FMG Revision - Config issues when used for recovery

[betodejj]

Hi all, 

please does anyone have had issues when trying to use the FMG Revisions config files (FMG 6.4 or 7.0) in order to recovery a device (RMA for example)? 

I have simulated a recovery process (assuming FMG is not accessible - isolated location) into our lab, downloading and pushing FMG Revision to a completed new device (same model and same version) via CLI & USB and config was incomplete due a lot of config errors (diag debug config-error-log read) - no chance to be on production.

The only way that worked fine was when I used the backup config file downloaded direct from the GUI.

Are FMG devices Revisions not accurate to be used as config files during RMA for example? or do they need adjustments?

Thanks

FortiManager 

[Toshi_Esumi]

We're currently running our FMG-VM with 7.2.4. I tested a hardware swap by uploading the latest revision of old one's config a couple of times in the past with probably 6.4.x and 7.0.x at those times.
I didn't encounter any particular config issues other than the process took unreasonably very long time to just upload the config and sync.
I suggest you open a ticket at TAC then get it looked at. Especially when it happens in LAB environment, it's easy to recreate the situation and TAC person can look at each error.

Toshi 

[betodejj]

Hi @Toshi_Esumi tks for the update here, please did you push it from FMG right?

I am simulating here a push of the Revision downloaded from FMG via CLI & USB to the new device (locally) assuming cases where FMG is not reachable  (remote locations connected via VPN where for some reason VPN tunnel is down - no connection to FMG). 

I just updated the original post clarifying the scenario via USB & CLI & isolated location .. please let me know your comments.

[Toshi_Esumi]

Sorry I misstated that part. We always locally upload the config via TFTP server in CLI. Below is our operation to swap hardware whenever we need to replace whatever the reason is for those customers whose FGTs are managed by our FMG-VM, which I needed to test it actually works.

1. dowanload the latest config revision from the FMG
2. remove "set fmg <fmg_ip_address>" statement from "config sys central-management" in the config file
3. restore the modified config file to the new FGT
4. swap the serial number at the FMG with the new one
5. connect the new FGT to the existing/same network then execute "Refresh Device" at the FMG

We never use USB to upload either firmware or config file. Always TFTP server at our Warehouse before shipping them the customer locations.
Again, open a ticket at TAC to get it looked at, which I would do in case something goes wrong with the operation.

Toshi