When an Administrative Domain (ADOM) is set to backup mode, FortiManager's central management capabilities, such as the Policy & Objects pane, are disabled for that ADOM. The primary purpose is to back up the device's configuration, which is managed locally on the FortiGate. However, FortiManager can still push configuration changes to the device using scripts. A script containing the necessary CLI commands to create a new firewall policy can be created in FortiManager and then run on the target FortiGate, effectively applying the new policy.

A. Use the Install Wizard located on the device manager.

The Install Wizard is used to install policy packages and device settings. This functionality is not available for ADOMs in backup mode, as policy packages cannot be managed.

B. Enable workflow mode to allow policy creation and approval.

Workflow mode is a change management feature that requires an approval process. It does not override the fundamental restriction of backup mode, which disables policy package management.

C. Make sure the ADOM and FortiGate firmware versions match and use the ADOM policy package.

Using ADOM policy packages is the standard method for centrally managing devices in Normal or Advanced mode, but this feature is explicitly disabled in backup mode.

1. FortiManager Administration Guide 7.2.3

Administrative Domains (ADOMs) > ADOM modes

Page 138.

"In Backup mode

FortiManager is used to back up FortiGate configurations. You cannot use FortiManager to provision or manage the devices. The Policy & Objects and AP Manager panes are not available." This statement confirms that options A and C

which rely on policy packages

are incorrect.

2. FortiManager Administration Guide 7.2.3

Scripts > About scripts

Page 578.

"You can use scripts to deliver configuration files and CLI commands to a managed device or to multiple devices." This confirms that scripts are a valid method for applying CLI-based configuration changes

which is the mechanism required to create a policy on a device in a backup mode ADOM.