FortiGate Next Generation Firewall utilizes purpose-built security processors and threat intelligence security services from FortiGuard labs to deliver top-rated protection and high performance, including encrypted traffic.
This article describes what is the meaning of warning messages about application IDs 48976 and 48977.
Scope
FortiGate.
Solution
To check the config error log, it is required to configure 'diagnose debug config-error-log read', and the application ID 48976 and 48977 will be prompted especially for recent firmware upgrades as shown below:
diagnose debug config-error-log read Warning: bad application ID 48977 in application.group.Communication Application.application. Warning: bad application ID 48976 in application.group.Communication Application.application.
The application id 48976 is the signature name for 'Microsoft.Teams_File.Upload', and id 48977 is the signature name for 'Microsoft.Teams_File.Download', both signatures have been merged with the function of Teams and SharePoint due to Microsoft update in the service.
To detect the Teams file download feature, use the official signature 'Microsoft.SharePoint_File.Download' and 'OneDrive_File.Download'. To detect the Teams file upload feature, use the official signature 'Microsoft.SharePoint_File.Upload', and 'OneDrive_File.Upload'.
