FortiManager push policies on FortiGate 30G with Trial License

[NetLux]

Hello,

Being new to the Fortinet ecosystem, I am not yet familiar with all the details of the FortiManager solution.

However, I have installed the FortiManager VM with a trial license to perform tests in preparation for future use with a full license.
I have two FortiGate 30G devices running the latest available firmware version for these models: 7.2.8.

They are properly "synchronized" with my FortiManager, but when I make a Policy modification and push the changes using "Re-install Policy," an error occurs.

In the "Preview" before the push, I can clearly see the test modification I made and only that modification. However, later in the "View Installation Log" file, new commands are added, which causes the error. The Policy does get successfully pushed, but this creates a configuration "conflict" with each push due to the additional commands/checks.

Starting log (Run on device)


Start installing
FortiGate-… $  config firewall policy
FortiGate-… (policy) $  edit 20
FortiGate-… (20) $  set name "DENY"
FortiGate-… (20) $  set uuid xxxxx
FortiGate-… (20) $  set srcintf "any"
FortiGate-… (20) $  set dstintf "any"
FortiGate-… (20) $  set srcaddr "all"
FortiGate-… (20) $  set dstaddr "all"
FortiGate-… (20) $  set schedule "always"
FortiGate-… (20) $  set service "ALL"
FortiGate-… (20) $  set logtraffic all
FortiGate-… (20) $  next
FortiGate-… (policy) $  end

---> generating verification report
(vdom x: log disk setting:status)
	remote original: enable
	to be installed: 

(vdom x: firewall ssl-ssh-profile "custom-deep-inspection" ssh:status)
	remote original: 
	to be installed: disable

(vdom x: vpn ssl settings:servercert)
	remote original: 
	to be installed: ''

(vdom x: web-proxy global:proxy-fqdn)
	remote original: 
	to be installed: "default.fqdn"

<--- done generating verification report



------- Start to retry --------

FortiGate-… $  config log disk setting
FortiGate-… (setting) $  unset status
FortiGate-… (setting) $  end
FortiGate-… $  config firewall ssl-ssh-profile
FortiGate-… (ssl-ssh-profile) $  edit "custom-deep-inspection"
FortiGate-… (custom-deep-insp~ion) $  config ssh
FortiGate-… (ssh) $  set status disable
FortiGate-… (ssh) $  end
FortiGate-… (custom-deep-insp~ion) $  next
FortiGate-… (ssl-ssh-profile) $  end
FortiGate-… $  config vpn ssl settings
FortiGate-… (settings) $  set servercert ''
FortiGate-… (settings) $  end
FortiGate-… $  config web-proxy global
FortiGate-… (global) $  set proxy-fqdn "default.fqdn"
FortiGate-… (global) $  end


---> generating verification report
(vdom x: log disk setting:status)
	remote original: enable
	to be installed: 

(vdom x: firewall ssl-ssh-profile "custom-deep-inspection" ssh:status)
	remote original: 
	to be installed: disable

(vdom x: vpn ssl settings:servercert)
	remote original: 
	to be installed: ''

(vdom x: web-proxy global:proxy-fqdn)
	remote original: 
	to be installed: "default.fqdn"

<--- done generating verification report


install failed

I have tried using an ADOM in version 7.2, 7.4, and 7.6. The issue persists, so it does not appear to be related to the ADOM. I considered a Template file, but no Template is being used, as I have not created any so far.

Could the issue be related to the trial license? A configuration issue with my FortiGate devices? Or with my FortiManager VM?

Thank you in advance,
Have a great day!

[dingjerry_FTNT]

OK, more questions:

1) Please keep using ADOM 7.2 version.

2) When you added the FGT 30G, did you import the configuration from the FGT?  I hope that you have firewall policies configured on the FGT already.

3) If yes, and since this is the only FGT in this ADOM, on the Conflict Object page while Importing, please select "FGT", not "FMG".

4) Once Import is done, are the Config Status and PP (Policy Package) Status in sync?

5) If yes, try to Push PP and Config settings, are you able to push it?

6) If yes, make some minor changes, such as add a comment/notes in one firewall policy, then Push it again to see whether you still have this issue or not.

7) When you Push, use "Install Wizard".  It will give you the chance to pause/stop/cancel and review the Install Preview.   Save/Download the Install Preview and if you still have the issue, provide it.

[NetLux]

I followed the different steps you gave me, even though I had already tested them:

- An adom in 7.2

- Imported the configuration and policies by selecting "FGT" in the conflicts.

- Yes, I already have policies on the FortiGate 30G

I made an "Install Wizard" instead of "Re-install Policy" and it gave me approximately the same results by adding only one comment. I first checked in the install preview that there is only what I modified. Which was the case:

=== Preview result ===
config firewall policy
    edit 8
        set comments "Add 1 comment test"
    next
end

And so I launched the push, which led to the same error unfortunately:

Starting log (Run on device)


Start installing
FortiGate-X $  config firewall policy
FortiGate-X (policy) $  edit 8
FortiGate-X (8) $  set comments "Add 1 comment test"
FortiGate-X (8) $  next
FortiGate-X (policy) $  end


---> generating verification report
(vdom root: log disk setting:status)
	remote original: enable
	to be installed: 

(vdom root: firewall ssl-ssh-profile "Test" ssh:status)
	remote original: 
	to be installed: disable

(vdom root: firewall ssl-ssh-profile "custom-deep-inspection" ssh:status)
	remote original: 
	to be installed: disable

(vdom root: vpn ssl settings:servercert)
	remote original: 
	to be installed: ''

(vdom root: web-proxy global:proxy-fqdn)
	remote original: 
	to be installed: "default.fqdn"

<--- done generating verification report



------- Start to retry --------

FortiGate-X $  config log disk setting
FortiGate-X (setting) $  unset status
FortiGate-X (setting) $  end
FortiGate-X $  config firewall ssl-ssh-profile
FortiGate-X (ssl-ssh-profile) $  edit "Test"
FortiGate-X (Test) $  config ssh
FortiGate-X (ssh) $  set status disable
FortiGate-X (ssh) $  end
FortiGate-X (Test) $  next
FortiGate-X (ssl-ssh-profile) $  edit "custom-deep-inspection"
FortiGate-X (custom-deep-insp~ion) $  config ssh
FortiGate-X (ssh) $  set status disable
FortiGate-X (ssh) $  end
FortiGate-X (custom-deep-insp~ion) $  next
FortiGate-X (ssl-ssh-profile) $  end
FortiGate-X $  config vpn ssl settings
FortiGate-X (settings) $  set servercert ''
FortiGate-X (settings) $  end
FortiGate-X $  config web-proxy global
FortiGate-X (global) $  set proxy-fqdn "default.fqdn"
FortiGate-X (global) $  end


---> generating verification report
(vdom root: log disk setting:status)
	remote original: enable
	to be installed: 

(vdom root: firewall ssl-ssh-profile "Test" ssh:status)
	remote original: 
	to be installed: disable

(vdom root: firewall ssl-ssh-profile "custom-deep-inspection" ssh:status)
	remote original: 
	to be installed: disable

(vdom root: vpn ssl settings:servercert)
	remote original: 
	to be installed: ''

(vdom root: web-proxy global:proxy-fqdn)
	remote original: 
	to be installed: "default.fqdn"

<--- done generating verification report


install failed

As answered above, doing a "Retrieve configuration" solves the situation. And removes the "Conflict" generated by the push error.

But on a global push on a large firewall fleet in the future, this will be anything but practical ... The solution would therefore be to find out why this causes this.

Thanks

[dingjerry_FTNT]

Hi @NetLux ,

1) Do you have any system template associated with this FGT while adding it into ADOM?

2) Do you apply Global DB to this FGT/ADOM?

3) Actually, when this issue happened, you could run some commands on FGT directly to collect some outputs. But since you ran Retrieve already, we may have lost the chance.

[NetLux]

Hi @dingjerry_FTNT ,

1) I don't have a system template that I created for this firewall in this ADOM.

2) No I did not assign the Global DB

The FortiGate 30G being the lowest model offered in FortiGate. I wonder if it is not because of this..