Troubleshooting Tip: FortiGate is Out-of-sync in the Device Manager

Description

This article describes how to solve an issue where the 'Device Manager' page in FortiManager indicates the FortiGate status is Out-of-sync.

Scope

FortiManager v5.6 and above, FortiGate.

Solution

First, check the Compatibility Tool.

Retrieve the config on the device, as shown below:

It is also possible to use the FortiManager CLI to retrieve the configuration:

diagnose test deploymanager reloadconf <OID>

To find the device OID, use the following command:

diagnose dvm device list

If the changes were applied to policies or objects used in any policy, import the policies again:
Select the unit in the Device Manager page and select Import Policy to launch the import wizard. Use the wizard to import the policies and objects.

In FortiManager v7.x.x, the wizard additionally grants the option to import FortiAP and FortiSwitch profiles.

Select the policy profile name to use:

Choose one of the following options:

• Keep and import the FortiGate object entity into the FortiManager policy package database. 

• Keep the FortiManager database as-is. (It is common practice to import the object from the FortiGate if the one running in the live network is trusted.)

Policy differences may result if the FortiGate object is imported multiple times and the content is different in each one. For example, the object printer_server may have different IP addresses in the first FortiGate and the second FortiGate.

If the FortiAP and FortiSwitch profiles were selected to be imported from the FortiGate, the following screen will appear:

Afterward, the device database and policy package will be fully synchronized:

Run a policy package Install Wizard on the FortiGate(s) to finalize the sync process:

Troubleshooting:

If the retrieval itself is unsuccessful or throws an error, enable the following debugs on the FortiManager:

diagnose debug timestamp enable
diagnose debug application depmanager 255
diagnose debug enable
diagnose test deploymanager reloadconf <OID>

If the import operation fails, enable the following debugs on the FortiManager:

diagnose debug service cdb 255
diagnose debug enable

If the install operation fails, enable the following debugs on the FortiManager:

diagnose debug application securityconsole 255
diagnose debug enable

To disable the debugs:

diagnose debug disable
diagnose debug reset

Related articles:

Technical Tip: How to fix synchronization issue in FortiManager

Technical Tip: How to manually upload FortiGate configuration to FortiManager to synchronize configuration status

Troubleshooting Tip: FortiManager error 'datasrc invalid. object: webfilter profile ftgd-wf filters.xx:category. detail: xxx.'