Technical Tip: FortiManager policy install fails with 'Invalid Template Assignment' for Central FortiAP

Description

This article describes a scenario where a FortiManager policy package installation fails during the 'Copy device global objects' phase with a 'Vdom copy failed' error referencing an invalid template assignment for a Central FortiAP (or 'central fap' in logs) entry that is not assigned to the target device.

The error typically appears in the Install Wizard log as:

Vdom copy failed: error -999 - . detail: - invalid template assignment - prop[central fap]: central fap '<AP-name>' is not assigned to device

Scope

•       FortiManager 7.2.x and later.

•       Any ADOM where a policy package references a Central FortiAP template that is no longer assigned to the managed device.

•       Typically triggered after a firmware upgrade or ADOM migration that leaves stale template-to-device assignments in the CDB database.

Solution

Root cause:

The FortiManager CDB (Configuration Database) retains 'assign status' entries that map policy package templates (such as Central FortiAP profiles) to managed devices. Following a firmware upgrade or ADOM reconfiguration, these entries can become stale, the template reference still exists in the database but is no longer valid for the target device.

When the Install Wizard attempts to copy global device objects to the managed FortiGate, it validates template assignments and aborts the copy phase for any assignment that fails validation, resulting in a 'Copy Failed' status for the affected device.

To solve the issue:

Step 1 - Take a configuration backup:

Before running any diagnostic command that modifies the database, take a full FortiManager configuration backup via the GUI or CLI. See Backing up the system.

Step 2 - Check and remove invalid assignment entries.

From the FortiManager CLI, run the following command to detect and automatically delete any stale or invalid template assignment entries from the CDB database:

diagnose cdb upgrade check invalid-assign-status

This command performs the following actions:

•       Scans the CDB database for all policy package and template assignment records.

•       Identifies assignments where the referenced template (e.g., Central FortiAP profile) is not currently assigned to the target device.

•       Automatically removes the invalid entries from the database.

Step 3 - Verify with a full CDB upgrade check (optional but recommended):

To perform a comprehensive integrity check across all CDB subsystems, run the following command:

diagnose cdb upgrade check +all

Confirm that the 'Invalid assign status entries' line reports 'No error found' before retrying the installation.

Step 4 - Retry the policy installation:

Return to the FortiManager Install Wizard and re-run the policy package installation for the affected device. The 'Copy Failed' error should no longer occur once the invalid assignment entries have been cleared.

Related articles:

•       Technical Tip: How to check FortiManager database integrity prior to firmware upgrade

•       Technical Tip: Upgrading FortiManager/FortiAnalyzer