FortiManager 5.2 with VDOMs - Here Be Dragons

[neonbit]

Has anyone had any problems with FortiManager 5.2 and managing VDOMs on a FortiGate running 5.2?

I just gave it a spin in my lab and from the very first config I started to get errors everytime I made some changes. For example:

I enabled VDOMs = this worked

I created a new VDOM = this gave an error (but still made the correct changes on the FGT)

I moved interfaces into a VDOM & enabled DHCP on the interfaces = this failed

When I enabled DHCP on an interface in the 'SITE-A' VDOM for example, the config the FortiManager sent to the FGT was as follows:

config vdom
edit root
config system dhcp server
edit 1
set forticlient-on-net-status disable
set dns-server1 8.8.8.8
set default-gateway 10.1.1.1
set netmask 255.255.255.0
set interface "port3"
config ip-range
edit 1
set start-ip 10.1.1.10
set end-ip 10.1.1.11
next
end
next
end
end

As per above it's trying to enable the DHCP server on the root VDOM, which doesn't have port3 anymore (since it's been moved to the SITE-A VDOM). This causes it to fail :(

Just wanted to see if anyone is having the same experience as myself with the 5.2 firmware and VDOMs? I'm going to boot up 5.0.9 to see if that behaves any better.

[scao_FTNT]

Hi, neonbit

Thanks for the feedback, we will do a check in the lab for your mentioned case steps

for that create VDOM error, not sure what error reported on GUI?

Thanks

Simon

[neonbit]

Hi Simon,

I've attached a pic of the error I get when I try to add a new 'TEST' VDOM. It's the standard 'install and save status=FAILED' message.

Looking through the installation log history I see a few errors:

gate2 $ config vdom
gate2 (vdom) $ edit TEST
current vf=TEST:7
gate2 (TEST) $ config log threat-weight
gate2 (threat-weight) $ config web
gate2 (web) $ edit 1
gate2 (1) $ set group 1

command parse error before 'group'
Command fail. Return code -61
gate2 (1) $ next
gate2 (web) $ end
gate2 (threat-weight) $ end
gate2 (TEST) $ end
gate2 $ config vdom
gate2 (vdom) $ edit TEST
current vf=TEST:7
gate2 (TEST) $ config log threat-weight
gate2 (threat-weight) $ config web
gate2 (web) $ edit 2
gate2 (2) $ set group 5

command parse error before 'group'
Command fail. Return code -61
gate2 (2) $ next
gate2 (web) $ end
gate2 (threat-weight) $ end
gate2 (TEST) $ end
gate2 $ config vdom
gate2 (vdom) $ edit TEST
current vf=TEST:7
gate2 (TEST) $ config vpn ssl web portal
gate2 (portal) $ edit "full-access"
gate2 (full-access) $ unset ip-pools
ip-pools is required for this tunnel
command_cli_unset:4790 clear MEMBER table oper error. ret=-2011
Command fail. Return code -2011
gate2 (full-access) $ unset ipv6-pools
ipv6-pools is required for this tunnel
command_cli_unset:4790 clear MEMBER table oper error. ret=-2011
Command fail. Return code -2011
gate2 (full-access) $ next
gate2 (portal) $ end
gate2 (TEST) $ end
gate2 $ config vdom
gate2 (vdom) $ edit TEST
current vf=TEST:7
gate2 (TEST) $ config vpn ssl web portal
gate2 (portal) $ edit "tunnel-access"
gate2 (tunnel-access) $ unset ip-pools
ip-pools is required for this tunnel
command_cli_unset:4790 clear MEMBER table oper error. ret=-2011
Command fail. Return code -2011
gate2 (tunnel-access) $ unset ipv6-pools
ipv6-pools is required for this tunnel
command_cli_unset:4790 clear MEMBER table oper error. ret=-2011
Command fail. Return code -2011
gate2 (tunnel-access) $ next
gate2 (portal) $ end
gate2 (TEST) $ end
gate2 $ config vdom
gate2 (vdom) $ edit TEST
current vf=TEST:7
gate2 (TEST) $ config firewall service custom
gate2 (custom) $ edit "NONE"
gate2 (NONE) $ set tcp-portrange 0
gate2 (NONE) $ next
gate2 (custom) $ end
gate2 (TEST) $ end

---> generating verification report
(vdom TEST: log threat-weight web 1:group)
 original: 
 to be installed: 1 
(vdom TEST: log threat-weight web 2:group)
 original: 
 to be installed: 5 
(vdom TEST: vpn ssl web portal "full-access":ip-pools)
 original: "SSLVPN_TUNNEL_ADDR1" 
 to be installed: 
(vdom TEST: vpn ssl web portal "full-access":ipv6-pools)
 original: "SSLVPN_TUNNEL_IPv6_ADDR1" 
 to be installed: 
(vdom TEST: vpn ssl web portal "tunnel-access":ip-pools)
 original: "SSLVPN_TUNNEL_ADDR1" 
 to be installed: 
(vdom TEST: vpn ssl web portal "tunnel-access":ipv6-pools)
 original: "SSLVPN_TUNNEL_IPv6_ADDR1" 
 to be installed: 
<--- done generating verification report

install failed

On the FortiGate I can see the VDOM is there, but the FortiManager is unable to save the config until I delete the VDOM. As it stands, I've just been creating the VDOM on the ForitGate and retrieving the config onto the FortiManager.

Both the FGT and FMG are running factory default configurations. All I've done is started the VM, configured the management interfaces, added the fortigate, then tried to add a vdom.

[scao_FTNT]

Hi, neonbit

Thanks for the update, I understand your VDOM issue is not for FMG config generate and save, but for config install to FGT. Just to confirm, which FMG version and FOS version you are using?

FMG 5.2.0.GA 0618, has full syntax support for FOS 5.2.0.GA 0589, but since FOS 5.2.1 0618 has some syntax change, and thus FMG may have issue to install these related syntax to FGT properly. For example, in your mentioned case, new VDOM install may fail because of "log threat-weight" change if using FMG 5.2.0 + FOS 5.2.1. But if you do not need to config for this feature, then you can do a manual retrieve after VDOM install, to sync again with FOS side config, next time config install should be OK (For example, a policy package install to FGT).

FMG 5.0.9 has syntax support for FOS 5.2.1

And I am still checking for your another case for interface assign and DHCP install issue.

By the way, I am not clear for the issue you mentioned for "but the FortiManager is unable to save the config until I delete the VDOM."

Thanks

Simon

[Matthew_Mollenhauer]

scao_FTNT wrote:

FMG 5.2.0.GA 0618, has full syntax support for FOS 5.2.0.GA 0589, but since FOS 5.2.1 0618 has some syntax change, and thus FMG may have issue to install these related syntax to FGT properly. For example, in your mentioned case, new VDOM install may fail because of "log threat-weight" change if using FMG 5.2.0 + FOS 5.2.1. But if you do not need to config for this feature, then you can do a manual retrieve after VDOM install, to sync again with FOS side config, next time config install should be OK (For example, a policy package install to FGT).

FMG 5.0.9 has syntax support for FOS 5.2.1

I've just spent the last three days moving several vDom's from a pair of 621B's to 1240B's, both running FOS 5.2.1 from a 5.2.0 

 FortiManager and I didn't see any issues creating and installing the new vdoms on the 1240B's. But to be fair the ADOM I was creating and updating them in is set to version 5.0, so that might be the difference for me.

As for FMG 5.0.9 having full support for FOS 5.2.1, how does this help us? We've already upgraded to 5.2.x and there are no notes to say that a "cross-grade" from 5.2.0 to 5.0.9 is even possible or supported. We're now approaching 3 months since 5.2.0 was released with no further updates to properly support FOS 5.2.x, and this includes absolutely no support for our 1500D's (or any other NP6 units) on 5.2. Anytime I've asked our local SE or the TAC it's always "it's due next week" which now I interpret to mean we haven't started coding it yet...

Regards,

Matthew

[neonbit]

Thanks Simon, I had forgotten that FMG 5.2 did not support FGT 5.2.1.

I've installed a new FMG image running 5.0.9 and the VDOM creation went smoothly.

Unfortunately moving the interface to another VDOM and enabling DHCP still fails (as before it's configuring the root VDOM instead of the VDOM the interface should now reside in).

Testing a little more I can see it only fails if I edit the interfaces vdom and enable the DHCP server at the same time. If I change the interfaces VDOM and save/push the config to the FortiGate, then go back and enable the DHCP server and save/push the config it works fine.

I'm happy to work around that for now :)

[scao_FTNT]

Hi, neonbit

Thanks a lot for your detailed update, I will double check in the lab.

Thanks

Simon