FortiManager Cloud update pushing TACACS logging - failing when installing

[jayp_petfolk]

Hey all,

I recently updated our FortiManager instance to v7.4.5 build5874.

After doing so, I was trying to install a device + policy package to a test firewall.

For some reason, it is trying to append the following commands whenever I try to install, even though I did not configure these settings:

config log tacacs+accounting filter

set cli-cmd-audit enable

config log tacacs+accounting2 filter
set cli-cmd-audit enable

config log tacacs+accounting3 filter
set cli-cmd-audit enable

all 3 fail with the same message:
CLI audit log needs to be enabled in global setting to enable CLI command audit for TACACS+ accounting!
node_check_object fail! for cli-cmd-audit enable

I've tried the command

config system global 
    set cli-audit-log enable 
end

 But the same error persists.

Just not sure where these commands are coming from in FortiManager or what I have to do to fix. I appreciate any help!

[untjc1]

I'm having the exact same behavior as well.  This smells like a FortiManager bug, similar to the ones they had in 7.4.4 and 7.4.3.

[kmusk01]

Did you ever get this fixed?  I upgraded and I am having the same issue :(  I guess I need to make a TAC ticket.

[Grifter]

did you get a solution from TAC for this, i just upgraded to 7.4.6 and got the same issue?

[Grifter]

Updating fromCLI failed, but from fortimanager under the FGT system -> settings -> advanced -> cli-audit-log. set this setting to enabled and it fixed the issue

[jjdope]

This is a bug which is already fixed in 7.4.7 FortiManager. 
Workarounds:

1. Retrieve the config on the FMG for the FGT. -> This can be helpful if the number of managed devices are less.

2. If you have many devices then run the below CLI script.

config log tacacs+accounting filter
     set cli-cmd-audit disable
end
config log tacacs+accounting2 filter
     set cli-cmd-audit disable
end

config log tacacs+accounting3 filter
     set cli-cmd-audit disable

end

Run the CLI script to update the Device Database -> Atached screenshot