Skip to main content
dtogkas
Staff
dtogkas
Staff
June 12, 2026

Troubleshooting Tip: Policy package installation fails after FortiGate upgrade from v7.2 to v7.4 due to invalid 'fec-state' setting in the FortiSwitch template

  • June 12, 2026
  • 0 replies
  • 20 views

Description


This article describes an issue where, after upgrading a managed FortiGate from FortiOS v7.2 to v7.4 and ADOM v7.2 to 7.4, the installation of the existing policy package from FortiManager fails during the verification phase with an error related to the fec-state setting on a managed FortiSwitch port.


Scope


FortiManager, FortiGate v7.4, FortiSwitch managed by FortiLink, ADOM v7.2 and v7.4.


Solution


After upgrading a managed FortiGate from v7.2 to v7.4 as part of a normal ADOM migration workflow, installing the policy package to the upgraded FortiGate fails. Upgrading the ADOM from v7.2 to v7.4 and retrying the installation produces the same result.

The installation fails while generating the verification report with an output similar to the following:

---> generating verification report
(vdom root: switch-controller managed-switch "Manager Switch S/N" ports "port1": fec-state)
remote original:
to be installed: cl91


Root cause.


This is a known issue when upgrading the FortiGate from v7.2 to v7.4 together with the ADOM from v7.2 to v7.4: the FortiSwitch template attempts to push the command set fec-state cl91 to all switch ports, including RJ45 ports that do not support Forward Error Correction (FEC). The FortiGate rejects the setting on these ports, and the installation fails.


Why the setting is invalid.


FEC is a feature applicable only to high-speed ports. As a reference:

  • FEC is not supported on ports operating at 100M, 1G, 10G, or 40G.

  • FEC can be used on ports supporting 25G, 50G, 100G/200G, and 400G. The cl91 value corresponds to Clause 91 (Reed-Solomon FEC), used for 25G and above.

In the example above, the switch hardware model is a FortiSwitch-T1024E. On this model, only two ports (port25 and port26) support FEC configuration; all remaining ports are standard RJ45 ports, where fec-state cl91 cannot be applied.


Workarounds.

  1. Remove the fec-state configuration from the affected ports through the FortiManager GUI (Managed Switch port settings), then retry the installation.

  2. Remove the fec-state setting from the FortiSwitch template assigned to the switch, then retry the installation.

In both cases, the FEC value cl91 should only remain configured on ports that actually support FEC (on the FortiSwitch 1024E, port25/port26). After removing the invalid fec-state entries, the verification report completes and the policy package installs successfully.

    Terms & ConditionsAccessibility statement