In FortiOS v7.6.4, there is a known issue (ID: 1209793 Interface configuration is lost when FortiManager-managed FortiGate reboots after a power cycle or unexpected shutdown).
This issue can result in interface configuration loss after a reboot, which happens to the FortiGate managed by FortiManager. The issue ID can be found in FortiOS v7.6.4 release notes:
Known issue 7.6.4
To have a bit more context for this issue, when FortiManager periodically polls the configuration from the FortiGate, the FortiGate may incorrectly save an empty interface configuration file. This file contains no interface configuration.
In this situation, there are two possible scenarios:
If a manual CLI configuration change is made before the next reboot, the normal CMDB save process is triggered, which overwrites the empty file with the correct interface configuration. As a result, the FortiGate loads the correct configuration after reboot, and the issue does not occur. If no configuration change is made before the next reboot, the empty file remains on disk. After reboot, the FortiGate loads this file, resulting in missing interface configuration. This also happens when FortiGate boots up with a higher version of firmware during a firmware upgrade.
This issue has been permanently fixed in FortiOS v7.6.7 as per the release notes and only affects FortiOS v7.6.4. However, when upgrading a FortiGate that is already running FortiOS v7.6.4, a workaround must be performed before the upgrade to ensure that the interface configuration is preserved.
For a standalone FortiGate managed by FortiManager, the simplest workaround is to make any interface configuration change, such as modifying an interface description. After making the change, proceed with the firmware upgrade immediately. This minimizes the chance that another CMDB save process triggered by FortiManager will overwrite the workaround before the upgrade.
For a FortiGate HA cluster managed by FortiManager, it is recommended to temporarily disconnect the FortiGate from FortiManager before performing the upgrade.
This is because the firmware image is first installed on the secondary FortiGate during an HA upgrade, while the primary FortiGate remains online for several minutes until the secondary unit has completed the upgrade and rebooted. During this waiting period, FortiManager may trigger another CMDB save process on the primary FortiGate, which could void the earlier interface configuration change. If this occurs, the primary FortiGate may again boot with missing interface configuration after its upgrade.Â
Thus, disconnecting FortiManager from FortiGate can eliminate the chance of triggering another CMDB save process before the next reboot.
To temporarily disconnect the FortiGate from FortiManager, it is not recommended to disable Central Management on the FortiGate, as doing so may remove the FortiGate from FortiManager.
Instead, temporarily block connectivity between the FortiGate and FortiManager. One recommended approach is to add a blackhole route for the FortiManager IP address and clear the existing TCP port 541 sessions before applying the interface configuration workaround.
Step 1:
Step blackhole route for the FortiManager IP.
config router static
edit 10
set dst <FortiManager IP>
set blackhole enable
next
end
Step 2:
After that, clear any existing sessions with the FortiManager IP:
diagnose sys session filter dport 541
diagnose sys session filter dst <FortiManager IP>
diagnose sys session list
diagnose sys session clear
At this point, the FortiGate should appear as disconnected on the FortiManager side, and the Central Management status on the FortiGate should show as 'Not Connected'.
Step 3:
After that, change the configuration of any interface (change interface description).
Step 4:
Upload the firmware image to the primary FortiGate to proceed with the upgrade immediately after Step 3.
Step 5:
After the upgrade, remove the blackhole route to restore the connection between FortiManager and FortiGate.
These steps should avoid FortiGate booting up with missing config.
| 
