Technical Tip: Deleting VDOMs with a similar name (such as 'ro/roo') removes PAC file data under 'root' VDOM

Description

This article describes an issue where, in some FortiOS versions, the explicit proxy PAC file configured under the root VDOM may become empty after deleting another VDOM with a similar name, such as 'ro' or 'roo'.

This issue has been observed on FortiOS 7.4.11 and may also affect other FortiOS versions.

Scope

FortiOS v7.4, FortiOS v7.6, FortiOS v8.0.

Solution

The issue may occur after creating and deleting VDOM names similar to root.

config vdom
    edit roo
end

config vdom
    delete roo
end

When this issue occurs:

• Explicit proxy clients may lose internet connectivity.

• PAC file download from the GUI may fail with HTTP 404.

• The configured PAC file data under the root VDOM is removed.

The following command may show an empty PAC file configuration:

config web-proxy explicit
show

Example output:

set pac-file-data ""

PAC file download from the GUI under 'Network -> Explicit Proxy' may also fail with the following error:

{
  "status":"error",
  "http_status":404
}

The following httpsd debug may also be observed:

[httpsd 5242 - 1778161285 error] api_file_response[116] -- File '/etc/pac/proxy.pac.vfroot' could not be accessed: 2

[httpsd 5242 - 1778161285 info] fweb_debug_final[503] -- Completed GET request for "/api/v2/monitor/webproxy/pacfile/download" (HTTP 404)

Workaround: After deleting VDOMs, verify that the PAC file configuration is still present under the root VDOM. If the PAC file data is empty, manually restore the PAC file configuration.

The issue has been identified and fixed on FortiOS 8.0.1.