Troubleshooting Tip: Install policy package receviced error '-999 - beyond the boundary'

Description

This article describes how to troubleshoot the error '-999 - beyond the boundary' when performed in policy package installation.

Scope

FortiManager, FortiGate.

Solution

Perform a debug to understand which part of configuration causing the error:

diagnose debug application securityconsole 255

diagnose debug enable

Example outputs:

SECURITY_CONSOLE: Load dynamic obj time: 0 hours 0 minutes 0.002543 seconds.
SECURITY_CONSOLE: (1) [FGT-SPOKE[copy] root] Start copying shared objs to devdb, device(FGT-SPOKE), vdomid(root) (reason:none)
SECURITY_CONSOLE: (1) Using mm method.
TCL error(beyond the boundary).
obj rule
action:permit
flags:0
ge:17
id:1
le:17
prefix:10.119.0.0 255.255.0.0
SECURITY_CONSOLE: (1) [FGT-SPOKE[copy] root] Copy done (reason:none)
SECURITY_CONSOLE: (1) [FGT-SPOKE[copy] root] Commit failed: beyond the boundary - (in Template TestBGP) beyond the boundary (reason:none)
SECURITY_CONSOLE: (1) Compile time: 0 hours 0 minutes 0.207358 seconds.
SECURITY_CONSOLE: (1) Import time: 0 hours 0 minutes 0.019504 seconds.
SECURITY_CONSOLE: (1) Change dvm status time: 0 hours 0

This error is related to BGP configurations specifically on 'config router prefix-list' where when checking on the FortiGate itself, the error is explained in more detail.

FGT-SPOKE (IN) # show
config router prefix-list
    edit "IN"
        config rule
            edit 1
                set prefix 10.119.0.0 255.255.0.0
                set ge 17
                set le 17
            next
        end
    next
end

FGT-SPOKE (IN) # end
Invalid prefix range -- make sure: len < ge-value <= le-value object check operator error, -650, discard the setting

Command fail. Return code -650

This error mentioned 'ge' value must be greater than the prefix length and less than or equal to the 'le' value.

The combinations of 'ge' equal to 17 and 'le' equal to 19, will allow subnets 10.119.0.0/17, 10.119.0.0/18, and 10.119.0.0/19.