Fortigate 50B not accepting dstaddr for firewall policy

[Gbarnes619]

Hi all, I had to resort to reaching out here as I cannot seem to determine what the problem is. I have set up a firewall object-VIP and am attempting to set up the Firewall Policy but every time I make the entry it does not have my VIP in the dstaddr field of the policy. When I attempted to do it via CLI, it errored out with: commands.c:3952 cmf_query_table_delete() error Command fail. Return code -1 The command I attempted was: config firewall policy edit 11 set dstaddr XXXXX edit 11 set srcintf " wan1" set dstintf " internal" set srcaddr " any" set dstaddr " " set action accept set schedule " always" set service " SSH" set logtraffic enable set nat enable next Can someone explain what is happening and why I can' t set the dstaddr? Thanks in advance, -Greg

[Gbarnes619]

config firewall policy (policy) # edit 11 (11) # set dstaddr XXXXX commands.c:3952 cmf_query_table_delete() error Command fail. Return code -1 (11) #

[rwpatterson]

What' s the firmware version?

[Gbarnes619]

v4.0,build0496,111108 (MR3 Patch 3)

[rwpatterson]

Is the VIP name longer than about 16 characters? Does it have spaces embedded within?

[Gbarnes619]

8 Characters, No spaces.

[rwpatterson]

The only thing I can think of is corrupt code. Have you tried upgrading to a later more stable version of code? Also, how long has that box been running? A reboot may enable you to make the change if the unit has been stressed for a long time.

[Gbarnes619]

Box uptime is 269 days. I haven' t upgraded recently no. I' ll try a reboot.

[rwpatterson]

That would be the easiest thing to try.