7.6.7 Registration woes
Trying to get FortiGate VM 7.6.7 registered and controlled by FortiMan VM 7.6.7
- Cert is used as part of the authentication, the serial number is expected to be in the cert as the CN, but its not
- We can see this by using debugs
diagnose debug reset
diagnose debug enable
diagnose debug application depmanager 0
diagnose debug application depmanager 255
diagnose debug enable
- Clearly the serial number is required
{ "id": 1, "result": [{ "status": { "code": 5, "message": "device serial number conflicted"}, "url": "start\/probe\/session"}]}
- We can get passed the serial number issue by creating a new cert
- i found that i have to use this low key size of 512, anything higher wont be accepted
openssl req -x509 -newkey rsa:512 -nodes -keyout fmg_tunnel.key -out fmg_tunnel.crt -days 365 -subj "/CN=MYSERIAL/O=Fortinet/OU=Lab"
openssl pkcs12 -export -legacy -out fmg_tunnel.pfx -inkey fmg_tunnel.key -in fmg_tunnel.crt
- and now the issue is different
{ "client": "\/bin\/dvmcmd:5115", "id": 2, "method": "exec", "params": [{ "data": { "host": "192.168.83.136", "passwd": "******", "usr": "admin"}, "target start": 1, "url": "probe\/device"}], "root": "deployment", "session": -1}
Chkperm Response [/bin/dvmcmd:5115:2]:
{ "id": 2, "result": [{ "status": { "code": 0, "message": "OK"}, "url": "probe\/device"}], "session": -1}
start_dmsvc_probe_device,854: dev_oid=0, host=192.168.83.136, flags=0x0
__enter_state,499: dev_oid=0, start check_reachable
__enter_state,499: dev_oid=0, start start_probe_session
Request [dmserver:937:4]:
{ "client": "dmserver:937", "id": 4, "method": "exec", "params": [{ "data": { "detect_only": 0, "force_probe": 0, "ip": "192.168.83.136", "passwd": "******", "usr": "admin"}, "url": "start\/probe\/session"}], "root": "fgfm"}
Start probe_dev.start_probe_session ...
Response [unknown-daemon:4]:
{ "id": 4, "result": [{ "status": { "code": 1, "message": "internal error"}, "url": "start\/probe\/session"}]}
__on_state,505: dev_oid=0, start_probe_session, done, events=8 r=0
__on_probe_session_cb,326: dev_oid=0, probe session failed, error 1(error)
__fgfm_cb,683: error: probe_status=1, proto=1, r=-15
__p_o_cleanup,612: cleanup...
__p_finish,603: status=-15, has_devinfo=0
__write_rpc_to_shm_fd, Response [/bin/dvmcmd:5115:2] to 17:
{ "id": 2, "result": [{ "status": { "code": -35007, "message": "Fgfm protocol error"}, "url": "probe\/device"}]}
__o_cleanup,121: fgfm probe cleanup…
- and now the issue is different, i suspect that its saying that it does not like the cert being used
FortiManager config config system global
set enc-algorithm low
set fgfm-allow-vm enable
set fgfm-ssl-protocol tlsv1.0
set usg enable
end