Issue with address group nesting with FortiOS 5.2

[MBR]

Hi there, My firewall cluster throws me an error when i want to change members of an address group which is member of an other group (nested) When i try to change members is get the error " entry not found" Anyone else having this issue? or could anyone test this on an other 5.2 and 5.0.7 FG? You can test this is as follows: First create some test addresses: FW02A (address) # config firewall address FW02A (address) # edit zztest1 new entry ' zztest1' added FW02A (zztest1) # set subnet 10.0.0.1/32 FW02A (zztest1) # next FW02A (address) # edit zztest2 new entry ' zztest2' added FW02A (zztest2) # set subnet 10.0.0.2/32 FW02A (zztest2) # next FW02A (address) # edit zztest3 new entry ' zztest3' added FW02A (zztest3) # set subnet 10.0.0.3/32 FW02A (zztest3) # next FW02A (address) # end Then create two address groups where the first group is a member of the second FW02A # config firewall addrgrp FW02A (addrgrp) # edit zztestgrp1 new entry ' zztestgrp1' added FW02A (zztestgrp1) # set member zztest1 zztest2 FW02A (zztestgrp1) # next FW02A (addrgrp) # edit zztestgrp2 new entry ' zztestgrp2' added FW02A (zztestgrp2) # set member zztestgrp1 FW02A (zztestgrp2) # next And now try to change members of the first group: FW02A (addrgrp) # edit zztestgrp1 FW02A (zztestgrp1) # set member zztest1 zztest2 zztest3 entry not found in datasource value parse error before ' zztest1' Command fail. Return code -3 FW02A (zztestgrp1) # append member zztest3 entry not found in datasource value parse error before ' zztest3' Command fail. Return code -3 FW02A (zztestgrp1) # unselect zztest2 command parse error before ' zztest2' Command fail. Return code -61 When you remove the first group as a member of the second group all works properly. Hope some of you have time to test this on 5.0.7 and 5.2 setups. - MBR-

[MBR]

Hey Mitch,

I seems the 5.2 issue is indeed now also problematic om 5.0.9

As of today we experience the same issue in 5.0.9... (pff downgraded from 5.2 to 5.0.7 earlier to solve this issue)

Have you opened a ticket with support?

I will also open a ticket on this.

Keep us posted!

[Mitch_111]

Hi There,

yes ive openend a Ticket, and its a known Bug which will be fixed in 5.10 end of November...

Well, whats up with QA objects in Groups...its real real Basic Stuff how can such a bug come in a release...

Now im Waiting, during this time i need to put new Objects direct in the matching Rule to get my work done...

Regards

Michael

[MBR]

Hi Mitch,

They told me the same. Waiting for the 5.0.10 patch now.

The bug id is a bug id they generated for my original bug report ticket for 5.2. I needed to downgrade from 5.2 to 5.0.7 until they fixed it (5.2.1). Now i get the same bug again after i upgraded to 5.0.9. :( So i have to some bug reported twice now ?!?!.

I dont get it that they didn't fixed it already when they released 5.0.9 because they got the solution already.

And yes indeed as you also said this is basic stuff!! how is it possible such bugs aren't noted during Q&A..

Well i guess there is nothing to do about it and we have to wait until the release of patch 10...

[olafmarcos]

As a quick and dirty workaround, I remove the group from the nested group(s), append the address(es) i need, and rejoin the group to the nested group(s).

I think this is more feasible and smarter than include address(es) in every policy we need.

Best regards,

Olaf

[MBR]

That wasn't working also. But it doesn't matter anymore because the issue is already fixed now in the new firmware versions.

[olafmarcos]

MBR wrote:

That wasn't working also. But it doesn't matter anymore because the issue is already fixed now in the new firmware versions.

I  just did 20 minutes ago in our v5.0,build0291 (GA Patch 8) and worked like a charm.

We can't afford update by the moment.

Cheers,

[MBR]

This thread is regarding FortiOS 5.2.

The same issue arise when you upgrade to 5.0.9

It's fixed again in 5.0.10 and up

[olafmarcos]

MBR wrote:

This thread is regarding FortiOS 5.2.

The same issue arise when you upgrade to 5.0.9

It's fixed again in 5.0.10 and up

Upsss, my apologies...

Good to know it.

Regards,