Technical Tip: Unable to create address object in firewall policy via GUI with custom sysgrp-permission

Description

This article describes the issue where the user is unable to create an address object in the firewall policy on FortiGate GUI if sysgrp-permission admin is set to 'read' privilege.

Scope

FortiGate.

Solution

In FortiOS v7.4.4 and above, a user account with custom sysgrp-permission is not able to create an address object directly in a firewall policy via the GUI due to the missing '+' sign. For example:

config system accprofile
    edit "ICT_Maintain"
        config sysgrp-permission
            set admin read <<==
            set upd read-write
            set cfg read-write
            set mnt read-write
        end
    next
end

The issue is fixed in FortiOS v7.6.3 and above. For FortiOS v7.4, the 'sysgrp-permission' for 'admin' can be configured as 'read-write' to solve the issue. For example:

config system accprofile
    edit "ICT_Maintain"
        config sysgrp-permission
            set admin read-write <<==
            set upd read-write
            set cfg read-write
            set mnt read-write
        end
    next
end