It is relatively easy to manage one device via its GUI or CLI. However, managing tens or even hundreds of devices is where efficiency comes into play or falters.<\/p>\n\n\n\n
FortiManager offers two main ways of automation in terms of object configuration, interface management, and setting up devices in bulk: Native CLI Scripts and Jinja2 Templates. Although they perform pretty much the same tasks, they differ greatly in terms of their execution, flexibility, and application.<\/p>\n\n\n\n
The following text will help you understand when it is better to apply one or another way of management.<\/p>\n\n\n\n
Native CLI scripts consist of a sequential list of commands using standard FortiOS commands. The execution is done sequentially on FortiManager, just like a network engineer would paste individual commands while working in an SSH session.<\/p>\n\n\n\n
config system dns\nset primary 1.1.1.1\nset secondary 8.8.8.8\nend\nconfig system global\nset hostname \"FG-$(name)\"\nend<\/code><\/code><\/pre>\n\n\n\n2. Jinja2 Templates<\/h3>\n\n\n\n
Jinja2 is an advanced templating engine which is built-in to FortiManager. This engine enables the use of conditionals, loops, variables, and math operations in your definition.<\/p>\n\n\n\n
\n- Execution Context:<\/strong> Evaluated dynamically at deployment time with FortiManager metadata, device variables, and CLI template groups.<\/li>\n\n\n\n
- Logic:<\/strong> Complete programmatic logic (conditional statements such as if\/else statements, for loops, filters like default, ipaddr, etc.)<\/li>\n\n\n\n
- Error Handling:<\/strong> Evaluated before execution; syntax error in template is detected before execution of the commands on device.<\/li>\n<\/ul>\n\n\n\n
config system interface\n{% for intf in device_interfaces %}\n edit \"{{ intf.name }}\"\n set vdom \"root\"\n set ip {{ intf.ip }} {{ intf.mask }}\n {% if intf.allow_ping %}\n set allowaccess ping\n {% endif %}\n next\n{% endfor %}\nend<\/code><\/pre>\n\n\n\nDirect Comparison<\/h2>\n\n\n\nFeature \/ Dimension<\/strong><\/td>Native CLI Scripts<\/strong><\/td>Jinja2 Templates<\/strong><\/td><\/tr><\/thead>Learning Curve<\/strong><\/td>Extremely Low (Standard FortiOS CLI)<\/td> Moderate (Requires basic programming logic)<\/td><\/tr> Logic & Conditionals<\/strong><\/td>No (if\/else<\/code> not supported)<\/td>Yes (Full if\/elif\/else<\/code> and loop control)<\/td><\/tr>Variable Manipulation<\/strong><\/td>Basic FortiManager Meta-Variables<\/td> Advanced (Filters, string transformations, arithmetic)<\/td><\/tr> Code Reusability<\/strong><\/td>Low (Requires separate scripts per variant)<\/td> High (Single template handles varying site specs)<\/td><\/tr> Debugging Complexity<\/strong><\/td>Low (Direct CLI output)<\/td> Moderate (Need to inspect rendered CLI before deployment)<\/td><\/tr> Ideal Scope<\/strong><\/td>Quick fixes, one-off changes, simple baselines<\/td> Complex multi-site provisioning, SD-WAN, Hub-Spoke networks<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n<\/p>\n","protected":false},"excerpt":{"rendered":"