Technical Tip: Workaround for loss of aggregate interface and related firewall policies after upgrading from FortiOS v7.4.13 to v7.4.14

Description

This article describes the workaround for the loss of aggregate interfaces and related firewall policies after upgrading from FortiOS v7.4.13 to FortiOS v7.4.14.

Scope

FortiProxy v7.4.13 and above.

Solution

Create an aggregate on v7.4.9 like so:

config system interface
    edit "Production"
        set vdom "root"
        set ip 192.168.128.13 255.255.255.0
        set allowaccess ping
        set type aggregate
        set explicit-web-proxy enable
        set explicit-ftp-proxy enable
        set member "port7" "port8"
        set monitor-bandwidth enable
        set role lan
        set snmp-index 14
    next
end

After upgrading to v7.4.14, the Aggregate interface will be lost and the following error will appear:

diagnose debug config-error-log read
>>> "set" "interface" "aggregate" @ root.firewall.address.aggregate address:value parse error (error -3)
>>> "next" @ root.firewall.address.aggregate address:failed command (error 1)
>>> "set" "device" "aggregate" @ root.router.static.5:value parse error (error -651)
>>> "next" @ root.router.static.5:failed command (error 1)

Workaround:

• Save a backup of the v7.4.13 configuration before performing the upgrade.

• Upgrade the device to FortiOS v7.4.14 and download the config file.

• Edit the saved configuration file from v7.4.13 and remove the 'ssl.<vdomname>' interface entries from all VDOMs.

• Replace the first 4 lines from the v7.4.14 config file.

• Restore the modified configuration file to the device.

Important: The order of these steps is important. The upgrade must be completed before restoring the modified configuration.

Related document:
Known Issues (FortiProxy v7.4.14)