Troubleshooting Tip: Unable to delete object when the object is not used in the device

Description

This article describes troubleshooting steps and checks when unable to delete an object that is not used. The object used as an example in this article is SSID or wireless VAP.

Scope

FortiManager.

Solution

To delete an object within FortiManager, the object must first not have any reference to the managed device.

To identify the reference, the following methods can be used:

1. Select the object -> More -> Where Used.

2. Or, 'right-click' the object -> Where Used.

In this case, the 'Where Used' indeed showed the usage of the object:

The new ones are already configured and pushed to the managed devices. The old one is no longer used, but it is still showing references.

Confirmed in the device database of the managed device that it is using the new set of configurations instead of the older one:

At this point, it is safe to assume a database issue within the FortiManager, and the following command can be used to verify:

diagnose dvm check-integrity
diagnose pm2 check-integrity all
diagnose cdb check adom-integrity
diagnose cdb check update-devinfo
diagnose cdb upgrade check +all
diagnose cdb check policy-packages

The commands will return an error and will prompt for a fix. Note to take a configuration backup before proceeding with the fix.

In this case, the following output can be seen from 'diagnose dvm check-integrity':

VDOM dirty flag error: <Truncated firewall name> (oid=672), reason: vdom root dirty flag inconsistent between device DB and DVM VDOM table.
0 change(s) will be made (1 error(s)

The FortiManager able to identify the inconsistency but as the output stated, 0 changes will be made. After running the fix, the issue persists.

In this case, to safely remove the dependency of the object, the device from the output needs to be removed and re-added. The following steps can be taken:

1. Take a configuration backup of the FortiManager.

2. Delete the device, navigate to Device Manager -> Device & Groups -> Select the device -> Delete. At this stage, all of the referencing will also be removed.

3. Re-add the device and re-assign the policy/AP profile and proceed with installation. By right, there are no changes from the FortiManager if all of the references are re-added prior to deletion

The object that was unable to be deleted before can now be deleted, and the command 'diagnose dvm check-integrity' will now return no error.