Config Download is Failing on Fortigate Firewalls When Pre and Post Login Banners are Enabled

I finally enabled pre and post login banners on our Fortigate firewalls to comply with CIS L1 guidelines. Now, the config downloads are failing. I was looking through the forums and saw the following:

- If all it is waiting for is an "a" to continue try to add the following line to the template:
- <Command Name="PreCommand" Value="a"/>
- or if it needs a carriage return as well:
- <Command Name="PreCommand" Value="a${CRLF}"/>

Since I am am uncertain as to which template they are referring to or how to even apply it, I am looking for some guidance from the community before I open a case with SolarWinds. Thanks in advance!

Mark

Find more posts tagged with

fortigate

templates

config_downloads

Accepted answers

All comments

donrobert5

Try this one.

support.solarwinds.com/.../Fortinet-device-does-not-download-configuration-or-connect-with-banners-enabled

TuesdayRain

@rosema
I suggest that you enable session trace first in NCM then download the config.
Read the session trace to know at which part the session is failing.

how to get sessiontrace

If you need to modify the device template, follow this KB.
https://documentation.solarwinds.com/en/success_center/ncm/content/ncm-create-device-template.htm

Click Settings > All Settings.
Under Node & Group Management, click Manage Device Templates.
Select a custom device template.
Click Edit and select either Using Interactive Wizard or Using XML Editor.
Edit values, and click Finish (in the wizard) or Save (in the XML editor).

If you are not sure what device template your node is using, just go to the edit node page of the node and at the bottom you will see the device template that the node is using.

gobob

Do you have a guide on how to read a session trace?

TuesdayRain

@gobob

this may help
https://support.solarwinds.com/SuccessCenter/s/article/NCM-How-to-Read-a-Session-Trace?language=en_US

If you need further help, I suggest opening a support case.

gobob

Thanks! Do you recommend the same tech from this thread?

(+) NCM keeps reporting a "Start Transfer Error. See log for details"..but I am not sure where the log files are. - Forum - Network Configuration Manager (NCM) - THWACK (solarwinds.com)

donrobert5

In addition, you might want to check the Solarwinds Academy's Virtual classroom for you to maximize your solarwinds products.

https://customerportal.solarwinds.com/VirtualClassrooms

This is free. You just need to have a login into the customer portal.

rosema

Thanks to all for pointing me in the right direction! Update - I ended up copying the base Fortinet template and created one for each of my firewall types based on OID. All I had to do was add the <Command Name="PreCommand" Value="a"/> line to each of the newly created templates. Your advice was very much appreciated!

Mark