FortiManager partially overwrites interface settings of interfaces with same name on different FGTs

[masterofdesaster_01]

I opened a TAC case regarding this but maybe somebody already had this issue:

We're importing a large number of FortiGates into FortiManager. After importing the first 3 devices I noticed the following behavior:
Authorizing and importing the configurations went well. All 3 devices have some interfaces with same interface name but different configurations (VLAN ID, IP, Alias, bandwidth settings, etc).
After import I can verify that the device settings show the correct interface with the original interface settings, normalized interface is mapped per device to the correct device interface.
When I try to install the policy in the 2nd and 3rd device the install preview shows that several settings of those interfaces will be overwritten by the values imported from the first firewall (e.g. alias, bandwith-settings and allowaccess settings). VLAN ID or IP settings will not be modified.
Why does this happen? Do we need to rename the interfaces on each firewall to make them unique?

[Jean-Philippe_P]

Hello masterofdesaster_01, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[AtiT]

What is the FortiManager version and the version of the FortiGates?

[masterofdesaster_01]

its FMG 7.0.8 and FGT 7.0.11 / 7.0.12

but see my reply above

[masterofdesaster_01 · Accepted solution]

I will reply to myself as together with TAC we found the reason for this.

What I didn't mention is: the VLANs affected are FortiSwitch VLANs.

The issue only occurs if the ADOM has FortiSwitch enabled and the device is imported including FortiSwitch templates. This causes the FortiSwitch VLANs to be managed by FortiSwitch Manager and this overrules the device database settings.

This wouldn't be an issue as each VLAN can include per-device settings BUT these per-device settings are missing some parts of the configuration, e.g. Administrative Access (IPv4), bandwidth settings and most of the IPv4 advanced settings (where the interface alias is located for whatever reason). IPv6 Administrative Access is configurable per device though. Makes sense...

This causes the FortiSwitch VLAN settings on the device being overwritten by the VLAN values that are not configured per-device and theses are values from the device imported first.

So I guess, the per-device settings need to be expanded to several more of the VLAN settings so solve this.

The workaround is to disable FortiSwitch in ADOM settings or to not import FortiSwitch templates.

[Jean-Philippe_P]

Thanks for sharing and happy you found a solution :)