Troubleshooting Tip: FortiManager pushes 'set verify-cert disable' with 'server-type tcp', which is not available in FortiGate

Description

This article describes an issue where FortiManager pushes 'set verify-cert disable' under 'config realservers' with 'server-type tcp', which is not available in FortiGate. 

Scope

FortiManager v7.6.5, FortiGate.

Solution

In FortiManager v7.6.5, FortiManager is trying to push the following configuration to FortiGate:

config firewall vip
    edit <name>
        set type server-load-balance
        set server-type tcp
        set extip <IP>
        set extint <interface>
        set extport <port>
        config realservers
            edit 1
                set ip <IP>
                set port <port>
                set verify-cert disable
            next
        end
    next
end

When 'server-type' is set to 'tcp', the configuration 'set verify-cert disable' under 'config realservers' is not available in FortiGate, and this is by design. For this reason, when FortiManager tries to push the above configuration, the installation fails with the message: 'install failed'.

For VIP to be installed, the 'verify-cert' should be changed to 'enable' as below, and then the configuration should be pushed:

config firewall vip
    edit <name>
        set type server-load-balance
        set server-type tcp
        set extip <IP>
        set extint <interface>
        set extport <port>
        config realservers
            edit 1
                set ip <IP>
                set port <port>
                set verify-cert enable
            next
        end
    next
end

The issue is expected to be fixed in FortiManager v7.6.8 and v8.0.2.