FortiManager install fails with "firewall policy table limit... global limit is 3" despite target FortiGate having 7+ policies configured locally
Environment:
- FortiManager 7.6.1
- FortiGate-VM64-KVM, FortiOS 7.2.0 build1157, Evaluation License (15-day)
- ADOM version 7.2
Issue:
When installing a Policy Package from FortiManager to a managed FortiGate, the install fails with:
Â
Â
post_vdom copy error::(errcode)3 - max entry. object: firewall policy. detail: global limit. solution: limit is 3This strongly implies a hard cap of 3 firewall policies enforced during the FMG→device install process.
However, this is demonstrably NOT a device-side limitation. Running show firewall policy directly on the same FortiGate via console/SSH shows 7 policies already present and fully functional, created locally without any issue:
Â
Â
[paste your 7-policy output here]This proves the FortiGate itself accepts well more than 3 policies. The limit is only encountered when FortiManager performs the install — meaning the restriction lives somewhere in FortiManager's install/validation logic (or possibly an ADOM/device-DB setting), not in the FortiGate's own firewall policy table or its evaluation license.
Questions for the community/Fortinet:
- Is this a known FortiManager-side validation rule tied to ADOM version 7.2, or to the evaluation-licensed VM specifically?
- Is there a setting (ADOM, device profile, or system global) that artificially caps the policy count during install, separate from the device's actual firewall policy table limit?
- Is this expected/documented behavior anywhere, since it does not appear in the standard "VM evaluation license limitations" documentation (which describes a 3-interface/3-route/3-policy cap that clearly isn't being enforced on the device itself in this case)?
Any insight appreciated — this is currently blocking a hands-on FortiManager/SD-WAN Overlay Orchestration lab build.
