FortiManager supports network operations use cases for centralized management, best practices compliance, and workflow automation to provide better protection against breaches.
Article Id 276722


This article describes how to troubleshoot the install policy package and the error 'error firewall addrgrp - xxx :44 - address'.




FortiManager, FortiGate.




Performing a debug on FortiManager will show associate firewall addresses because it failed to install:


Debug command:


diag debug application securityconsole 255

diag debug enable


Debug output:


SECURITY_CONSOLE: copy all policies: 0 hours 0 minutes 0.050321 seconds.
__add_reference_core,2478: soid=3569, mobj=fw_policy.dstaddr, Test Group fail. <- ('Test Group' is the Address Group and is assigned to the destination address in the policy).
add 1 fail references back to pending list 
SECURITY_CONSOLE: (1) [Bezza-kvm08[copy] root] post commit check fail: firewall addrgrp - Test Group - address (reason:none)
SECURITY_CONSOLE: (1) [Bezza-kvm08[copy] root] post_vdom copy error:firewall addrgrp - Test Group :(errcode)44 - address (reason:none)
SECURITY_CONSOLE: (1) [Bezza-kvm08[copy] root] Copy rollbacked, due to error (reason:none)
SECURITY_CONSOLE: (1) Compile time: 0 hours 0 minutes 0.588362 seconds.


error firewall addgrp.png


The debug explains what caused it to fail, but does not mention why. The reason for this installation error is due to the object address in the address group is associated with a different interface, which is not supported by FortiGate by design.

fmg address group.png


In FortiManager, an address group will be successfully created without throwing an error but this behavior is different when checking on FortiGate itself. It will throw a warning message if the members are assigned with a different interface.


fgt config address group.jpg.png


In the current design, members in the address group with different interfaces are not supported. Proceed to change the address object interface to 'any' or the same interface with other members to rectify this install error.


Related article:

Troubleshooting Tip: Solving the 'copy' error that occurs while installing the policy package / data....