Fortinet

FortiGate (standalone)

Access Requests	Manual target selection Device object selection
Modify Group	Create/modify group
Add Access	Risk Analysis Designer Verifier Authorization and documentation Auto close
Remove Access	Verifier
Server Decommission	Impact Analysis, Verifier
Rule Recertification	Update metadata

Advanced means device management mode in SecureTrack is Advanced management

Access Requests	Manual target selection Device object selection
Modify Group	Designer Syntax-based change Provisioning + Committing Provisioning + Committing in automatic step Create/modify group
Add Access	Risk Analysis Verifier Designer Provisioning + Committing Provisioning + Committing in automatic step Authorization and documentation Auto close
Remove Access	Auto close, Verifier (topology mode only)
Server Decommission	Impact Analysis Designer Provisioning + Committing Verifier Authorization and documentation
Clone Server Policy	Designer Provisioning (or) Provisioning and Committing Verifier
Rule Decommission	Designer Provisioning + Committing Provisioning + Committing in automatic step Verifier Authorization and documentation Auto close
Rule Modification	Provisioning + Committing Provisioning + Committing in automatic step
Rule Recertification	Update metadata

Access Request supports FQDN objects which are resolved as IP addresses
“Dynamic assignment” and “Skip this step if” options do not list targets when topology is disabled.

Workaround: Enter these targets manually, using free text.
Support for Fortinet FortiManager Web Filters.
New objects in a Rule Modification workflow can only be created on the policy where the rule is located. It is not possible to create a global object in a hierarchical environment and add the object to a rule on a sibling policy.
In a Rule Modification workflow there is no zone validation for Fortinet FortiManager devices. While it is possible for a request to include adding objects from address books or adding zones to rules on other zones, validation will fail on provisioning.
Support for IPv6 objects for Access Requests in non topology mode (topology disabled).
Designer gives priority to service objects that have a default timeout set in the firewall.

Basic means device management mode in SecureTrack is Basic firewall management

Access Requests	Device object selection
Add Access	Risk Analysis Verifier Designer Provisioning Provisioning in automatic step Authorization and documentation Auto close
Rule Recertification	Update metadata