Question
Fortigate 40F v7.2.11 loses part of config
Hi all,
I have around 45 FortiGates 40F-3G4G with FortiOS version 7.2.11 that I registered with a FortiManager-VM version 7.4.7. It happened to me about 6 times that our Fortigates lost part of their configuration after a sudden power outage. All settings for IPSec VPNs disappeared, together with policy and static route that were referencing them. Among settings that remained are central management address and tunnel interface that was associated with the VPN:
Interfaces list screenshotI'm using the following pre-run CLI script in FortiZTP:
config system global
set timezone 29
end
config vpn ipsec phase1-interface
edit "Administrative"
set interface "wwan"
set ike-version 2
set peertype any
set net-device disable
set mode-cfg enable
set proposal aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256
set localid "{{fgt-sn}}"
set dhgrp 19 18 17
set remote-gw <HQ_IP_address>
set psksecret <PSK>
next
end
config vpn ipsec phase2-interface
edit "Administrative"
set phase1name "Administrative"
set proposal aes256-sha256 aes256gcm chacha20poly1305
set dhgrp 19 18 17
set auto-negotiate enable
next
end
config firewall policy
edit 0
set name "Admin->Admin"
set srcintf "Administrative"
set dstintf "Administrative"
set action accept
set srcaddr "none"
set dstaddr "none"
set schedule "always"
set service "ALL"
set comments "Policy needed to start the administrative VPN"
next
end
config router static
edit 0
set dst <HQ_IP_address> 255.255.255.255
set device "wwan"
set dynamic-gateway enable
next
edit 0
set dst {{fmg-ip}} 255.255.255.255
set device "Administrative"
next
end
config system central-management
set type fortimanager
set allow-remote-lte-firmware-upgrade enable
set serial-number "{{fmg-sn}}"
set fmg "{{fmg-ip}}"
end
I found some information about VPNs disappearing, but none of the cases were exactly like mine. Is this any known bug in 7.2.11 version? Should I upgrade to 7.4?
Thanks!