Troubleshooting Tip: FortiManager Dynamic Interface Mapping Errors

tnesh · ‎01-03-2023

Description

This article describes how to troubleshoot dynamic interface mapping errors when installing policy on FortiManager.

Scope

FortiManager.

Solution

Sample error messages during policy installation:

- ADOM interfaces have no mapping.

- Dynamic interface mapping undefined for device <device name>.

- Compiling dynamic interface (port5) fail: invalid_value.

Troubleshooting:

1) Go to Policy & Objects -> Object Configurations -> Normalized Interface.
2) Search the interface and select 'Edit'.

3) Verify if the normalized interface is correctly mapped and has a valid value.
4) If the Normalized interface is not mapped to the device interface, make sure to map it with the correct device interface.

5) If the mapped device interface is no longer in use, remove it from the Normalized Interface mapping.
6) Once the above has been rectified, proceed to install the policy again and verify the result.

Advanced troubleshooting:

1) To get more detailed information, run the below command from FortiManager CLI:

# diag debug application securityconsole 255

# diag debug enable

2) Proceed to install the policy.
3) Check the command output and locate for the error message

Sample output (with error):

SECURITY_CONSOLE: Installing dynamic interface
copy dynamic interface.(soid=6810) to dparent=3, :fail.
SECURITY_CONSOLE: [fmg[copy] root] "Compiling dynamic interface (port5) fail: invalid_value"
SECURITY_CONSOLE: Installing dynamic interface completed - 10 entries installed, 1 errors

4) Proceed to rectify the Normalized Interface based on the error message.
5) Once the above has been rectified, proceed to install the policy again and verify the result.