Unable to add FortiGate to FortiManager

[k-lee]

Hi all,

I am attempting to build a Fortinet Lab. I have a FortiGate version 7.6.1 and FortiManager 7.6.2. Both devices are using trial licenses. 

When attempting to add the FortiGate to the Manager, I am getting a "probe failed" error. 

On the FortiGate I have FMG-Access selected, I configured the ENC-algorithm to default

On the FortiManager I configured ENC-algorithm to low and fgfm-ssl-protocol sslv3

When attempting to add the FortiGate to the FortiManager from the FortiGate Security Fabric -> Fabric Connectors I get the below error

Any assistance will be greatly appreciated

[dingjerry_FTNT]

Hi @k-lee ,

Is there any firewall device between the FGT and FMG?

On the FGT, please run the following CLI command to make sure that FGT can see FMG each other:

diagnose sniffer packet any 'port 541' 4

[Liebe4Alle]

any solution or step by step guide to fix this issue in Fortimager 7.6.2

[Rsilva86]

I’m trying to make it work too and received same error. I was using FM and FG trial version v7.4 and then v7.6

[jsunsaid]

I am also trying this with FMG 7.4.6 and FGT 7.4.6 and not having any success. I created a local CA server and new certificates for the FMG and FGT to use. Talking to Fortisupport, they will not confirm deny, or help while using a trial license. Which is understandable.

I have mine to a point where it gives the OP error then says it has registered to FMG and to then authorise in FMG. The FGT never appears. The debug logs also show success on the certificates and the connection but also a fail on using TLSv1.3. The trial has limited encryption ability so this is likely the issue.

I am inclined to assume it will not work without the 'set fgfm-peercert-withoutsn enable', as they removed this from newer versions their is no point trying. Save your time and sanity.

[Rub_aprendicia]

Hello,

I've  had problems installing FortiGate 7.6.2 and FortiManager 7.6.2 too, both trial versions with KVM machines.
So far, I haven't been able to make any progress.

I have set up a Windows 2019 Server with a local CA. I downloaded the ROOT CA certificate for the FMG, generated the CSR on the FMG, and signed this CSR using the CA to get the Certificate. So, in principle, the FMG setup seems okay.

BUT, the problems start with the FortiGate. It doesn't allow installing the same ROOT CA certificate that I installed on the FMG. Additionally, when I try to generate a CSR on the FortiGate, it only allows an RSA key size of 512 bits. Therefore, I CANNOT generate a CSR that is strong enough to be signed by the Windows 2019 Server CA.

And that's where I'm stuck. I can't proceed because the limitations Fortinet has imposed on trial versions for registering a FortiGate with FortiManager in a simple lab environment seem totally disproportionate and unreasonable.

Does anyone have a guide or a workaround ("trick") to solve this problem?

Note that the command mentioned previously:
    config system global
   set fgfm-peercert-withoutsn enable

DOES NOT WORK FOR FortiGate VERSION 7.6.2.

Thanks in advance,

[Rub_aprendicia]

And, This is the problem, the FortiOS Versions.

from the link:

https://community.fortinet.com/t5/FortiManager/Technical-Tip-Setup-custom-certificate-for-FGFM-proto...

you can see:

    Note: 

     Starting in v7.6.2/v7.4.6/v7.2.10, the fgfm-peercert-withoutsn command is no longer         supported, and FortiManager will always check the FortiGate's certificate for the         FortiGate Serial Number.

You can see that the command that allow register fortigate in fortimanager without certificates is only valid in lower versions: 

"

From v7.2.10/v7.4.6/7.6.2 the above command is not available anymore.

"

 included versions

In summary, you can use this command only until versions 7.2.9, 7.4.5 and 7.6.1

config sys global

     set fgfm-peercert-withoutsn enable

And this command is the key for register Eval VM (kvm) fortigate in Fortimanager Eval VM (kvm).