Ideas on how to get Fortimanager back in sync after adding VDOM without Fortimanager?

Question

Recently I had to make emergency changes on my 800C Fortigates to add another VDOM while the Fortimanger's contact to the 800Cs was unreliable. I'd started it some in the manager, and then when the push failed, I had to give up and do it directly on the 800Cs.

Now that we've been stable for some time I'd like to get this clean again. At first the manager showed a "conflict" on the device. Perhaps it wasn't the right way, but I went into the dashboard in Fortimanager and looked at "installation preview", which gave a list of commands it wanted to perform on the new VDOM - basically it wanted to remove all the static routes and policy rules. Since the VDOM was only needed during the emergency, I was OK with that. But I couldn't get the manager to push those commands, so I ran them directly on the 800Cs and had the manager "refresh device".

Now the device shows "Modified" instead of "Conflict". Yet looking at the "installation preview" again shows "no differences". And the list of virtual domains still shows the new VDOM I'd tried to add in the list as "Configuration Pending", which it will not permit me to delete.

On a similar thread someone suggested a "Re-install Policy", but that is greyed out for me. Probably I'll need to call support, but I thought if someone had some ideas here first since it isn't urgent. I'm able to manage all the other VDOMs normally since I didn't touch them outside of the manager.

aagrafi · Answer

A quick and dirty solution is to delete the FortiGate from the FMG and re-add it. I know it sounds brutal, but it works and at much less time than trying to fix the problem some other way.

An other way to fix this is by trying to make all changes in the FMG regarding this FG, so that you'll bring it at configuration parity with the FG. But as I said, deleting and re-adding the FG does not look very nice but it works.

Sign up

Login with SSO

Login to the community

Login with SSO