Technical Tip: Obsolete Microsoft-Teams ISDB objects message in debugging FortiGate configuration

This article explains how to handle an error that points out some ISDB objects are obsolete. 

When doing 'diagnose debug config-error-log read' on some FortiGate configurations, this message could appear:

diagnose debug config-error-log read
<----- internet-service-name Microsoft-Teams.Published.Worldwide.Allow(id=327992) is now obsolete. Change the configuration(s) containing this service name.

<-----  internet-service-name Microsoft-Teams.Published.Worldwide.Optimize(id=327991) is now obsolete. Change the configuration(s) containing this service name.

There are two possible reasons for this message:

• The ISDB objects are obsolete.
• The ISDB database has not been updated and it is not able to identify these objects.

The first case can be resolved by deleting the objects. In the second case, if the ISDB database is not updated, the fix is to update the database to avoid this error. If it is not updated, the objects should be changed by others: otherwise, the error will persist.

When the ISDB has not been updated, this specific error can be fixed: 

These objects can be replaced with 'Microsoft-Skype_Teams' (id=327781) if they are being used in a firewall policy. Then, delete the unidentified objects: 

config firewall internet-service-name

    delete [object_name]
end

Note:
The above error, indicating obsolescence, is due to the ISDB not being updated before restoring the configuration. It does not mean that the ISDB object does not exist anymore.

ISDB is a FortiGuard service, so ISDB objects do not change with a FortiOS upgrade. They can change with upgrades of the ISDB DataBase. In this case, check the FortiGuard Internet Services DataBase (Version: 7.04406) for the service 'Microsoft-Teams'. 

The confusing thing about this object name is that it does not appear (use the string 'Teams' instead), and only 'Microsoft-Skype_Teams' appears. 

While the ranges and IPs included in the Skype object seem to include all of the Microsoft ranges, the reality is that this is most likely the original ISDB object for Microsoft services, and Microsoft-Teams was been added later. Any of them are kept. 

It is best practice to regularly update the ISDB version to the latest in order to avoid encountering these issues in future. 

After updating, check if the object is functional with these commands: 

diagnose internet-service id-summary [id]

Microsoft-Teams objects are still functional. 

An operative object cannot be deleted. 

For more information about ISDB Microsoft groups, see Technical Tip: Different Internet Service Database groups for Microsoft Office 365.