Technical Tip: Resolving an installation failure from FortiManager to FortiGate v7.4.10+/v7.6.3+ for limit on shaping-entries under shaping-profile

After an upgrade of FortiOS to v7.4.10/v7.6.3 or higher, install issues can be observed from FortiManager in the format as follows:

------- Start to retry --------  MY_FIREWALL config firewall shaping-profile MY_FIREWALL (shaping-profile) edit "MY_SHAPING_PROFILE" MY_FIREWALL (MY_SHAPING_PROFILE) config shaping-entries MY_FIREWALL (shaping-entries) edit 1 MY_FIREWALL (1) set limit 1000 MY_FIREWALL (1) next  ---> generating verification report (vdom root: firewall shaping-profile "MY_SHAPING_PROFILE" shaping-entries 1:limit) remote original: to be installed: 1000  <--- done generating verification report

This happens when FortiGates are set up with a shaping-profile with type set to policing. When the FortiGate does not have a shaping profile configured, or its type is set to queueing, this article does not apply.

This is because the default value of the limit got changed on FortiOS for the shaping-entries, as shown from:

• config firewall shaping-profile 7.4.10 
• config firewall shaping-profile 7.6.3

In these versions, the previous default value is set to 1000. The 1000 is also the value that FortiManager utilizes by default, and thus it worked fine on earlier versions because by default it does not push the value. However, as the default changed on FortiOS, it does push the value, but the limit parameter is only applicable to shaping profiles of the queueing type.

There are a couple of other settings for which the default value changed, as well as indicated from the document FortiManager 7.6.6 and FortiOS 7.4.10 & 7.4.11 compatibility issues on the compatibility between FortiManager v7.6.6 and FortiGate v7.4.10 and v7.4.11. Note that it is also relevant for FortiManager 7.4 versions because it is just a change on the FortiGate, actually.

To resolve the installation failure from FortiManager to FortiGate, follow these steps:

1. Log in to the FortiManager and go to Policy & Objects -> Advanced.
2. Go to CLI Configurations -> firewall -> shaping-profile.
3. Edit the shaping profile(s) being used by the firewall with the install failure.
4. In the shaping entries section, edit each entry and set the limit value to 100 (the default value on FortiManager is 1000), which is the default value for FortiGate versions 7.4.10/7.6.3 or higher.
5. Save the changes to the shaping profile.
6. Push the changes from the FortiManager to the FortiGate again, using Install Policy Package & Device Settings.