Fortimanager Normalized Interface Data Corruption

[mariano_lavia]

Hello, we have a small group of Fortigate managed by a Fortimanager VM (both versions 7.6.3).

For one of them, the Normalized Interface objects in "Policy & Objects > Normalized Interface" are not being populated correctly:
All interfaces (VLANs, Tunnels, etc.) are incorrectly typed as 'Physical', and all addressing information are missing.

From the same screen, if I try to add a "per device" mapping of an interface on that unit, the drop down menu is not showing the one I need.

ST-FW mapping is incorrect.

But the interface data appears correctly in "Device Manager > Network > Interfaces", where I can see their addressing and I can map them to the normalized one.

The same mapping looks fine here, and I can edit the interface.

Seems that two views (Policy & Objects vs Device Manager) of the same object are not matching.

I have already performed the following troubleshooting steps without success:
Full 'Import Config', 'Refresh Device', deleting and re-mapping the interfaces.
Ran scripts from Fortimanager to modify interface aliases on the Fortigate to force a re-sync.
Rebooting both machines.

The mapping was normal when the Fortigate was installed, and I'm not sure when the problem started as I can still manage the FG policies without errors or warnings.

Any suggestion?

[Jean-Philippe_P]

Hello mariano_lavia, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[Jean-Philippe_P]

Hello,

We are still looking for an answer to your question.

We will come back to you ASAP.

Thanks,

[tonga94]

I highly suggest you go take the training for NSE5 Fortimanager. It's free and available on Fortinets training site. Just watch the slides and listen to the...terrible narration. It will take you half a day and will save you endless headaches. It won't touch all there is within FMG but it will get you the core knowledge that will help you be successful.

[Jean-Philippe_P]

Hello again mariano_lavia,

I found this solution. Can you tell us if it helps, please?

To address the issue of mismatched interface data between "Policy & Objects" and "Device Manager" in FortiManager, you can try the following steps:

1. Verify ADOM Settings: Ensure that you are working within the correct Administrative Domain (ADOM) for both the FortiManager and the FortiGate device.
   
   
2. Check Interface Mapping: Double-check the interface mappings in both "Policy & Objects" and "Device Manager" to ensure they are correctly configured.
   
   
3. Re-import Device Configuration: Perform a full configuration import again to ensure all settings are correctly synchronized. Go to "Device Manager," select the device, and choose "Import Config."
   
   
4. Check for Software Bugs: Review the release notes for FortiManager and FortiGate version 7.6.3 to see if there are any known issues or bugs related to interface mapping.
   
   
5. Manual Sync: Manually synchronize the device by going to "Device Manager," selecting the device, and clicking "Sync Now."
   
   
6. Review Logs: Check the FortiManager logs for any errors or warnings that might indicate why the interfaces are not being populated correctly.
   
   
7. Contact Support: If the issue persists, consider reaching out to Fortinet Support for further assistance. Provide them with detailed information about the steps you've already taken.

These steps should help in diagnosing and potentially resolving the issue with the interface data mismatch.

[mariano_lavia]

Hi Jean-Philippe, thank you for your answer.

Unfortunately I've already tried all of your suggestions before posting, and none worked.

I've also opened a support ticket, but until now they only suggested to enlarge the disk, which I did, but it didn't bring any benefit.

May you tell me more about Fortimanager logs? I'm new to this platform and I'm not sure what to look for. When I do the mapping, there is only a "notice" of a configuration change, without any error reported. The case is similar when I refresh the device. I never saw errors in the log.

Thank you.

[Jean-Philippe_P]

Hello again mariano_lavia :)

I am sorry that it didn't help much! 

For the logs, I found this information:

To effectively utilize FortiManager logs for troubleshooting, follow these steps:

1. Access Event Logs: Navigate to the Event Log section in FortiManager. This will provide a detailed audit trail of actions performed, including configuration changes.
   
   
2. Filter Logs: Use the filtering options to focus on specific events related to interface mapping or device synchronization. Look for entries with descriptions like "Configuration change for object changed."
   
   
3. Check Log Details: Pay attention to the "Operation" column for actions like "delete" or "modify" and the "User" column to see who performed the action. This can help identify if any unexpected changes were made.
   
   
4. Download Logs: If needed, download the logs in CSV or detailed format for further analysis. This can be useful for sharing with support or for a more in-depth review.
   
   
5. Review System Logs: Use system log commands to check for any alerts or errors that might not be immediately visible in the event logs. Commands like `get system log settings` can provide additional insights.
   
   
6. Look for Anomalies: Even if no errors are reported, look for any unusual patterns or repeated entries that might indicate an underlying issue. By systematically reviewing the logs, you may uncover clues that can help resolve the interface mapping issue.

If the logs do not provide sufficient information, continue working with Fortinet Support for further assistance.

[boult]

On FortiManager 7.6.3, one FortiGate shows corrupted Normalized Interface data interfaces appear as "Physical" with missing addressing, unlike in Device Manager where they display correctly. Tried re-sync, remap, and reboot with no success. Any fix?