Skip to main content
janro
janro
New Member
January 7, 2021
Question

Errors after 6.0.10 -> 6.2.7

  • January 7, 2021
  • 1 reply
  • 3549 views

FG81, NAT (Flow based), NGFW Mode: Policy Pased.

After upgrading to 6.2.7 I got some config errors.

# diagnose debug config-error-log read

(1) "set" "scan-botnet-connections" "monitor" @ global.system.interface.wan1:command parse error (error -61)

(2) "set" "scan-botnet-connections" "monitor" @ global.system.interface.wan2:command parse error (error -61)

(3) "config" "voip" "profile" @ root:command parse error (error 1)

(4) "config" "dnsfilter" "profile" @ root:command parse error (error 1)

(5) "set" "dnsfilter-profile" "default" @ root.system.dns-server.Cameras:value parse error (error -3)

(6) "config" "firewall" "proxy-policy" @ root:command parse error (error 1)

 

I came back to 6.0.10 and I'm trying to modify the conf before trying upgrade again.

 

I think that rows (1) and (2) are correctable:

https://kb.fortinet.com/k....do?externalID=FD46056 ######################################################################### Row (3): I have never used VoIP profiles (neither default nor strict). I used "set auto-asic-offload disable" on policy that allowed phones to WAN. Now we don't have VoIP phones at all.

In conf:

config system settings   set sip-helper enable   set default-voip-alg-mode kernel-helper-based

end

What should I do with that? ######################################################################### Row (4): What should I do with that?

Row (5): I removed DNS Filter from Network->DNS Servers->Cameras interface ######################################################################### Row (6): biggest question for me. I don't find anything about proxy-policy in conf (of 6.0.10).

 

Unfortunatelly I didn't save the conf of 6.2.7. If there will be no errors after upgrading to 6.2.7 my next step is 6.4.4

    1 reply

    Toshi_Esumi
    SuperUser
    Toshi_Esumi
    SuperUser
    January 7, 2021

    First, if you used "exe set-next-reboot" to swap back to the original boot partition to go back to 6.0.10, your config with 6.2.7 is still in non-active partition. I would swap them in a maintenance window and retrieve the config, then swap it back if I want, which I wouldn't.

     

    Every time we upgrade our boxes to a new major version, we generally get a lot of errors like those since ours have more than a couple of dozens of VDOMs per customer. Unless I know the error is related to used/intentionally configured features, we ignore those and run some time to wait until somebody complains something.

    For many of them the upgrade process doesn't understand previous config database structures since it's changed, so had to ignore the particular part and corrected/defaulted with the new structure.

    Only important part, at least for me, is when the error said something was thrown out due to conflict or something like that. For those, I go back and check why they were thrown out. In most cases, somehow illegal or conflicting config was created (mostly HA related) so some of them needs to be thrown out. In those cases, I have to figure out what was the original intended config before the conflict was created in the past, then fix it.

     

    Otherwise, if you're not confident those errors are ignorable, I would run 6.2.7 at least one day to see any real problems arose before upgrading 6.4.4. I think you're fine with those errors. 

    Terms & ConditionsAccessibility statement