FortiManager CLI Provisioning Template Groups

[jokes54321]

While we've been running FortiManager for years, we finally took the time to setup it up to fully provision a firewall using Provisioning CLI Templates. We built around 17 individual CLI Templates that configure various sections of the config, and once we could fully provision a firewall running them one at a time, we grouped them up into a CLI Template Group and were so disappointed when it immediately failed. 

It appears that regardless of how you arrange the individual scripts in the Group, when you execute the script, it doesn't execute them sequentially, it consolidates all of the configuration and pushes in whatever order it feels like. In our case, the very first config it tries to push has a dependency on an interface that hasn't been created yet.

I opened a support ticket reporting the Provisioning CLI Templates are running out of order and asked how to fix it. The answer I got was to run some of the CLI Templates independent of the Template Group, to ensure the dependencies are created first. My question to them was, why did the GUI developers design the CLI Template Group interface to allow us to arrange the CLI Templates in a certain order if it doesn't honor that order. The answer I got was, this is how it's designed and to run the dependency CLI Template prior to the Template Group. 

Our Manager is currently on 7.2.10 and the question for the community is, does anyone know if this is the same in 7.4.x ?

Denny

[Jean-Philippe_P]

Hello jokes54321, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[Jean-Philippe_P · Accepted solution]

Hello Denny,

I found this solution. Can you tell me if it helps, please?

In FortiManager version 7.6.2, CLI template groups are designed to allow multiple CLI templates to be assigned to managed devices at the same time. However, the execution order of the scripts within a CLI template group is not guaranteed to follow the order they are arranged in the group.

This behavior is consistent with the design, as you have experienced. To address the issue of dependencies, it is recommended to run certain CLI templates independently to ensure that necessary configurations, such as interface creation, are completed before executing the rest of the template group.

This approach helps manage dependencies effectively. Regarding your question about whether this behavior is the same in version 7.4.x, the context provided does not specify any changes in this behavior for that version. Therefore, it is likely that the behavior remains the same in version 7.4.x as well.

If you require further confirmation or details specific to version 7.4.x, it would be best to consult the release notes for that version or reach out to Fortinet support for the most accurate information.

[jokes54321]

I greatly appreciate you researching this and was really hoping this wouldn't be the case.

Fortinet's argument that their approach helps manage dependencies effectively is exactly what running the scripts in order would achieve. We built the Template Group in an order that satisfies the dependency order, which would allow us to fully provision a firewall in one pass.

I guess it won't matter much as we work towards automating the interaction with Manager and let the automation deal with running a pre-provisioning provisioning script. 

Thank you again for doing the research,

Denny