Technical Tip: Error code: 2 Protocol error while uploading FortiGate configuration managed by FortiManager in Backup mode ADOM

Description

This article describes a new option in FortiManager to enable the FCP (FortiManager Communication Protocol) service that impacts backup files/Revisions of FortiGate managed by FortiManager.

Scope

FortiManager v7.2.6, v7.4.4, v7.6.0, and above.

Solution

After the FortiManager upgrade, uploading the FortiGate config file managed by FortiManager in Backup mode ADOM will fail with Error code: 2(Protocol error), as shown below:

FG200E-4 (global) # diagnose fdsm cfg-upload test2
Retrieving full config.
Error code: 2(Protocol error)
FG200E-4 (global) #  

This happens as a new option has been added to FortiManager to enable or disable the FCP (FortiManager Communication Protocol) service. By default, it is disabled to avoid unwanted retrieval actions.

FMG-VM64 # config system global
(global)# set fcp-cfg-service
 disable FCP service doesn't process configuration requests from the web
 enable FCP service processes to configure requests from the web.

For FortiGate to be able to upload a Backup file to FortiManager via 'diagnose fdsm cfg-upload test2' or just a simple Autoupdate, the option 'fcp-cfg-service' needs to be enabled in FortiManager. After  'fcp-cfg-service' is enabled in FortiManager, it allows FortiGate to upload its revision to FortiManager via 'diagnose fdsm cfg-upload test2'

FortiManager CLI:

FMG-VM64 # config system global
(global)# set fcp-cfg-service enable
(global)# end

FortiGate CLI:

FG200E-4 (global) # diagnose fdsm cfg-upload test2
Retrieving full config.
Result=Success
FG200E-4 (global) #

This feature works in FortiManager Normal mode and Backup mode ADOM.

Related article:
Technical Tip: How to do bulk retrieve config in FortiManager using a script