PCNSE
NSE
StrongSwan
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Andy Bailey wrote:I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).
Hey,
I don't have that problem - works fine for me since Beta 3.
Can you run the following on a Command Line, while you try to modify a policy:
diag deb reset
diag deb ena
diag deb cli 8
... and post the output
Br,
Roman
romanr wrote:Andy Bailey wrote:I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).
Can you run the following on a Command Line, while you try to modify a policy:
diag deb reset
diag deb ena
diag deb cli 8
... and post the output
In addition, please enable "diag debug app httpsd -1" and include that output.
Andy Bailey wrote:I've attached the output your requested Roman and Jordan. Thanks for your help.
Nothing really obvious for me. I tried opening the policy and then clicking ok (no changes) and again (no changes) same result both times. I tried Edge instread of Firefox too- no changes there either.
The key lines seem to be:-
[httpsd 9510 - 1522869450 error] cmdb_commit_from_json[1426] -- error saving request object to CLI (-651) [httpsd 9510 - 1522869450 error] _api_cmdb_v2_config[1137] -- error editing object (nret=-651) [httpsd 9510 - 1522869450 error] api_return_http_result[516] -- API error -651 raised
Interestingly I can delete policies- I just tried deleting a couple of unused policies and that worked fine (highlighted from the "IPv4 Policy" list and then just delete.
Any other ideas?
Hi Andy, we've tried with several FGTs and were unable to reproduce your issue. Looks like it's specific to your config after upgrade. From your CLI debug output, the CLI is rejecting the change (any policy edit save) from the GUI.
0: config firewall policy 0: edit 15 0: set ssl-ssh-profile "SSL Certs-Block Untrusted\\Invalid" -651: end
Here are a few other things to try:
1. Can you use the CLI to edit a policy? You can use the above commands to see further error reported by the CLI
2. Can you use the GUI to create new Policy? if not, please also include CLI and httpsd debug message
3. Does this happen to any policy edit via the GUI? 4. Can you check if your interfaces are correctly upgraded?
5. Which FGT model are you using? if possible, can you share your full config with us? you can email me the config at thuynh@fortinet.com
Tri
https://docs.fortinet.com/uploaded/files/4328/fortios-v6.0.0-release-notes.pdf
Beta and interims have been good.
Nice Easter surprise.
I'm reading through some of the documentation. I was interested in the fabric changes.
So far- you still cannot have VDOMs enabled and participate in a security fabric which is still ridiculous. Also- the guide appears to be inconsistent for setting up a fabric as far as what is required. The diagrams show that a fortianalyzer is required, but all the text makes it seem like it is optional by referring to it as a recommended item. As I understand it, in 5.4 you only needed fortigates, in 5.6 you need an analyzer to use fabric features. Is that requirement now dropped again? Unfortunately almost all my devices have multiple VDOMs (mixing transparent and NAT modes) so I haven't been able to verify myself.
CISSP, NSE4
Totally agree.
I was excited about the new feature that attempts to make the swithcontroller work with mulitble VDOMs. I have not tried it yet, as the documentation says that some of the bare essentials like STP (and related), QoS, 802.1X etc. are not supported with this feature enabled.
It would be really helpful to know what is on the roadmap for VDOMs in the near future that actually works.
@neonbit: FOS v5.4.8 fixes the 'policies all-expanded' GUI bug already.
did the upgrade on my 100d, after i tested it on my DC 100d which was fine.. however the one in my office did the upgrade, comes up and all seems okay but cannot access the web interface through http or https.. ssh works fine and the firewall is letting traffic through and VPNs etc. are up, but the web interface on http or https is totally knackered! tried changing ports via SSH and enabling the http/https access on other interfaces, same thing!
Just a warning
Upgraded 201E from 5.6.3 to 6.0 and working great for me so far. Tested local logging, SSLVPNs with RDP bookmarks and tunnel mode, VLANs, dialupVPNs, DHCP sever and DNS server and all working fine so far.
Registered the FortiClient Linux (beta) to the FGT and it now shows up on the FGT (including my avatar).
I like how when you open the policy section it now defaults to the collapse all view instead of the expand all one like it was before.
One thing that I noted in the release notes is if you're upgrading from 5.6.3 > 6.0.0 you can't have any VLANs tied to an interface, and then have a zone referencing the interface and the zone. Hope it doesn't burn anyone that didn't read the notes!
All up very happy with this build so far, especially for a X.0 GA build.
rkhair wrote:did the upgrade on my 100d, after i tested it on my DC 100d which was fine.. however the one in my office did the upgrade, comes up and all seems okay but cannot access the web interface through http or https.. ssh works fine and the firewall is letting traffic through and VPNs etc. are up, but the web interface on http or https is totally knackered! tried changing ports via SSH and enabling the http/https access on other interfaces, same thing!
Just a warning
Just a thought, that sounds like a certificate issue (if you have redirect to https enabled as well)
Check the 'admin-server-cert' setting under conf sys global.
Simon
NSE8
Fortinet Expert partner - Norway
simonorch wrote:
rkhair wrote:Just a thought, that sounds like a certificate issue (if you have redirect to https enabled as well) Check the 'admin-server-cert' setting under conf sys global. Simon
did the upgrade on my 100d, after i tested it on my DC 100d which was fine.. however the one in my office did the upgrade, comes up and all seems okay but cannot access the web interface through http or https.. ssh works fine and the firewall is letting traffic through and VPNs etc. are up, but the web interface on http or https is totally knackered! tried changing ports via SSH and enabling the http/https access on other interfaces, same thing! Just a warning
Will I bit the bullet , my new FWF50E has a fresh v6.0 installed ;) The upgrade from v5.6.3 went off with zero issues. It did take a few longer minutes for the WebGUI to be present. I will upgrade a FWF60D next and see what a D model does.
FWF50E3U17002431 # get system status | grep ersion Version: FortiWiFi-50E v6.0.0,build0076,180329 (GA) BIOS version: 05000013 Release Version Information: GA
Ken
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1527 | |
1020 | |
749 | |
443 | |
209 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.