Debugging Interface Errors at Boot - Unusual Grouping of Interfaces In the Errors

[hillsitsupp]

Hi

On a Fortigate 200E running 7.4.7, I see interface errors when watching the boot from the console after restoring a saved config. All interfaces still work, but I want to eliminate the errors.

diagnose debug config-error-log read
>>> "edit" "byod wifi" @ 35095:system.interface.Temp Mail DMZ 2:command parse error (error -61)
>>> "next" @ 35097:system.interface.Temp Mail DMZ 2:failed command (error 1)
>>> "edit" "PIE" @ 35146:system.interface.LANTrunk:command parse error (error -61)
>>> "next" @ 35148:system.interface.LANTrunk:failed command (error 1)

I'll be removing the spaces from interface names during the edit.

How do I interpret these errors? For example, the first one. Nowhere in the config does "byod wifi" interact with "Temp Mail DMZ 2". There's no config involving both of those interfaces. They don't exist next to each other anywhere in the config, so there's no missing "next" that would make them run-on in the config.

The only overlap I can think of would be policies with "all" as srcaddr or dstaddr.

I ran a diff-compare between the running config and the saved, and there's no difference in policies, interfaces, or objects.

[AEK]

This is probably  because the config file you restored doesn't match the right FortiOS version (e.g.: restored a 7.6.1 backup on a 7.6.4 FortiOS).

If you want a clean config, install the right firmware version on your FGT (the same as backup file), do a factory reset, then restore the backup file.

But first make sure that your backup file doesn't contain the error inside it.

[hillsitsupp]

The backup was taken 6 hours before it was restored. There was no change in the FortiOS version installed on the firewall in that time.

[AEK]

Then are you sure the errors were not here before?

When you restored the config, do you still see the interfaces shown in the error log?

You can clean these errors by editing the backup file, correct the "config system interface" problematic portion, or delete the problematic portion if the impacted interfaces are not needed, then restore the backup.

[hillsitsupp]

I don't usually watch the console when booting, so the errors could have been there for a while. I was only watching it this time as I restored via the console. I haven't had to restore from backup before.

I've added running diagnose debug config-error-log read after reboots to our procedures.

I'm changing a single in-use interface to an aggregate, so I have to manually edit. I applied the edited config, saw the errors, and rolled back to the unchanged config just to make sure I could. But the unchanged config  gave me similar errors. I spent the rest of the outage window confirming everything was still working correctly.

I really can't see any mistakes in the config when editing it manually. I think I'll raise a ticket. Thanks for taking a look.

[AEK]

In the edited config file, is the aggregate interface defined after the interfaces composing the aggr?

[hillsitsupp]

Yep, the interface definition order goes physical interfaces --> aggregate interfaces --> VLAN interfaces using aggregates.

[Toshi_Esumi]

Why did you need to edit the config file and upload while you can add a new interface into an existing LAG interface???

config sys interface
  edit [LAG_name]
    append member "[new_member_interface_name]"
  next
end

You can do it in GUI as well.

Toshi

[Toshi_Esumi]

Ok, I mistook your comment. You swapped a single interface with an aggregate interface. 
Then I'd like to ask if you searched those all individual interface names, which are now in the LAG, through the config to make sure those are NOT used in any part of your config.

Toshi

[hillsitsupp]

Yep, I did an exhaustive find/replace to swap references to the single port interface to the new aggregate interface.

Keep in mind I still get similar errors after reverting back to the original unedited config.

I'm starting to suspect it's to do with two interfaces having spaces in their names. I'm going to try again, renaming the interfaces with spaces. I don't have an outage window for a few more days unfortunately.