy packages within this ADOM |
| FortiManager | Reference to the parent FortiManager CI |
| Description | Administrator-assigned description |
[Table 4. Fortinet Firewall ADOM attributes \[cmdb_ci_firewall_device_group_fortinet\]]

{#fortinet-fortimanager-discovery-requirements__table_adom_attributes} {#fortinet-fortimanager-discovery-requirements__table_device_attributes__entry__2}

| Attribute | Description |
|-|-|
| Name | Device display name in FortiManager |
| Serial Number | Hardware serial number used as primary identifier |
| IP Address | Device management IP address |
| Manufacturer | Device manufacturer |
| Model ID | Reference to hardware model record \[cmdb_model\] |
| Platform Family | Operating system type (for example, fos) |
| High Availability Role | HA cluster role: standalone, primary, or secondary |
| FortiManager | Reference to the managing FortiManager CI |
| VDOM Enabled | Whether virtual domains are enabled (derived from maxvdom \> 1) |
| Operational Status | Device operational state integer |
[Table 5. Fortinet Firewall Device attributes \[cmdb_ci_firewall_device_fortinet\]]

{#fortinet-fortimanager-discovery-requirements__table_device_attributes}  
Note:  
Discovery populates firmware version information in the Firmware Installation \[cmdb_firmware_install_list\] table instead of directly on the device CI.
{#fortinet-fortimanager-discovery-requirements__table_policy_pkg_attributes__entry__2}

| Attribute | Description |
|-|-|
| Name | Policy package name |
| Object ID | Unique path: /pm/pkg/adom/{adom}/{name} |
| Policy Count | Number of policies in this package |
| Parent ADOM | Reference to the owning ADOM CI |
| FortiManager | Reference to the root FortiManager CI |
| Package Type | pkg (active package) or folder (organizational container) |
[Table 6. Fortinet Firewall Policy Package attributes \[cmdb_ci_fortinet_firewall_policy_pkg\]]

{#fortinet-fortimanager-discovery-requirements__table_policy_pkg_attributes} {#fortinet-fortimanager-discovery-requirements__table_policy_attributes__entry__2}

| Attribute | Description |
|-|-|
| Name | Policy display name. Fallback: "Policy {policyid}" when name is empty |
| UUID | Primary identifier auto-generated by FortiOS |
| Policy ID | Integer policy ID within the package |
| Policy Enabled | Whether the policy is active |
| Last Hit | Timestamp of last traffic match |
| Object ID | Unique path: /pm/config/adom/{adom}/pkg/{pkg}/firewall/policy/{policyid} |
| Sequence Number | Rule evaluation order within the package |
| Policy Package | Reference to the parent Policy Package CI |
| Parent ADOM | Reference to the ADOM CI this policy belongs to |
| FortiManager | Reference to the root FortiManager CI |
| Action | Policy action: accept, deny, or ipsec |
| Source Interface | Ingress interface name(s), comma-joined |
| Destination Interface | Egress interface name(s), comma-joined |
| Source Address | Source address/group object names, comma-joined |
| Destination Address | Destination address/group/VIP object names, comma-joined |
| Source Services | Service/service-group object names, comma-joined |
| Policy Schedule | Schedule object name (for example, always) |
| ISDB Src Enabled | Whether Internet Service is used at the source |
| ISDB Dest Enabled | Whether Internet Service is used at the destination |
| NAT Enabled | Whether source NAT is applied |
| NAT IP | NAT IP pool name when ippool is enabled |
| Traffic Logging Mode | Log level: disable, utm, or all |
| Traffic Session Logging Enabled | Whether session start events are logged |
| UTM/Security Profile Enabled | True when any UTM profile (AV, IPS, SSL) is applied |
| AV Profile | Antivirus profile name applied to this rule |
| IPS Sensor | IPS sensor profile name applied to this rule |
| SSL/SSH Profile | Deep inspection profile name |
| Description | Free-text description and change audit trail |
[Table 7. Fortinet Firewall Policy attributes \[cmdb_ci_fortinet_firewall_policy\]]

{#fortinet-fortimanager-discovery-requirements__table_policy_attributes}

## Non-CMDB firewall object attributes populated {#fortinet-fortimanager-discovery-requirements__section_noncmdb_attributes}

The following tables detail attributes populated for non-CMDB firewall object tables. All tables inherit common base attributes: Object ID, UUID, Name, Description, Discovery Source, Parent ADOM, and FortiManager reference.
{#fortinet-fortimanager-discovery-requirements__table_address_object_attributes__entry__2}

| Attribute | Description |
|-|-|
| Address Type | Type of address: ipmask, iprange, fqdn, wildcard, geography, or dynamic |
| Subnet | IP address and mask (present when type = ipmask) |
| Start IP | Start of IP range (present when type = iprange) |
| End IP | End of IP range (present when type = iprange) |
| Fully Qualified Domain Name | FQDN string (present when type = fqdn) |
| Geography | ISO country code(s) (present when type = geography) |
| Associated Interface | Interface this address is bound to. "any" indicates all interfaces |
[Table 8. Address Object attributes \[sn_disco_firewall_fortinet_address_object\]]

{#fortinet-fortimanager-discovery-requirements__table_address_object_attributes} {#fortinet-fortimanager-discovery-requirements__table_addrgrp_object_attributes__entry__2}

| Attribute | Description |
|-|-|
| Member Names | Comma-joined list of member address/group names |
| Member Count | Number of members in the group |
| Exclude Members | Comma-joined exclude-member list when exclusion mode is active |
[Table 9. Address Group Object attributes \[sn_disco_firewall_fortinet_addrgrp_object\]]

{#fortinet-fortimanager-discovery-requirements__table_addrgrp_object_attributes} {#fortinet-fortimanager-discovery-requirements__table_service_object_attributes__entry__2}

| Attribute | Description |
|-|-|
| Protocol | Layer-4 protocol type: ICMP, IP, TCP/UDP/SCTP, or ICMP6 |
| TCP Port Range | Space-separated TCP ports/ranges (present when protocol includes TCP) |
| UDP Port Range | Space-separated UDP ports/ranges |
| SCTP Port Range | Space-separated SCTP ports/ranges |
| ICMP Type | ICMP type number (present when protocol = ICMP) |
| Service Category | Comma-separated category names this service belongs to |
[Table 10. Service Object attributes \[sn_disco_firewall_fortinet_service_object\]]

{#fortinet-fortimanager-discovery-requirements__table_service_object_attributes} {#fortinet-fortimanager-discovery-requirements__table_servicegrp_object_attributes__entry__2}

| Attribute | Description |
|-|-|
| Member Names | Comma-joined list of service member names |
| Member Count | Number of service members in the group |
| Proxy Enabled | Whether this is a proxy-mode service group |
[Table 11. Service Group Object attributes \[sn_disco_firewall_fortinet_servicegrp_object\]]

{#fortinet-fortimanager-discovery-requirements__table_servicegrp_object_attributes} {#fortinet-fortimanager-discovery-requirements__table_vip_object_attributes__entry__2}

| Attribute | Description |
|-|-|
| VIP Type | Type of VIP: static-nat, server-load-balance, fqdn, or dns-translation |
| External IP | Public-facing IP that clients connect to (before NAT) |
| External Interface | Interface where inbound traffic arrives (for example, wan1, any) |
| Mapped Address | Internal real server IP or FQDN that traffic is forwarded to after DNAT |
| Port Forward Enabled | Whether port translation is applied in addition to IP translation |
| Active | Whether this VIP is active and processing traffic |
| NAT44 Enabled | Whether IPv4-to-IPv4 NAT is enabled |
[Table 12. VIP Object attributes \[sn_disco_firewall_fortinet_vip_object\]]

{#fortinet-fortimanager-discovery-requirements__table_vip_object_attributes} {#fortinet-fortimanager-discovery-requirements__table_vipgrp_object_attributes__entry__2}

| Attribute | Description |
|-|-|
| External Interface | External interface all member VIPs are associated with |
| Member Names | Comma-joined list of member VIP object names |
| Member Count | Number of VIP members in the group |
[Table 13. VIP Group Object attributes \[sn_disco_firewall_fortinet_vipgrp_object\]]

{#fortinet-fortimanager-discovery-requirements__table_vipgrp_object_attributes} {#fortinet-fortimanager-discovery-requirements__table_isdb_object_attributes__entry__2}

| Attribute | Description |
|-|-|
| Reputation Score | Threat reputation score for this internet service entry |
[Table 14. ISDB Object attributes \[sn_disco_firewall_fortinet_isdb_object\]]

{#fortinet-fortimanager-discovery-requirements__table_isdb_object_attributes} {#fortinet-fortimanager-discovery-requirements__table_m2m_attributes__entry__2}

| Attribute | Description |
|-|-|
| Firewall Policy | Reference to the Firewall Policy CI \[cmdb_ci_firewall_sec_policy\]. Cascade delete enabled. |
| Firewall Object | Reference to the base firewall object record \[sn_disco_firewall_object\]. Cascade delete enabled. |
| Reference Type | Which policy field referenced this object: srcaddr, dstaddr, or service |
| Discovery Source | Source system that populated this record |
[Table 15. Policy Object M2M Mapping attributes \[sn_disco_firewall_policy_object_m2m\]]

{#fortinet-fortimanager-discovery-requirements__table_m2m_attributes}

## Relationships created {#fortinet-fortimanager-discovery-requirements__section_relations}

Discovery establishes the following CMDB relationships between discovered Configuration Items:
{#fortinet-fortimanager-discovery-requirements__table_relations__entry__3}

| Parent CI | Relationship Type | Child CI |
|-|-|-|
| FortiManager Network Manager | Manages::Managed By | Fortinet Firewall ADOM |
| Fortinet Firewall ADOM | Members::Member Of | Fortinet Firewall Device |
| Fortinet Firewall ADOM | Contains::Contained By | Fortinet Firewall Policy Package |
| Fortinet Firewall Policy Package | Used By::Uses | Fortinet Firewall Device |
| Fortinet Firewall Policy Package | Contains::Contained By | Fortinet Firewall Policy |
[Table 16. FortiManager CI relationships]

{#fortinet-fortimanager-discovery-requirements__table_relations}

## Discovery pattern {#fortinet-fortimanager-discovery-requirements__section_discovery_pattern}

The FortiManager discovery uses a serverless Large Payload Pattern (LP). The pattern name is Fortinet FortiManager (LP).

Discovery consists of one serverless root pattern that triggers multiple independent Large Payload Patterns for global objects, ADOMs, devices, policy packages, and firewall policies.

*[\>]: and then