PCNSE
NSE
StrongSwan
Solved! Go to Solution.
Nominating a forum post submits a request to create a new Knowledge Article based on the forum post topic. Please ensure your nomination includes a solution within the reply.
Andy Bailey wrote:I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).
Hey,
I don't have that problem - works fine for me since Beta 3.
Can you run the following on a Command Line, while you try to modify a policy:
diag deb reset
diag deb ena
diag deb cli 8
... and post the output
Br,
Roman
romanr wrote:Andy Bailey wrote:I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).
Can you run the following on a Command Line, while you try to modify a policy:
diag deb reset
diag deb ena
diag deb cli 8
... and post the output
In addition, please enable "diag debug app httpsd -1" and include that output.
Andy Bailey wrote:I've attached the output your requested Roman and Jordan. Thanks for your help.
Nothing really obvious for me. I tried opening the policy and then clicking ok (no changes) and again (no changes) same result both times. I tried Edge instread of Firefox too- no changes there either.
The key lines seem to be:-
[httpsd 9510 - 1522869450 error] cmdb_commit_from_json[1426] -- error saving request object to CLI (-651) [httpsd 9510 - 1522869450 error] _api_cmdb_v2_config[1137] -- error editing object (nret=-651) [httpsd 9510 - 1522869450 error] api_return_http_result[516] -- API error -651 raised
Interestingly I can delete policies- I just tried deleting a couple of unused policies and that worked fine (highlighted from the "IPv4 Policy" list and then just delete.
Any other ideas?
Hi Andy, we've tried with several FGTs and were unable to reproduce your issue. Looks like it's specific to your config after upgrade. From your CLI debug output, the CLI is rejecting the change (any policy edit save) from the GUI.
0: config firewall policy 0: edit 15 0: set ssl-ssh-profile "SSL Certs-Block Untrusted\\Invalid" -651: end
Here are a few other things to try:
1. Can you use the CLI to edit a policy? You can use the above commands to see further error reported by the CLI
2. Can you use the GUI to create new Policy? if not, please also include CLI and httpsd debug message
3. Does this happen to any policy edit via the GUI? 4. Can you check if your interfaces are correctly upgraded?
5. Which FGT model are you using? if possible, can you share your full config with us? you can email me the config at thuynh@fortinet.com
Tri
Anybody using IPsec VPNs on 6.0.0 yet?
Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.
I have one static ipsec, no difference or any thing to report. I haven't crafted any thing new or any dynamic ipsec/sslvpn as of yet.
Ken
PCNSE
NSE
StrongSwan
tanr wrote:Hi,Anybody using IPsec VPNs on 6.0.0 yet?
Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.
Upgrade a 60E from 5.6.0->5.6.2->6.00, no issue when I check from cli (diagnose debug config-error-log read).
1 static Ipsec Tunnel, working fine before and after upgrade.
2 FGT 100D + FTK200
3 FGT 60E FAZ VM some FAP 210B/221C/223C/321C/421E
tanr wrote:Anybody using IPsec VPNs on 6.0.0 yet?
Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.
Hi,
upgraded my configuration, hardware and firmware from FG110C Cluster 5.2.3 to FG60E Cluster 6.0.0 with at least 80 IPSEC VPN configured and no issue detected after the upgrade, all is working fine.
Regards.
FCNSP V.4, V.5
accidentally put space in between my FSSO name. Now if I edit it new FSSO name is prompted.
Fortigate Newbie
8th of April we upgraded 1200D HA a-a and 2x 500E 1x600D (Security Fabric: 500E&600D Upstream to 1200D) from 5.6.3 to 6.0.0 and all seamed to working great.
Tested SSLVPNs (LDAP) with RDP and several other bookmarks and tunnel mode; VLANs, dialupVPNs, DHCP sever, OSPF and DNS server ,..., FortiAnalyzer ,..., and all seamed working fine.
Remark: We have 15VLAN and Aggregated 10GBit/s connecting to the Backbone to Monitor Traffic internally and to the Internet - so all traffic is "passing" the Cluster)
These Problems gradually came up and we have been forced to downgrade the 1200D HA (NOT 500E !) back to 5.6.3 on 29th of April and all working fine again.
1. 30 Users out of 70 could not authenticate anymore to SSLVPN
2. Outlook disconnected sporadically, sometimes it was possible to start Outlook in safe mode to get access to eMail
3. Connection(s) to Database-Server(s) dropped
4. UPS's "created" additional problems to the environment due to dropped connections
5. VoIP Servers "started" to continuously drop connection from Internet; even became inaccessible (VirtualIP)
6. FortiAP-Profiles for AP421E and AP221E had to be deleted and new profiles needed to be created ...
7. ... and finally accessing the Internet with Internet-Browser's started to fail (blank pages, frozen PC's,...)
After 2 weeks of deep investigation, however, nothing was really pointing to the FireWalls as the source of the problems ... finally we found the FGT1200D is actively closing connections!
It does not happen with "E" models (61E, 500E tested and still in Production with 6.0.0)!
As I mentioned, downgrade to 5.6.3 was the solution.
Found a problem with eBGP over inter-vdom links. Anyone else having trouble with it?
Neighborship isn't getting formed, state is "idle" and it says "Not directly connecte EBGP".
Although ping is working between the vdoms.
Same config as in 5.6, just updated it.
sam91 wrote:Found a problem with eBGP over inter-vdom links. Anyone else having trouble with it?
Neighborship isn't getting formed, state is "idle" and it says "Not directly connecte EBGP".
Although ping is working between the vdoms.
Same config as in 5.6, just updated it.
Did you restart the BGP router process and what do you see if anything on diag sniffer packet any "port 179"
?
I would run two ssh session and restart the router process while running a packet capture and see if you get any syn/syn-ack from the ebgp peers.
PCNSE
NSE
StrongSwan
emnoc wrote:Just tried it but I can't see any packets :(Did you restart the BGP router process and what do you see if anything on diag sniffer packet any "port 179"
?
I would run two ssh session and restart the router process while running a packet capture and see if you get any syn/syn-ack from the ebgp peers.
The get router info bgp neighbor command also shows that no messages have been sent out:
VDOM 1
BGP neighbor is 169.254.255.5, remote AS 65101, local AS 65100, external link
BGP version 4, remote router ID 0.0.0.0
BGP state = Idle
Not directly connected EBGP
Last read , hold time is 6, keepalive interval is 60 seconds
Configured hold time is 6, keepalive interval is 2 seconds
Received 0 messages, 0 notifications, 0 in queue
Sent 0 messages, 0 notifications, 0 in queue
Route refresh request: received 0, sent 0
Minimum time between advertisement runs is 10 seconds
VDOM root
BGP neighbor is 169.254.255.6, remote AS 65100, local AS 65101, external link
BGP version 4, remote router ID 0.0.0.0
BGP state = Idle
Not directly connected EBGP
Last read , hold time is 180, keepalive interval is 60 seconds
Configured hold time is 6, keepalive interval is 2 seconds
Received 0 messages, 0 notifications, 0 in queue
Sent 0 messages, 0 notifications, 0 in queue
Route refresh request: received 0, sent 0
Minimum time between advertisement runs is 10 seconds
Btw: eBGP with another FG via VPN works fine.
CLI commands
diag ip route bgp all
diag debug en
PCNSE
NSE
StrongSwan
Select Forum Responses to become Knowledge Articles!
Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.
User | Count |
---|---|
1633 | |
1063 | |
751 | |
443 | |
210 |
The Fortinet Security Fabric brings together the concepts of convergence and consolidation to provide comprehensive cybersecurity protection for all users, devices, and applications and across all network edges.
Copyright 2024 Fortinet, Inc. All Rights Reserved.