Troubleshooting Tip: FortiGate incorrectly adding 'ffff' in the beginning of the FortiManager IP connector after upgrading to 7.4.7

MichaelTorres · ‎03-26-2025

Description

This article describes a behavior where users upgrade the FortiGate to 7.4.7 and the IP in the FortiManager connector is changed to '::FFFF:X.X.X.X'.

Scope

FortiGate 7.4.7 and FortiManager 7.4.6.

Solution

Users configure in FortiGate a Fortimanager for the central management settings.

config system central-management
    set type fortimanager
    set serial-number "FMG-VMxxxxxxx"
    set fmg "192.168.3.4"
    set fmg-source-ip 1.1.1.1

end

After upgrading to version 7.4.7, in the begging of the FortiManager IP, the parameter 'ffff' gets added.

config system central-management
    set type fortimanager
    set serial-number "FMG-VMxxxxxxx"
    set fmg "::ffff:192.168.3.4"
    set fmg-source-ip 1.1.1.1

end

This can cause FortiGate to change the source IP used for the communication. Run the following debugs to verify:

diag debug reset
diag debug application fgfmd -1
diag debug console timestamp enable
diag debug enable

In the debugs, it can be seen:

allow-push-firmware : enable
allow-remote-firmware-upgrade: enable
allow-monitor : enable
serial-number : "FMG-VMxxxxxxx"
fmg : "::ffff:192.168.3.4"
fmg-source-ip : 5.5.5.5 <- FortiGate uses an IP different from the one configured in the connector.
fmg-source-ip6 : ::

Workaround:

Delete the 'ffff' in the FortiManager IP through FortiGate GUI in the section 'Security Fabric - Fabric connector - Central management'.

Note: When trying to modify the IP through the CLI, FortiGate shows an error regarding the FortiManager Serial Number.

Restart the fgfmd process.

fnsysctl killall fgfmd

Refresh the FortiGate connector in FortiManager side.

Fix schedule:

Upgrade to versions 7.4.8, 7.6.1.

Troubleshooting Tip: FortiGate incorrectly adding 'ffff' in the beginning of the FortiManager IP connector after upgrading to 7.4.7

You are leaving our website