Troubleshooting Tip: Cannot install FortiAnalyzer 'set serial' settings

Description

This article describes an issue on FortiManager v7.6 when installing FortiOS v7.6 when the 'set serial' option is set and 'set certificate-verification disable' is used for FortiAnalyzer configurations.

This issue is due to a change in behavior starting from FortiOS v7.6.0.

Scope

FortiManager v7.6.0+, FortiGate v7.6.0+.

Solution

When 'set certificate-verification disable' is used, FortiGate does not require the 'set serial' option and it is not possible to set.

With certificate-verification disabled, the certificate is not checked and the serial setting is therefore effectively not used, even if it was possible to set in older releases. As such, starting from v7.6.0, this option is removed when certificate-verification is disabled.

In FortiManager, this can still be set via 'CLI configurations' and the following errors will prevent any installation to the device:

Under Device Manager -> Device & Groups, select the appropriate FortiGate, select CLI configurations, search for FortiAnalyzer, select settings, then either enable the certificate-verification or delete the serial configuration:

To note: this issue is not caused by an upgrade and is not triggered after an upgrade but can be triggered by manual configuration, specifically when a FortiGate device upgrades, the FortiManager detects the change and when the FortiGate reconnects an automatic auto-retrieve is issued by the FortiManager.

Since this configuration is updated via FortiGate update scripts, the FortiManager retrieves the correct configuration and auto-updates its database.

If auto-update is disabled in FortiManager or a custom CLI Script is used, it is important to modify the script and configuration directly. For more information on the auto-update process, see Auto-update and auto-retrieve.