Management interface access blocked when virtual patch and VRF are enabled

Description

FortiGate blocks GUI access to the management interface when virtual patching is enabled on a local-in policy and the management interface is configured with a VRF.

This behavior exists in 7.6.6 and earlier versions.

FGT_A # show sys interface port1
config system interface
    edit "port1"
        set vdom "vd1"
        set vrf 1
        set ip 172.16.10.10 255.255.255.0
        set allowaccess ping https ssh snmp http telnet
        set type physical
        set device-identification enable
        set device-user-identification disable
        set snmp-index 3
        config ipv6
            set ip6-allowaccess ping https ssh snmp
        end
    next
end

FGT_A # shshow firewall local-in-policy
config firewall local-in-policy
    edit 1
        set uuid 7c2f91b4-86e5-43a7-9d02-6135b8e4f0a6
        set intf "port1"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set service "ALL"
        set schedule "always"
        set virtual-patch enable
    next
end

Scope

FortiGate.

Solution

After disabling virtual-patch, GUI access will work immediately.

FGT_A # config firewall local-in-policy
FGT_A (local-in-policy) # edit 1
FGT_A (1) # set virtual-patch disable
FGT_A (1) # end

If you unset VRF and then enable virtual-patch, GUI access can work as well:

FGT_A # config sys interface

FGT_A (interface) # edit port1

FGT_A (port1) # sh
config system interface
    edit "port1"
        set vdom "vd1"
        set vrf 1
        set ip 172.16.10.10 255.255.255.0
        set allowaccess ping https ssh snmp http telnet
        set type physical
        set device-identification enable
        set device-user-identification disable
        set snmp-index 3
        config ipv6
            set ip6-allowaccess ping https ssh snmp
        end
    next
end

FGT_A (port1) # unset vrf

FGT_A (port1) # end

FGT_A # config firewall local-in-policy

FGT_A (local-in-policy) # edit 1

FGT_A (1) # set virtual-patch enable

FGT_A (1) # end

This behavior has a fix planned for FortiOS 8.0.3.