Important but non mentioned change from FortiManager 7.2 to 7.4

Question

This just screwed the complete ip interface config on some of our managed FGT:

with FMG 7.4 FOrtinet have changed the behaviour of resolving meta data variables!

In 7.2. it primary uses vdom level in provisioning templates and global level in scripts.

In 7.4. it primary uses global level everywhere!

So be sure to change your per-device-mappings in variables to the global object before you first time deploy the config after you upgraded FMG to 7.4.

To me this is a bit strange since Fortinet themselves in the FMG 7.4 release notes say FMG 7.4 is downwards compatible from 7.0 on.

In case of variables used in scripts/templates its obviously not.

sw2090 · Answer

I forgot to add: in FMG 7.2 there existed fallback. So if the primary mapping does not exist it would fallback to the other one and if both don’t exist would fallback to the default value. This mechanism does no longer exist in FMG 7.4. In 7.4 if the primary mapping does not exist it would use the default value and ignore any other mapping.

Just to give an example:

I create a variable called “identifier”.

I set the default value of this variable to “99”.

I then create a per device mapping for FGT1 using the vdom object with value “50”

I then create a per device mapping for FGT2 using the global object with value “20”

I then use the variable e.g. in a cli provisioning template to set an interface ip address:

set ip 10.$(identifier).223.42/24

I then assign that template to FGT1 and FGT2 and FGT3

If I deploy that with FMG 7.2 the result would be:

FGT1 would be set to 10.50.223.42/24

FGT2 would be set to 10.20.223.42/24

FGT3 would be set to 10.99.223.42/24 (using default value because there is no per device mapping on the variable for FGT3)

If I deploy the exact same constellation with FMG 7.4 the result would be:

FGT1 and FGT3 would be set to 10.99.223.42/23

FGT2 would be set to 10.20.223.42/24

Sign up

Login with SSO

Login to the community

Login with SSO