Technical Tip: How to solve an ISDB issues upon upgrade

Description

This article describes how to fix potential ISDB issues with an empty database upon upgrade of the FortiOS.

Scope

FortiGate v7.0, v7.2, v7.4.

Solution

First, diagnose the issue. Use the following command. Example output is shown below that points to a problem with the installation of the database due to memory.

diagnose deb config-error-log read
ffdb_map_flash_read: ret=-2, Error: open map tmp file error
init_do_ffdb_map: ret=-6, Error: shared memory error 

The reason for this issue is a very likely error with the device not being able to hold the database. This usually happens on smaller devices. 

To fix this issue, clear the current internet service using the commands below:

diagnose internet-service clear /data2/ffdb_app
diagnose internet-service clear /data2/ffdb_map
diagnose internet-service clear /data2/ffdb_map_res

With these commands, the ISDB database is supposed to be clear. After that, issue the following command:

execute update-now

The command to check the current ISDB is below:

diagnose autoupdate versions | grep "Internet-service Full Database" -A 6

Another common issue for an upgrade from major version 7.0 to version 7.2 is explained in Troubleshooting Tip: Getting error 'ffdb_app_map_process-3326: wrong word' after upgrading from v7.0 to v7.2. Example output:

ffdb_map_flash_read: ret=-5, Error: version error
ffdb_map version mismatch, the Internet Service Database will automatically update

The following error will also sometimes be seen when upgrading from v7.4 to v7.6.

fqdn_check_reload: ffdb_fqdn file does not exist, the internet service database will automatically update

For these issue, the fix is as per the lines above with:

execute update-now

If issues persist, the next step is to perform a manual update of the ISDB as per Technical Tip: Manual Update of Internet Service Database (ISDB) Package.

Once again, the command to check the current ISDB is below (see the paragraph with 'Internet-service Full Database', which will help to verify whether the ISDB is installed successfully):

diagnose autoupdate versions

The other options would be to change the database; the options are given below: Technical Tip: Configuring and checking the Internet Service database version installed and running on FortiOS based units.

Upon the change of the database, the following options are given:

A:

1.  Clear the internet service using the commands below:

diagnose internet-service clear

2. Change the type of database (to mini or on-demand).

3. Manual update with command:

execute update-now

Or B:

1. Change the type of database (to mini or on-demand).

2. Reboot.

3. Manual update with command:

execute update-now

Check for any duplicate entries in the ISDB by running the following command:

diagnose internet-service-name check-duplicate

Clean up unused, obsolete Internet Service names by running the following command:

diagnose internet-service-name cleanup

The last step to take, if none of the solutions above work, is to perform a clean installation of the device. This would format the disk and start from scratch, for which a backup is needed. The procedure is given below:

• Format: Technical Tip: Formatting and loading FortiGate firmware image using TFTP.

• Restore: Configuration backups and restoration.

If none of these steps work, open a ticket with TAC support and provide the data from the following debug:

get system status
diagnose autoupdate versions
diagnose debug application update -1
diagnose debug console timestamp
diagnose debug enable
execute update-now