Loading a Converted Global VDOM Configuration to a New FortiGate

[Joshua_DeltaNS]

Hello All,

We are working on a FortiGate upgrade for a customer and they have VDOMs configured on their current deployment. They are moving from a 1500D to 601F both running FortiOS 7.2.8. We have FortiConverter and have used the application to map all previous interfaces to new interfaces on the 601F. When attempting to restore the converted configuration onto the default configured 601Fs we receive the following errors in diagnose debug config-error-log read:

>>> "config" "vdom" @ 12398:command parse error (error -61)
>>> "config" "global" @ 12423:command parse error (error -61)
>>> "config" "vdom" @ 23614:command parse error (error -61)

These errors correspond to the places in the config where after multi-vdom mode is enabled, config vdom is used to initially create the vdoms, then config global is used to begin the global configurations as follows:

config vdom 

edit root

next

edit vdom1

next

edit vdom2

next

end

config global

config system global

etc...

...

config vdom

We have run into this issue previously and our solution was to manually paste lines into the CLI. However, I believe there has to be a better way. Thats what FortiConverter is for, right?

Is there anything built in that prevents vdom and global configurations from occurring in the same restoration file?

Are config vdom and config global not necessary in a backup file that is being used to restore a FortiGate configuration? If so, why does FortiConverter output the updated configuration file with them in it. 

We have tried multiple different ways to work around this issue while still managing a full system restoration and have not been able to find a solution.

Thanks for your help!

FortiGate  

[Toshi_Esumi]

We never used/relied on FortiConverter to do migration like what you're doing. But I'm assuming you at least need to match "vdom-mode" global setting to drop the multi-vdom config file on to the new device. Try....

config sys global

  set vdom-mode multi-vdom

end

When you change this part, it would ask you to re-login.

Then drop it again to see if it would work.

Toshi

[Joshua_DeltaNS]

So essentially, enable multivdom mode, remove that line from the config file, then drop it in again?

Trying now, will report results in a moment

[Toshi_Esumi]

Opposite. You need to make the 601F the multi-vdom mode, in order to drop a multi-vdom config file. By default any FGT is in non-vdom mode.

[Toshi_Esumi]

If it would still give you errors or doesn't come up, I would just call in TAC to get whatever necessary corrected.

Toshi

[Joshua_DeltaNS]

I was just hoping maybe someone else had encountered this in the wild!

[Joshua_DeltaNS]

Correct, I think you misunderstood. 

By default the FortiGate is in non-vdom mode. So I enabled multivdom mode, which prompted a logout. Next, I logged in again, the FortiGate is now in multivdom mode. Finally, I dropped in the config file with the line

set vdom-mode multi-vdom

removed.

This resulted in the same errors 

>>> "config" "vdom" @ 12396:command parse error (error -61)
>>> "config" "global" @ 12421:command parse error (error -61)
>>> "config" "vdom" @ 23612:command parse error (error -61)

My biggest question is, if this is the behavior when loading a global config for a multivdom deployment onto a new FortiGate, is it even possible to restore an entire configuration if the need were to arise or would that error out too? 

What I have seen so far leads me to believe that it is not possible to fully restore a FortiGate in multivdom mode. Rather, the global config and each individual vdom config needs to be taken and restored individually. 

[Joshua_DeltaNS · Accepted solution]

I believe I may have found the solution:

#config-version=FG6H1F-7.2.8-FW-build1639-240313:opmode=0:vdom=0:user=admin
#conf_file_ver=325820514117705
#buildno=1639
#global_vdom=1

#config-version=FG1K5D-7.2.8-FW-build1639-240313:opmode=0:vdom=1:user=admin
#conf_file_ver=4531018699642831
#buildno=1639
#global_vdom=1

These are the comments that appear at the top of each config file. I believe the vdom=0 and vdom=1 correspond to what commands the interpreter that reads in the script is set to accept. 

[Joshua_DeltaNS]

Upon reloading the config with the vdom=1 set after running it through FortiConverter and adding a "config global" at the top of the script, and an additional "end" at the end of it, I was able to successfully mirror the current running config!

FortiConverter should be updated to make this change automatically when creating an output for config using VDOMs