FortiManager Users Encounter 'firewall service custom protocol' Error Post-ADOM Upgrade

What's Happening?

FortiManager users are experiencing an installation issue characterized by an 'error firewall service custom protocol' message after upgrading their Administrative Domain (ADOM). This problem arises when multiple 'firewall service custom' objects fail

to install correctly. The root cause is identified as a change in the default protocol from TCP/UDP/SCTP to TCP/UDP/UDP-Lite/SCTP when upgrading from FortiOS 7.4 to 7.6. Although a 7.6 ADOM should align with this logic, the upgrade can result in 'firewall service custom' objects having a UUID (Universally Unique Identifier) set to ZERO, which prevents their proper installation. This issue manifests as an error message during the post-upgrade installation process, indicating an invalid value for the protocol property.

Why It's Important?

This issue significantly impacts network administrators managing FortiManager environments, as it can disrupt the deployment and enforcement of firewall policies. The inability to correctly install custom firewall service objects means that critical network services or applications might not function as intended, leading to service outages, security vulnerabilities, or operational inefficiencies. Organizations relying on FortiManager for centralized management of their FortiGate devices could face considerable downtime and resource expenditure in troubleshooting and resolving these errors. The integrity of firewall configurations is paramount for network security, and any disruption to this process can have far-reaching consequences for data protection and network access control. The need for manual intervention or scripting to correct UUIDs adds complexity and potential for human error in critical infrastructure management.

What's Next?

To resolve the 'firewall service custom protocol' error, FortiManager users can manually update each affected object by adding a comment and clicking 'Ok' to generate a new UUID. However, for environments with numerous affected objects, a script-based solution is recommended. This involves first printing a list of all objects with a ZERO UUID using `execute fmpolic print-adom-object 167 +all`, then creating a script to unset the UUID for each affected object (e.g., `config firewall service custom edit "Jitsi_TCP_4443" unset uuid end`), and finally running this script against the 'Policy Package or ADOM DB'. After executing the script, administrators must verify that new UUIDs have been generated and that subsequent installations run without errors. This process ensures the correct functionality of custom firewall services post-upgrade.

Beyond the Headlines

This technical issue highlights the complexities inherent in managing large-scale network security infrastructures and the challenges associated with software upgrades. Even seemingly minor changes in default protocol definitions between software versions can cascade into significant configuration problems. It underscores the importance of thorough pre-upgrade testing in a staging environment to identify such issues before they impact production systems. Furthermore, the reliance on UUIDs for object identification within network configurations emphasizes the critical role of metadata integrity in system operations. The need for scripting to correct these errors points to a broader trend in IT operations where automation becomes essential for maintaining system health and consistency, especially in environments with a high volume of managed objects. This incident serves as a reminder for IT teams to maintain robust change management processes and to be prepared for unexpected post-upgrade remediation tasks.