A network engineer is deploying FortiGate devices using zero-touch provisioning (ZTP). The devices must automatically connect to FortiManager and…

Zero-touch provisioning (ZTP) for FortiGate devices relies on the ability of a new, factory-default device to automatically contact and register with a FortiManager instance. This communication occurs over the FortiGate-FortiManager protocol (FGFM). The default and standard port for this protocol is TCP port 541. If there is a firewall, access control list, or routing issue preventing the FortiGate from reaching the FortiManager's IP address on this specific port, the management tunnel cannot be established, and the ZTP registration process will fail.

A. The core principle of ZTP is to eliminate the need for manual intervention on the device itself. The process is designed to be fully automated from the FortiGate's perspective.

B. ZTP is a network-based provisioning method that requires WAN or LAN connectivity. A console cable is used for direct, local configuration, which is contrary to the ZTP concept.

C. ZTP is specifically designed for devices in a factory-default state. The objective is for FortiManager to push the initial configuration, not for the device to have a preloaded file.

1. FortiManager Administration Guide 7.6.0

Section: Device Manager > Adding devices > Adding a device with the Add Device wizard > Zero-touch provisioning for FortiGate devices

Content: The guide outlines the prerequisites for ZTP, stating, "Ensure the FortiGate can connect to the FortiManager on port 541." This confirms that reachability on TCP port 541 is a critical requirement for the process to succeed.

2. Fortinet Cookbook

Document: Zero Touch Provisioning for FortiGate (fortinet.com)

Section: Prerequisites

Content: This official deployment guide explicitly lists as a prerequisite: "The FortiGate must be able to reach the FortiManager on TCP port 541." This directly supports the correct answer by identifying port 541 connectivity as a mandatory condition.

3. FortiOS Administration Guide 7.6.0

Section: System > Central Management

Content: This section describes the configuration for connecting a FortiGate to a FortiManager. It details the set fmg command, which specifies the FortiManager's IP address. The underlying protocol, FGFM, uses TCP port 541 by default for this communication, which is essential for both manual and automated (ZTP) registration.