Technical Tip: Security profile groups no longer available after an upgrade to v7.4.9

Description

This article explains a scenario where security profile groups are not available to be selected on firewall policies.

Scope

FortiGate, Security Profiles.

Solution

The firewall policy on the FortiGate is configured as seen below:

config firewall policy
    edit 7
        set name "TEST-Flow"
        set uuid 846dd5fc-dbf4-51f0-b64e-5107efcd7ea5
        set srcintf "port4"
        set dstintf "port3"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set utm-status enable
        set profile-type group
        set profile-group "TEST-Flow"
        set logtraffic all
        set nat enable
     next
end

The configuration of the profile-group is as follows:

config firewall profile-group
    edit "TEST-Flow"
       set ssl-ssh-profile "no-inspection"
       set av-profile "TEST-Flow"
       set webfilter-profile "TEST-Flow"
       set application-list "TEST-Flow"
       set waf-profile "default"
     next
end

When trying to add a security group to a new firewall policy, there is an error seen, as shown below:

 FortiGate (7)# set profile-group TEST-Flow

entry not found in datasource

 

value parse error before 'TEST-Flow'
Command fail. Return code -3

The security profile group is still visible on the existing firewall policies, but it is not possible to add it to a new firewall policy.

Even trying to change the profile group to an existing policy or creating a new security profile group does not allow for the request to be accomplished.

However, if removing the WAF profile from the profile-group, the group is now available to be selected again.

The reason for this behavior is that firewall policies with inspection-mode as flow (the default one) do not support WAF, ICAP, or SSH-filter features.

If this issue is noticed, it is recommended to unset the waf-profile, icap-profile and ssh-filter-profile in the profile-group first before adding it to the firewall policy.


This behavior is not present when the firewall policy is set to proxy inspection-mode.