Pre-run CLI templates used for Zero-Touch Provisioning (ZTP) and Low-Touch Provisioning (LTP) are designed for the initial bootstrapping of a FortiGate. They configure essential settings like interface IP addresses and static routes, enabling FortiManager to establish a connection and perform the first configuration installation. By design, FortiManager automatically unassigns these specific pre-run templates from the device after the first successful installation. This is a deliberate one-time action to prevent the initial bootstrap configuration from being re-applied during subsequent policy package installations, which could cause conflicts or revert intended changes.

A. This is incorrect. The template was assigned correctly for ZTP; its unassignment is an expected, automatic behavior, not a permanent assignment failure.

C. The unassignment process is automatic for ZTP/LTP pre-run templates, not manual. This automation is a key feature of the provisioning workflow.

D. Post-run CLI templates are executed after a policy package installation, making them unsuitable for the initial bootstrap configuration required for ZTP/LTP.

1. Fortinet FortiManager Administration Guide 7.6:

In the section Device Manager > Provisioning Templates > Creating a provisioning template

the guide states: "When a pre-run CLI template is used for zero-touch or low-touch provisioning

the template is automatically unassigned from the device after the template is run on the device. This prevents the template from being run on the device again during subsequent installations." This directly confirms the automatic unassignment behavior.

2. Fortinet FortiManager Administration Guide 7.4:

The same behavior is documented in the Device Manager > Provisioning Templates > Creating a provisioning template section

confirming this is a standard feature: "When a pre-run CLI template is used for zero-touch or low-touch provisioning

the template is automatically unassigned from the device after the template is run on the device."