Skip to main content
Dan_Eng52
Dan_Eng52
Explorer III
March 10, 2025
Question

Security Fabric stuck "connecting" - Management IP contains illegal characters

  • March 10, 2025
  • 3 replies
  • 2283 views

Hi all, 

 

I hope you're well. 

 

I am having issues connecting our branch firewalls to our fabric root FortiGate. All the configuration is correct as prior to upgrading all firewalls to 7.4.7 this was working just fine. Post upgrade to 7.4.7, we found that the set group-name "NAME" command was stripped from the security fabric configuration. This configuration was re-applied, and we can now see communication between the branch firewalls and fabric root on port 8013 however when running a sniffer, I get the below: 


Illegal Characters Screenshot.jpg

 

It seems as though that when it tries to validate it doesn't like the admin port that is configured which is not a default port. I have tried setting this to "Use Admin Port" as well as "Specify" but am still having the same issue. I am not sure as to what else I can change, changing the management port is not possible but I feel it would display the same behaviour no matter what this was set to. 

 

Has anyone come across this issue before and have any ideas on how to resolve? 

Many thanks, 

Dan. 

3 replies

Dan_Eng52
Dan_Eng52Author
Explorer III
March 11, 2025

@Anthony_E can you please assist in finding a possible solution? Many thanks, Dan. 

Jean-Philippe_P
Staff & Editor
Jean-Philippe_P
Staff & Editor
March 11, 2025

Hello Dan_Eng52,

 

Please note that Anthony is a Technical Writer and has no Technical knowledge (as for me).

 

Can you tell me if that helps:

 

If the Security Fabric is stuck on "connecting" and the management IP contains illegal characters, follow these steps to resolve the issue:

  1. Verify IP Address Format: Ensure that the management IP address is correctly formatted. It should only contain numbers and periods (e.g., 192.168.1.1).

  2. Check Configuration:
    - Access the FortiGate and FortiNAC configuration settings.
    - Verify that the management IP address is correctly entered without any illegal characters.

  3. Correct Illegal Characters: If illegal characters are present, correct the IP address to a valid format.

  4. Restart Services: After correcting the IP address, restart the necessary services on both FortiGate and FortiNAC to apply the changes.

  5. Monitor Logs: Check the system logs for any errors or warnings related to the IP address configuration.

  6. Test Connectivity: Once changes are made, test the connectivity between FortiGate and FortiNAC to ensure the Security Fabric is functioning correctly. If the issue persists after following these steps, further investigation into the network configuration and settings may be required.

Hope it can help you otherwise I will seek assistance to help you.

 

Thanks.

Jean-Philippe - Fortinet Community Team
    AEK
    SuperUser
    AEK
    SuperUser
    March 11, 2025

    Hi Dan

    Can you share the output?

    show full config sys global | grep management

    You can hide the IP (but keep visible any extra character, if any).

    AEK
      Dan_Eng52
      Dan_Eng52Author
      Explorer III
      March 11, 2025

      Hi AEK, 

       

      Please see output below: 

       

      Output.jpg

       

      I'm not quite sure why it is complaining about illegal characters, it wasn't doing this prior to upgrading to 7.4.7 so I am hoping this is not a bug that has been introduced. 

      Let me know your thoughts. 

      Thanks, 
      Dan. 

      Benjamin_B
      Benjamin_B
      New Member
      August 8, 2025

      Hello Dan,

      I dunno if you fixed the issue yet, but I had a ticket open with support about this same issue (also after migrating to 7.4.7), and the problem was the custom port for the mgmt interface on the downstream fortigate.

      The issue was solved by reverting the HTTPS port to the default one in System > Settings > Administration Settings

      Seems it has been fixed in 7.4.8

      1068310:  CSF root cannot accept downstream device with authorization-request-type serial/certificate with non-default management port.

       

      Regards

      Terms & ConditionsAccessibility statement