The Fortinet Security Fabric operates in a hierarchical structure with one FortiGate designated as the 'root' or 'upstream' device. When other Fortinet devices (downstream FortiGates, FortiAnalyzers, etc.) are configured to join the fabric, they send an authorization request to this root FortiGate. The final step of integrating a new device requires an administrator to log in to the root FortiGate's GUI, navigate to the Security Fabric settings, and explicitly authorize the pending device. This action establishes the trust relationship and officially adds the device to the Security Fabric topology, completing the connection.

A. FortiManager: FortiManager is a centralized management platform, but the core device-to-device trust and authorization for the Security Fabric itself occurs on the root FortiGate.

C. FortiAnalyzer: FortiAnalyzer is a logging and analytics component that joins the fabric as a member; it must be authorized by the root FortiGate, it does not authorize other devices.

D. Downstream FortiGate: A downstream FortiGate is a subordinate member of the fabric. It is the device that requires authorization from the root, not the one that grants it.

1. Fortinet FortiOS 7.0.0 Administration Guide:

Section: "Building the Security Fabric" > "Adding a downstream FortiGate"

Page 100: "On the upstream FortiGate

go to Security Fabric > Fabric Connectors. A notification banner is displayed

indicating that a device is waiting for authorization... Select the FortiGate and click Authorize." This explicitly states that authorization is performed on the upstream (root) FortiGate.

2. Fortinet FortiOS 7.2.0 Administration Guide:

Section: "Security Fabric" > "Security Fabric settings"

Page 101: "When a device is configured to join the Security Fabric

the root FortiGate receives a request to authorize the device. The administrator must authorize the device from the root FortiGate to allow it to join the Security Fabric." This confirms the root FortiGate is the point of authorization.

3. Fortinet NSE 4 - FortiOS 7.2 Study Guide:

Module: "Security Fabric"

Page 10: "After you configure a FortiGate as a downstream device

you must authorize it on the root FortiGate." This reinforces that the authorization action is a mandatory step performed on the root device.