Ideas on how to get Fortimanager back in sync after adding VDOM without Fortimanager?

[john_ring]

Recently I had to make emergency changes on my 800C Fortigates to add another VDOM while the Fortimanger's contact to the 800Cs was unreliable.  I'd started it some in the manager, and then when the push failed, I had to give up and do it directly on the 800Cs.

Now that we've been stable for some time I'd like to get this clean again.  At first the manager showed a "conflict" on the device.  Perhaps it wasn't the right way, but I went into the dashboard in Fortimanager and looked at "installation preview", which gave a list of commands it wanted to perform on the new VDOM - basically it wanted to remove all the static routes and policy rules.  Since the VDOM was only needed during the emergency, I was OK with that.  But I couldn't get the manager to push those commands, so I ran them directly on the 800Cs and had the manager "refresh device".

Now the device shows "Modified" instead of "Conflict".  Yet looking at the "installation preview" again shows "no differences".  And the list of virtual domains still shows the new VDOM I'd tried to add in the list as "Configuration Pending", which it will not permit me to delete.

On a similar thread someone suggested a "Re-install Policy", but that is greyed out for me.  Probably I'll need to call support, but I thought if someone had some ideas here first since it isn't urgent.  I'm able to manage all the other VDOMs normally since I didn't touch them outside of the manager.

[aagrafi]

A quick and dirty solution is to delete the FortiGate from the FMG and re-add it. I know it sounds brutal, but it works and at much less time than trying to fix the problem some other way.

An other way to fix this is by trying to make all changes in the FMG regarding this FG, so that you'll bring it at configuration parity with the FG. But as I said, deleting and re-adding the FG does not look very nice but it works.

[chall_FTNT]

The usual method for resynchronizing after making major changes directly on the FortiGate end: Retrieve >> Import Policy >> Install

[ergotherego]

When Re-Install Policy is greyed out, it's almost always because you need to perform an Install Wizard. FMG can't "reinstall" something it doesn't think it ever installed in the first place.

Additionally, running Install Wizard can be the solution to other little quirks that come up during a failed Re-Install.

Lastly, if you have workspace mode enabled (you have to lock and unlock ADOMs before making changes) you may need to unlock and re-lock the ADOM to force a full refresh of the displayed status.