Hi FortiExperts,
I am trying to add a configured and operational
A-P Cluster 2x FG1500D (FortiOS 5.4.8) to
a new Fortimanager 5.6.2 running on VMWare.
The Root ADOM (the only one) of the FM is "Fortigate Version 5.4".
During add I get the following Error message in Task Monitor
2018-02-07 17:26:58:reloadconffail 'datasrc invalid. object: dnsfilter profile ftgd-dns filters category 22. detail: 90. solution: data not exist
Indeed, 21 is the last entry in the Fortigate Config:
config dnsfilter profile edit "default" set comment "Default dns filtering." config ftgd-dns config filters edit 1 set category 12 next ......
edit 21 next end end next end
The device is added, but Config Status shows " ? unknown" and policy cannot imported.
Any idea whats wrong and how to fix ?
Thanks,
Frank
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
This sort of error can occur if a FortiGate is downgraded from FortiOS 5.6 to FortiOS 5.4. Additional categories could be left in the FortiGate configuration that are no longer valid for FortiOS 5.4.
I would look for any instances of category 22 in the FortiGate config and remove them.
Thanks for the fast response.
Indeed, the Boxes were delivered with 5.6 and downgraded to 5.4.6 and then up to 5.4.7 to 5.4.8
But there is no reference to a category 22 in the ftgd-dns filter. See below. I only can find "22" in Ports, UUIDs, encrypted passwords etc..
config dnsfilter profile edit "default" set comment "Default dns filtering." config ftgd-dns set options ftgd-disable config filters edit 1 set category 12 next edit 2 set category 7 next edit 3 set category 9 next edit 4 set category 64 next edit 5 set category 2 next edit 6 set category 15 next edit 7 set category 11 next edit 8 set category 66 next edit 9 set category 57 next edit 10 set category 13 next edit 11 set category 8 next edit 12 set category 14 next edit 13 set category 63 next edit 14 set category 67 next edit 15 set category 65 next edit 16 set category 16 next edit 17 set category 88 set action block next edit 18 set category 26 set action block next edit 19 set category 61 set action block next edit 20 set category 86 set action block next edit 21 next end end next end
found a workaround:
In lab I was able to import a vFG 5.4.8 into a FM 5.6.2.
So I deleted all 21 filters above from the 1500D and recreated them
using the 21 filters from a fresh installed virtual 5.4.8 FG Lab system.
Basically the only difference I can see is the order of the entries.
AND
the item without "set"s is now # 11..
in the unimportable config, it was # 21, the last one was without set (see above)
here is what I created and what was imported by fmgr without error messages:
config filters edit 1 set category 2 next edit 2 set category 7 next edit 3 set category 8 next edit 4 set category 9 next edit 5 set category 11 next edit 6 set category 12 next edit 7 set category 13 next edit 8 set category 14 next edit 9 set category 15 next edit 10 set category 16 next edit 11 next edit 12 set category 57 next edit 13 set category 63 next edit 14 set category 64 next edit 15 set category 65 next edit 16 set category 66 next edit 17 set category 67 next edit 18 set category 26 set action block next edit 19 set category 61 set action block next edit 20 set category 86 set action block next edit 21 set category 88 set action block next end
hope this does not screw up any internals somewhere...
Hi Simon,
after adding the FG to the FM and pushing the policy,
I checked the FG config.
there is no line category "90" in the FG config file.
Frank
Can you help for a try on FGT to download a config file, and do a search see if can find config for category 90 ?
Thanks
Simon
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1712 | |
1093 | |
752 | |
447 | |
231 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.