Policy Install Fails after Config Synchronized

[LarW63]

Hi,

First, the platform is Fortimanager v5.4.5 with multiple Fortigate 200s running FortiOS v5.4.9.  Initially, I was able to push policy from FMG without any problems.

I then needed to change some log settings on all of the FGs.  So, in FMG I created and ran a Remote Fortigate Directly (CLI) script to change the settings, as follows. 

config global config log fortianalyzer filter set local-traffic disable end config log syslogd filter set local-traffic disable end end

After running the Script, in Device Manager the FGs Config Status showed "Synchronized".  I then tried to Install a Policy Package after having made an IPv4 policy change in FMG and received the following validation error.

Device:otk-fw-11 VDOM:root Copy device global objects

Post vdom failed: error :20 - interface binding contradiction

Copy objects for vdom root

Note that I only ever use 'Any' as the Interface when defining Objects.

After cross-checking objects, comparing before/after configs and trying several different things, I went into one of the FGs and deleted all of the existing Multicast Policies (there were only 7).  After that I was then able to push the policy package, which recreated the 7 Multicast policies, without any issue.

Does anyone have any suggestions about what may be causing this weird behavior?

Thanks,

Larry

[ergotherego]

I don't have any advice since I don't use multicast policies, but it sounds like a transient bug. FMG does seem to commonly have issues with the more complex / less common configuration elements.

Curious why you chose to use a direct CLI script? I have always preferred to use the Device Database script. A lot safer that way in my opinion for a few reasons. FMG will still perform proper validation of that configuration against other aspects, versus a 'spray and pray' sort of approach. And you can then run Install Wizard and select Policy Package and Device level settings so you can see a preview of the device-level changes being made. I always like to preview the changes FMG pushes, even for simple log setting changes.

[chall_FTNT]

Were any of the original multicast policies on the FGT created directly on the FGT instead of via FMG?  If so, perhaps the objects referenced in those policies were tied to specific interfaces on the FGT.  As long as those objects are not referenced by existing policies on the FGT, then a FMG install could modify those objects during the install.