VIP issues - firewall/vipgrp/<name>/ : empty member is not allowed

[Lukáš_Majoros]

Hi,

I'm having a lot of issues regarding VIP / VIP groups lately. It all started after we have connected 1500D 6.2.X FGT to the FMG, for some reason, all VIPs (static) from Fortigate were converted to "dynamic" version and only few zones were imported, without all the other vlans (why? other adoms usually don't have any issues with importing all interfaces/vlans/emacs/zones). So I have manually mapped approx 500 vlans in ADOM database and I had to manually fix all VIPs (from dynamic to static, with extinf parametr > before it was set as zone, not vlan). Now I'm fighting with another issue... I'm not allowed to create new VIPgrp from imported VIPs (1:1 FGT configuration). I'm always getting error "empty member is not allowed".

Example config:

edit "SecretVIP1" set extip 1.1.1.1 set extintf "V666-Hell" set mappedip "1.0.0.1" next

edit "SecretVIP2" set extip 6.6.6.6 set extintf "V666-Hell" set mappedip "9.9.9.9" next

edit "VerySecretVIPgroup"  set interface "V666-Hell" set member "SecretVIP1" "SecretVIP2" next

I'm losing my mind here, am I doing something wrong? Please help:D

Thanks in advance! :)

LM

[Toshi_Esumi]

I know this doesn't help your situation and too late when you already have mulitple VIPs created by FMG. But we recently encountered a similar issue when I created a VIP and added it to a policy package. I still don't know the exact mechanism inside the FMG to handle a VIP with multiple FGT devices (or even with a single one) with a PP.

But when I created a VIP and a policy addition to a PP with two separate CLI scripts, it tried to map VIP per device dynamically despite my intention, changing VIP per location when install although this would cause the other locations to go out-of-sync. It was temporary to each so out-of-sync was acceptable.

What I did to fix the issue was 1) wiping out what previously created, VIP and policy. then 2) create one CLI script to create a VIP and a referencing policy so that the FMG doesn't set up mapping mechanism.

This solution was provided by TAC when I opened a ticket. So I recommend you do the same and get help from TAC. You might need to escalate the ticket to get the answer you want though if it doesn't go anywhere with the L1 tech.