Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
gced91
New Contributor

Fortimanager 5.2.4 Out of Sync with Fortigate after upgrade v5.2.4

Hello,

I have a fortimanager v5.2.4 with an ADOM in 5.0 I updated the firewall of this Adom as this v5.0.7, v5.0.11 OK sync OK connectivity OK, install policy OK. Having put the cluster of firewall in version 5.2.4, the status on the FMG passed it out of sync connectivity down (down tunnel). I thus updated the adom of the version 5.0 to the version 5.2, it changed nothing. I tried a refresh, a retrieve of the configuration, I always have the same error message: cannot communicate with remote device (down tunnel)

Nevertheless the network connectivity is always good (ping OK) I made a backup of the cluster of firewall to the imported on the fortimanager in the revision history. The status passed of out of sync in conflict, and the connectivity is always down.

Is there a solution to this problem without having to separate the cluster of the fortimanager? Thank you for your help

 

Cedric.

5 REPLIES 5
scao_FTNT
Staff
Staff

Having put the cluster of firewall in version 5.2.4, the status on the FMG passed it out of sync connectivity down (down tunnel).

   -- you mean after FGT HA upgrade from 5.0.11 to 5.2.4 then tunnel is down?

 

do you see any unexpected device listed in unregistered device list?

 

Thanks

 

Simon

gced91

Hello,

There is no device unregistered in adom root.

I tried on the cluster fortigate to delete configuration central-management, then to add it again, it changed nothing.

And from the fortimanager we manage also to connect ssh on the fortigate

Regards

Cedric.

scao_FTNT

can you see FMG SN still in FGT "get sys central-management"?

 

I tried on the cluster fortigate to delete configuration central-management, then to add it again, it changed nothing.

   -- so you mean FMG re-add FGT still fails?

 

Thanks

 

Simon

gced91

Hello,

 

-- so you mean FMG re-add FGT still fails?

NO, because i don't delete it on FMG.

config system central-management     set type fortimanager     set fmg "xxx.xxx.xxx.xxx"     set vdom "my_vdom" end

It's the same configuration as I had before passing in v5.2.4

 

I am going to have to delete it of the FMG to make a new association. But it has an important impact because we use the tufin solution and id to associate with the cluster of firewall is going to change and I have many of firewalls to be updated :\

 

Thanks

Cédric.

scao_FTNT

QA tried FMG 5.2.4 738 + FGT HA and upgrade from 5.0.7->5.0.11->5.2.4, tunnel connection is always up and can not reproduce the issue

 

We may need more info, and you can enable fgfm debug on FMG and FGT

 

diag deb en

diag deb app fgfm 255

 

and send me message for debug output when issue happens

 

Thanks

 

Simon

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors