Question
Issue with address group nesting with FortiOS 5.2
Hi there, My firewall cluster throws me an error when i want to change members of an address group which is member of an other group (nested) When i try to change members is get the error " entry not found" Anyone else having this issue? or could anyone test this on an other 5.2 and 5.0.7 FG? You can test this is as follows: First create some test addresses: FW02A (address) # config firewall address FW02A (address) # edit zztest1 new entry ' zztest1' added FW02A (zztest1) # set subnet 10.0.0.1/32 FW02A (zztest1) # next FW02A (address) # edit zztest2 new entry ' zztest2' added FW02A (zztest2) # set subnet 10.0.0.2/32 FW02A (zztest2) # next FW02A (address) # edit zztest3 new entry ' zztest3' added FW02A (zztest3) # set subnet 10.0.0.3/32 FW02A (zztest3) # next FW02A (address) # end Then create two address groups where the first group is a member of the second FW02A # config firewall addrgrp FW02A (addrgrp) # edit zztestgrp1 new entry ' zztestgrp1' added FW02A (zztestgrp1) # set member zztest1 zztest2 FW02A (zztestgrp1) # next FW02A (addrgrp) # edit zztestgrp2 new entry ' zztestgrp2' added FW02A (zztestgrp2) # set member zztestgrp1 FW02A (zztestgrp2) # next And now try to change members of the first group: FW02A (addrgrp) # edit zztestgrp1 FW02A (zztestgrp1) # set member zztest1 zztest2 zztest3 entry not found in datasource value parse error before ' zztest1' Command fail. Return code -3 FW02A (zztestgrp1) # append member zztest3 entry not found in datasource value parse error before ' zztest3' Command fail. Return code -3 FW02A (zztestgrp1) # unselect zztest2 command parse error before ' zztest2' Command fail. Return code -61 When you remove the first group as a member of the second group all works properly. Hope some of you have time to test this on 5.0.7 and 5.2 setups. - MBR-
