Technical Tip: FortiManager v8.0.0 fails to install to FortiOS v8.0 with error 'Invalid vdom context. object: logo_v3_fguard_app' (Known issue)

Description

This article describes a known issue in FortiManager v8.0.0: attempting to install device settings on a FortiGate running FortiOS v8.0 fails with an error similar to the following. Notably, this issue will only occur when attempting to install to a FortiGate that is not using Virtual Domains (aka VDOMs).

Invalid vdom context. object: logo_v3_fguard_app. detail: system replacemsg-image. solution: Device vdom is disabled, not allowed to add object with global context.

Scope

FortiOS v8.0, FortiManager v.8.0.0.

Solution

This issue occurs because of a bug in FortiManager v8.0.0, though the root cause is a CLI syntax change introduced in FortiOS v8.0 regarding the config system replacemsg-image table. This CLI table contains mappings for custom images that the FortiGate can use when serving replacement messages (see also: Replacement messages), and in FortiOS v7.x these entries were globally managed (i.e. shared by all VDOMs).

In FortiOS v8.0, this feature was enhanced to support both global and per-VDOM tables, which meant a change to the backend CLI syntax (see also: Per VDOM replacement message customization). Notably, this behavior change was not handled correctly in FortiManager but only under the following circumstances:

• FortiManager and the FortiGate are running v8.0.0 of their respective firmware.

• The FortiGate does not have VDOMs enabled (see: Technical Tip: How to check for VDOM Enablement on a FortiGate).

• Any changes are being made to the FortiGate configuration using FortiManager that reference entries within config system replacemsg-image.

When these circumstances are met, any attempt to install device settings from FortiManager to the FortiGate will fail with an error log similar to the above Description or the following screenshot:

Resolution:

This issue will be resolved in the upcoming FortiManager v8.0.1. Note that this issue does not impact FortiManager v7.x, nor does it impact config installations made from FortiManager to FortiGates running FortiOS v7.x (since the CLI syntax change is only relevant when pushing to FortiOS v8.x).

Further information:

The most common occurrence of this issue relates to the 'logo_v3_fguard_app' image entry mentioned in the Description, though the issue requires several related configuration steps to occur first. On a factory-fresh FortiGate, this entry already exists but is not referenced anywhere, and so no issue will occur:

FortiGate # show system replacemsg-image logo_v3_fguard_app 
config system replacemsg-image
    edit "logo_v3_fguard_app"
        set image-base64 ''
    next
end

FortiGate # diagnose sys cmdb refcnt show system.replacemsg-image.name logo_v3_fguard_app
The total reference number is 0

However, if the FortiGate is then configured with a FortiLink interface (for FortiSwitch management), then a series of changes will automatically occur that can result in the FortiManager install failure issue occurring:

• When a FortiLink interface is created on the FortiGate, and a Managed FortiSwitch entry is added for the first time, the FortiGate will automatically populate the FortiLink interface with several default VLANs, including the quarantine VLAN.

• This quarantine VLAN includes a default setting of replacemsg-override-group 'auth-intf-quarantine', which references the 'auth-intf-quarantine' entry under config system replacemsg-group.

• The 'auth-intf-quarantine' includes two pages ('auth-disclaimer-page-1' and 'auth-reject-page') that ultimately reference logo_v3_fguard_app (the aforementioned entry in config system replacemsg-image):

FortiGate # config system replacemsg-group
FortiGate (replacemsg-group) # edit auth-intf-quarantine
FortiGate (auth-intf-quarantine) # show | grep logo_v3_fguard_app
                background: url(%%IMAGE:logo_v3_fguard_app%%) no-repeat left center;
                background: url(%%IMAGE:logo_v3_fguard_app%%) no-repeat left center;

Once this configuration is imported into FortiManager, any subsequent attempts to install device settings to the FortiGate will result in the error message referenced earlier in this knowledge base article.

Another method of reproducing the issue can be done directly on FortiManager using the following steps:

1. On FortiManager, navigate to Device Manager -> Device & Groups and select the affected FortiGate running FortiOS v8.0.

2. In the upper navigation bar, select System -> Replacement Messages, then select Managed Images.

3. Select Create New, add any Tag name, upload any image under 24KB, then select OK.

The above procedure will silently fail with no error message from FortiManager. When checking the web browser Developer Tools, it is possible to observe an HTTP POST request sent to FortiManager that receives an HTTP 400 Bad Request response with the following payload. This issue will also be resolved as part of Issue 1297379:

{
    "code": -10179,
    "data": {
        "result": [
            {
                "data": null,
                "id": "cb6b8f5c-60f8-4f1f-8746-09f9deaa3727",
                "status": {
                    "code": -10179,
                    "message": "Invalid vdom context. object: MyTestImage. detail: system replacemsg-image. solution: Device vdom is disabled, not allowed to add object with global context."
                },
                "url": "/pm/config/device/FortiGate-61F/global/system/replacemsg-image"
            }
        ]
    },
    "errors": "",
    "message": "Response with errors"
}