Technical Tip: Understanding out-of-sync policy package status for managed devices after importing policies & objects

[jasonhong]

Description	This article describes the scenario where there is an out-of-sync policy package status for managed devices after importing policies & objects for a specific managed device.
Scope	FortiManager.
Solution	In order to simulate the scenario where a policy package status for a managed device automatically goes out-of-sync, there will first be two managed devices with both policy packages (FGT1 & FGT2) in the 'Synchronized' status as shown below. For this example, the av-scan value (Block) from the AntiVirus profile 'default' is used in a firewall policy and imported successfully into the FortiManager ADOM database. Entity Object value Status FGT1 av-scan = block Synchronized FGT2 av-scan = block Synchronized FMG ADOM av-scan = block Synchronized As some changes are processed in the AntiVirus Scan value from 'Block' to 'Monitor' from the AntiVirus profile 'default' in the locally managed device (FGT2), the policy package status for FGT2 will automatically be changed to out-of-sync in FortiManager Device Manager. This is because FortiManager has detected a conflict in the object value of the local managed device which differs from the value imported previously into the FortiManager ADOM database. Entity Object value Status FGT1 av-scan = block Synchronized FGT2 av-scan = monitor Out-of-Sync/Conflict FMG ADOM av-scan = block Synchronized Now try to synchronize the policy package status for FGT2 by re-importing the policy & objects via the Import Wizard. During the import process, FortiManager will detect a conflict and prompt the user to choose whether to use the value from FortiGate (av-scan = monitor) or FortiManager (av-scan = block). Users will also be able to view or download the conflict file. Suppose choosing to use the value from FortiGate (av-scan = monitor) and proceed with the import process successfully. In that case, the policy package status for FGT1 will be automatically changed to modified/out-of-sync status. This is because FortiManager has detected a conflict in the object value (av-scan) of FGT1 which differs from the object value imported previously into the FortiManager ADOM database. Entity Object value Status FGT1 av-scan = block Out-of-Sync/Conflict FGT2 av-scan = monitor Synchronized FMG ADOM av-scan = monitor Synchronized The above scenario explains how policy package synchronization works in FortiManager. If there are firewall objects shared among more than one managed device in the same FortiManager ADOM with different values for the same firewall object, the policy package status for both managed devices cannot be synchronized together at the same time. Related Articles: Technical Tip: Configuration import from the device to the ADOM DB / Policy & Objects Troubleshooting Tip: FortiGate is Out-of-sync in the Device Manager