certificate for FGFM protocol - Error (Auto Link Disabled)

[BarryGhuman]

Hi Team, 

I am applying Secure communication between FortiManger and FortiGate. The certificates are good and tested properly. 

Here are the errors and debugs:

FortiManager:

2024-10-28 22:07:06 { "client": "dmserver:907", "id": 30, "method": "exec", "params": [{ "data": { "device": 164, "force": 0, "sn": "FGT70FTK220----9", "sn list": []}, "target start": 3, "url": "start\/tunnel"}], "root": "fgfm"}
2024-10-28 22:07:06 FGFMs(FGT70FTK220----9-164-172.16.1.1): server:send:
2024-10-28 22:07:06 put auth
user=admin
passwd=******

2024-10-28 22:07:06 FGFMs(FGT70FTK220----9-164-172.16.1.1): server:
2024-10-28 22:07:06 reply 501
request=auth

2024-10-28 22:07:06 Response:
2024-10-28 22:07:06 { "id": 30, "result": [{ "status": { "code": 2, "message": "no permission"}, "url": "start\/tunnel"}]}
2024-10-28 22:07:06 Response [unknown]:
2024-10-28 22:07:06 { "id": 30, "result": [{ "status": { "code": 2, "message": "no permission"}, "url": "start\/tunnel"}]}
2024-10-28 22:07:06 Request:
2024-10-28 22:07:06 { "client": "dmserver:907", "id": 31, "method": "exec", "params": [{ "data": { "device": 164, "force": 0, "sn": "FGT70FTK220----9", "sn list": []}, "target start": 3, "url": "start\/tunnel"}], "root": "fgfm"}
2024-10-28 22:07:06 FGFMs(FGT70FTK22014599-164-172.16.1.1): server:send:
2024-10-28 22:07:06 put auth
user=admin
passwd=******

2024-10-28 22:07:06 FGFMs(FGT70FTK220----9-164-172.16.1.1): server:
2024-10-28 22:07:06 reply 501
request=auth

2024-10-28 22:07:06 Response:
2024-10-28 22:07:06 { "id": 31, "result": [{ "status": { "code": 2, "message": "no permission"}, "url": "start\/tunnel"}]}
2024-10-28 22:07:06 Response [unknown]:
2024-10-28 22:07:06 { "id": 31, "result": [{ "status": { "code": 2, "message": "no permission"}, "url": "start\/tunnel"}]}
2024-10-28 22:07:06 Request:
2024-10-28 22:07:06 { "client": "dmserver:907", "id": 32, "method": "exec", "params": [{ "data": { "device": 164, "force": 0, "sn": "FGT70FTK220----9", "sn list": []}, "target start": 3, "url": "start\/tunnel"}], "root": "fgfm"}
2024-10-28 22:07:06 FGFMs(FGT70FTK220----9-164-172.16.1.1): server:send:
2024-10-28 22:07:06 put auth
user=admin
passwd=******

The Error on FortiGate:

Message Administrator admin login failed from fgfm(172.16.1.101) because of invalid password

On the FortiManger - Here is the configuration:

config system global
set fgfm-ca-cert 1
set fgfm-cert-exclusive enable
set fgfm-local-cert "FAC"
set usg enable
end

It works after adding username and password for the device under the FortiManager using:

# execute device replace user <device_name> <username>

# execute device replace pw <device_name> <password>

I want to understand why the username and password needs to be added manually after successful certificate verification. 

[Jean-Philippe_P]

Hello Barinder, 

Thank you for using the Community Forum. I will seek to get you an answer or help. We will reply to this thread with an update as soon as possible. 

Thanks, 

[BarryGhuman]

Hi Jean, 

I found that manually adding the FMG serial number on FGT helps, but I want to know if this is the procedure. 

Regards, 

Barry Ghuman

[Jean-Philippe_P]

Hello again :)

Thanks for the update, we will try to find somebody who can answer that!

@AEK @pminarik @Debbie_FTNT do you have maybe an idea?

Have a great day.

[AEK]

Hello Barry

Which FGT and FMG versions?

[Debbie_FTNT]

Hey Barinder,

In addition to certificate, FortiManager does also need a valid administrator login for FortiGate. Usually, FortiManager is used to push configuration to FortiGate, and this has to happen under a specific admin account.

[BarryGhuman]

Hi Debbie, 

I think there is a missing flow here. When manually adding the FortiManager serial number under the FortiGate "config system central-management". 

Could you verify if adding a serial number is required because it is not mentioned in the configuration guides? 

I am using 7.0.12 FMG and 7.0.16 FGT. 

Regards, 

Barry Ghuman