When both FortiManager and FortiGate are behind NAT devices, the connection must be initiated from the FortiGate to the public IP of the FortiManager.

A. FortiManager discovers the FortiGate using the public IP address of the NAT device in front of the FortiGate. This IP is recorded as the device's IP address in the FortiManager's device list.

D. By default, FortiManager advertises its own private IP address to the FortiGate for management. When FortiManager is behind NAT, this private IP is unreachable. The administrator must manually configure the FortiManager's public (NATed) IP address on the FortiManager itself so it can provide the correct, reachable IP to the FortiGate. Therefore, the NATed IP is not configured by default.

B. The FortiGate must be configured with the FortiManager's public (NATed) IP address to establish a connection, as its private (non-NATed) IP is not routable from the FortiGate's network.

C. Because the FortiGate initiates the connection from behind its NAT device, it is also responsible for re-establishing the FGFM management tunnel if the connection is torn down.

1. FortiManager Administration Guide 7.4

Device Manager > Adding devices > Adding a FortiGate to FortiManager when FortiGate is behind NAT

Page 131: "FortiManager automatically adds the FortiGate device to its device list using the FortiGate NAT device's public IP address." This supports answer A.

2. FortiManager Administration Guide 7.4

Device Manager > Adding devices > Adding a FortiGate to FortiManager when both are behind NAT

Page 132: "When a FortiGate is behind a NAT device

and it is connecting to a FortiManager that is also behind a NAT device

you must configure the FortiManager with its public IP address... Use the config system admin setting and set fmg-source-ip command." This supports answer D

as it shows the NATed IP is not used by default and requires manual configuration.

3. FortiManager Administration Guide 7.4

Device Manager > About the FGFM protocol

Page 118: "If the connection is lost

the FortiGate unit attempts to re-establish the connection." This confirms that the FortiGate

not the FortiManager

re-establishes the tunnel

making option C incorrect.