Issue with address group nesting with FortiOS 5.2

[MBR]

Hi there, My firewall cluster throws me an error when i want to change members of an address group which is member of an other group (nested) When i try to change members is get the error " entry not found" Anyone else having this issue? or could anyone test this on an other 5.2 and 5.0.7 FG? You can test this is as follows: First create some test addresses: FW02A (address) # config firewall address FW02A (address) # edit zztest1 new entry ' zztest1' added FW02A (zztest1) # set subnet 10.0.0.1/32 FW02A (zztest1) # next FW02A (address) # edit zztest2 new entry ' zztest2' added FW02A (zztest2) # set subnet 10.0.0.2/32 FW02A (zztest2) # next FW02A (address) # edit zztest3 new entry ' zztest3' added FW02A (zztest3) # set subnet 10.0.0.3/32 FW02A (zztest3) # next FW02A (address) # end Then create two address groups where the first group is a member of the second FW02A # config firewall addrgrp FW02A (addrgrp) # edit zztestgrp1 new entry ' zztestgrp1' added FW02A (zztestgrp1) # set member zztest1 zztest2 FW02A (zztestgrp1) # next FW02A (addrgrp) # edit zztestgrp2 new entry ' zztestgrp2' added FW02A (zztestgrp2) # set member zztestgrp1 FW02A (zztestgrp2) # next And now try to change members of the first group: FW02A (addrgrp) # edit zztestgrp1 FW02A (zztestgrp1) # set member zztest1 zztest2 zztest3 entry not found in datasource value parse error before ' zztest1' Command fail. Return code -3 FW02A (zztestgrp1) # append member zztest3 entry not found in datasource value parse error before ' zztest3' Command fail. Return code -3 FW02A (zztestgrp1) # unselect zztest2 command parse error before ' zztest2' Command fail. Return code -61 When you remove the first group as a member of the second group all works properly. Hope some of you have time to test this on 5.0.7 and 5.2 setups. - MBR-

[ede_pfau]

I can confirm that modifying members in a nested address group is working in 5.2.1, via GUI and via CLI.

[MBR]

Hi Ede, Ok great news... Sadly Fortinet decided to not add all fixed issues in their release notes :( Thanks for sharing!

[Christopher_McMullan]

To add some perspective: some releases combine bugs if they are loosely related into one omnibus entry. This particular bug was not combined, but was fixed in build 597, which falls between 5.2.0 (589) and 5.2.1 (618). It' s unfortunate, but it does happen from time to time that a bug is not mentioned in the release notes. If you already have a known bug associated with the ticket, be aware of some stages in the process: 1. A bug is reported 2. The developers will see if the issue can be reproduced 3. Once the issue is reproduced, then a fix is prioritized relative to other bugs and scheduled for inclusion in a future release 4. Once the fix is coded, it is tested and verified 5. An Engineering Change Order (ECO) is made, officially checking the fix into a specific build, usually an interim number between releases 6. The full build is loaded and tested to ensure the fix resolves the issue within the context of the whole functioning OS. If a fix is scheduled, but has not been checked in, we can at best advise that we plan to fix it for a certain build, but as with everything, that schedule is subject to change. Once a fix has been checked in, however, you know that it will be included in the next General Availability (GA) release on our support site. If you have an open case, then, ask for a notice when the fix has been checked in, so you know to expect it whether or not it appears in the notes for that release.

[Mitch_111]

Hi,

i got this issue with a 1000c Cluster with Version 5.09.

Not only with nestend Groups, at the moment i cant put any Object in an existing Group, i could add a new Group with the new Object, but cant put the object in an exitsting Group, allways got the error "entry not found"

Also from the CLI creating an object and putting it into the group, i got the same error..

I will open a ticket for it, maybe someone has a hint for me, cause now i cant do my daily business...

Regards

Michael

[ede_pfau]

Hi Mitch,

chances are that the group name contains 'special' characters, like space or Umlauts.

I cannot reproduce this error using 5.0.9 with all-regular (= ASCII) group names.

[MBR]

Hi Mitch,

I think Ede is right. The bug was in FortiOS 5.2.

When researching the issue i found a lot of people having the similar issue on FortiOS <5.2 but they all had illegal characters in the names. So please check them first.

[Mitch_111]

Hi There,

thanks for the replys, the Group name is similar to Stores_Worldwirde...

The Underscore is in there since were coming from Checkpoint to Fortinet and it works well.

Ive tried following, Creating Test_test, put in an object Nw_store_dubai and it works like all the times

Ive renamed Stores_Worldwide to Stores Worldwide and the behavior is like before, i cant put the nw_store_dubai in there, also after renaming to nw store dubai it doesnt work.

Also renaming to names without Spaces doesnt work...

Of course i can create an new group containing all objects, but then i need to put this group in all Policys....

A Ticket is open happy over any new hint...

regards

Michael

[MBR]

Hi Michael,

If i remember correctly all group names and memebers are enemerated during saving a change.

So it could be a completely other groupname or member contains illegel characters.

[emnoc]

Michael

Can you share the  groups and address ( sanitized if you must ) ? Nesting can create havoc sometimes.

[Mitch_111]

Hi there,

thanks for your reply, this is just a standard Group, no nesting, the Pic shows the group, normal i use underscores, i tried with blank, and without everything, nothing works, i can built up a new group of course...