FortiManager deployment problems after FGT Upgrade to 7.0.14

[sw2090]

I did the following:

- upgraded FMG to 7.0.11 while the FGT still were on 7.0.13 => everything still worked fine afterwards

- upgraded the FGT to 7.0.14 during the next night (scheduled) => since then FGT keep losing the connection to FMG when I deploy policy package or device config. Results in the deployment timing out after some time. 

During a TAC session it helped to reboot FMG (and perform fsck on it with that) and then retrieving config of FGT and then deploy it. After this deploying of policy package worked fine until now.

Now just deployed the device config only on a FGT and it got disconnected from FMG again...

However they come back after some time...

[sw2090]

TAC said I'm gonna get a new interim FOS build for further debugging. Developers are still doing some sanity tests before I get it. 

Issue is still pending bugfix...

[sw2090 · Accepted solution]

got the new interim FOS build yesterday and it finally seems to have broought us to the right path. 

This build finally outputted an additional message saying that the FMG certificate could not be re-verfified by the fgt because of the issuer. And that issue gave me the clue I needed to finally find the culprit. 

It was in fact DPI in effect on the FGT to FMG policies. This was set long time ago and it never caused issues until fos 7.0.14. Since 7.0.14 this is an issue. 

Once I disabled DPI on those policies everything came back up and works fine again.

[AEK]

Thanks for sharing.

So how to do if you want to configure deep inspection?

[sw2090]

either do not enable it on policies for the FMG<->FGT connection or make sure that all FGT have the issuer ca  you use for deep inspection so they can still verify FMG's certificate.

[sw2090]

The biggest thing with this is that the usuall FGFM Debuglogs don't show you the actual certificate.

It just reports the CAs and the error itself.

Only the last interim build reported the actuall certificate.