Adom upgrade from 5.4 to 5.6 on FortiManager 5.6.2

[Gerrit_Loopmans]

Hi all,

I have an issue when trying to upgrade my ADOM from 5.4 to 5.6.

Anyone has had this issue or knows what is going wrong?

This is the error:

Fail(errno=151):dynamic-interface default mapping has been used

All devices in the Adom have been upgraded from 5.4.4 to 5.6.3

thanks in advance

[ergotherego]

Your picture did not attach correctly, FYI.

[chall_FTNT]

This is likely because default mapping has somehow been enabled on an interface but no value assigned.  

By default, all interface are mapped with per-device mapping & default mapping is disabled.

Solution is to disable default-mapping (or assign a value).  You can disable it manually or a script can be used to accomplish this.

config dynamic interface edit X set default-mapping disable

[tuxerl]

Hi,

I had exactly the same issue.

Reason:  In "Policy Objects" -> "Interfaces" there was an "Interface" as well as a "Zone" defined, which both mapped to the same physical Interface through their Default Mapping.

Removed the "Zone" and upgrade went fine.

best regards,

Tuxerl.

[tuxerl]

Support just confirmed this as a known bug 469958 which will be fixed in the next FMGT release 5.6.3

[ujnetsec]

I am getting this error when i try to upgrade from 5.6 to 6.0 :

Fail(errno=131):datasrc invalid. object: firewall ssl-ssh-profile ssl-exempt address 26. detail: auth.gfx.ms. solution : data not exist

how can i resolve this?

[Prab]

ujnetsec wrote:

I am getting this error when i try to upgrade from 5.6 to 6.0 :

Fail(errno=131):datasrc invalid. object: firewall ssl-ssh-profile ssl-exempt address 26. detail: auth.gfx.ms. solution : data not exist

how can i resolve this?

It could be a bug.

Seems like that an address object is missing under the SSL exemption option in your SSL/SSH inspection profile.

Could you please check if the address object exists under the SSL Inspection profile?

 

You could try creating an object and adding it to the list there.

Thanks & regards,

Prab