Skip to main content
sw2090
SuperUser
sw2090
SuperUser
February 16, 2024
Solved

FortiManager deployment problems after FGT Upgrade to 7.0.14

  • February 16, 2024
  • 17 replies
  • 10722 views

I did the following:

 

- upgraded FMG to 7.0.11 while the FGT still were on 7.0.13 => everything still worked fine afterwards

- upgraded the FGT to 7.0.14 during the next night (scheduled) => since then FGT keep losing the connection to FMG when I deploy policy package or device config. Results in the deployment timing out after some time. 

During a TAC session it helped to reboot FMG (and perform fsck on it with that) and then retrieving config of FGT and then deploy it. After this deploying of policy package worked fine until now.

Now just deployed the device config only on a FGT and it got disconnected from FMG again...

 

However they come back after some time...

    Best answer by sw2090

    got the new interim FOS build yesterday and it finally seems to have broought us to the right path. 

    This build finally outputted an additional message saying that the FMG certificate could not be re-verfified by the fgt because of the issuer. And that issue gave me the clue I needed to finally find the culprit. 

    It was in fact DPI in effect on the FGT to FMG policies. This was set long time ago and it never caused issues until fos 7.0.14. Since 7.0.14 this is an issue. 

    Once I disabled DPI on those policies everything came back up and works fine again.

    17 replies

    Show previous replies
    sw2090
    SuperUser
    sw2090Author
    SuperUser
    May 14, 2024

    I meanwhile also assume it is not  a certificate issue as reported before. I saw a FGT throwing the exact same certificate error in FGFM debug log but the reason it did not come online in FMG was that the FGT IP in FMG was wrong in this single case.

    I also have gotten an interim build of 7.0.14 for FGT100F that has more debugging capabilities. It even provides me with shell access to the os itself. But even that does not give me enough information to find the culprit.

    sw2090
    SuperUser
    sw2090Author
    SuperUser
    May 14, 2024

    I have to admit that TAC did provide me the bug it but I've overseen it in the ticket :\

    Here it is;

     

    1004231 - 1460: After upgrading FGT from 7.0.13 to 7.0.14, start loosing FMG connections because of fatal unknown CA

      AEK
      SuperUser
      AEK
      SuperUser
      May 14, 2024

      Thanks for the update.

      So you have the $1M FOS version (shell access). Try take full advantage of it :)

      AEK
      sw2090
      SuperUser
      sw2090Author
      SuperUser
      May 15, 2024

      yeah and I got it for free :)

      sw2090
      SuperUser
      sw2090Author
      SuperUser
      May 21, 2024

      TAC said I'm gonna get a new interim FOS build for further debugging. Developers are still doing some sanity tests before I get it. 

      Issue is still pending bugfix...

      sw2090
      SuperUser
      sw2090AuthorAnswer
      SuperUser
      May 23, 2024

      got the new interim FOS build yesterday and it finally seems to have broought us to the right path. 

      This build finally outputted an additional message saying that the FMG certificate could not be re-verfified by the fgt because of the issuer. And that issue gave me the clue I needed to finally find the culprit. 

      It was in fact DPI in effect on the FGT to FMG policies. This was set long time ago and it never caused issues until fos 7.0.14. Since 7.0.14 this is an issue. 

      Once I disabled DPI on those policies everything came back up and works fine again.

        AEK
        SuperUser
        AEK
        SuperUser
        May 23, 2024

        Thanks for sharing.

        So how to do if you want to configure deep inspection?

        AEK
        sw2090
        SuperUser
        sw2090Author
        SuperUser
        May 23, 2024

        either do not enable it on policies for the FMG<->FGT connection or make sure that all FGT have the issuer ca  you use for deep inspection so they can still verify FMG's certificate.

          sw2090
          SuperUser
          sw2090Author
          SuperUser
          June 10, 2024

          The biggest thing with this is that the usuall FGFM Debuglogs don't show you the actual certificate.

          It just reports the CAs and the error itself.

          Only the last interim build reported the actuall certificate.

          Terms & ConditionsAccessibility statement