Troubleshooting Tip: FortiManager policy package install fails due to unsupported bandwidth-unit setting

Description

This article discusses how to troubleshoot and resolve FortiManager policy package installation failures caused by the unsupported bandwidth-unit setting under Per-IP Shaper profiles.

Scope

FortiManager/FortiManager Cloud.

Solution

During policy package installation from FortiManager to FortiGate, the installation may fail if FortiManager attempts to push the bandwidth-unit setting under a Per-IP Shaper profile.

For example, FortiManager may try to install the following command:

set bandwidth-unit mbps

The installation log may show an error similar to the following:

config firewall shaper per-ip-shaper
edit "test_profile"
set bandwidth-unit mbps
next
end

generating verification report

(vdom root: firewall shaper per-ip-shaper "max-per-ip-5mbps":bandwidth-unit)
remote original:
to be installed: mbps

install failed

The 'bandwidth-unit' parameter is used to define the bandwidth unit for traffic shaping, such as kbps, mbps, or gbps.
However, this parameter is not supported on FortiGate models running on 32-bit processors. It is only available on FortiGate models with 64-bit processors.

Because of this, if the FortiManager ADOM or policy package database contains the bandwidth-unit setting for a Per-IP Shaper profile, FortiManager may attempt to push this setting during installation. Since the target FortiGate does not support the command, the policy package installation fails.

To confirm whether the bandwidth-unit setting exists in the FortiManager database, run the following command from the FortiManager CLI:

execute fmpolicy print-adom-object <ADOM name or ID> 1365 <per-ip-shaper profile name>

Example:

execute fmpolicy print-adom-object root 1365 test_profile

If the setting exists, the output may look similar to the following:

config firewall shaper per-ip-shaper
edit "test_profile"
set max-bandwidth 5
set bandwidth-unit mbps
next
end

Check the output and confirm whether bandwidth-unit is present under the Per-IP Shaper profile.

To resolve the issue, remove the unsupported 'bandwidth-unit' setting from the FortiManager database.
This can be done by creating a FortiManager CLI script and running it against Policy Package & ADOM Database.

Use the following script:

config firewall shaper per-ip-shaper
edit <profile_name>
unset bandwidth-unit
next
end

Example:

config firewall shaper per-ip-shaper
edit "test_profile"
unset bandwidth-unit
next
end

This removes the unsupported bandwidth-unit setting from the Per-IP Shaper profile stored in the FortiManager database.

After the script completes successfully, reinstall the policy package.
The installation should then proceed without the 'bandwidth-unit' error.