FMG: Bug in interface mappings upon rollout?
I try to eplain this to you:
if you create a mapping in the objects section of FMG Policy & Objects and you use an interface that already has a mapping you get notified about this and FMG reports that if you save this you are going to replace the old (=existing) mapping.
So far this is fine. You get to know that there already is a mapping and you could choose wether you want to replace it or not. Everthing ok here.
If you use an interface e.g. in a policy but forget to do a mapping for all FGT this policy is to be rolled out to, the FMG will notice that upon its integrity checks it does before it rolls out anything. It will then prompt you for the missing mappings so you can complete them. So far this is fine too.
When you then choose an interface of the FGT to complete the mapping you get all interfaces of the corresponding FGT in the drop down and you do not see which already have a mapping. Also you get interfaces that cannot be used as destination or source interface in a policy on a FGT. If you now chose an interface that already has a mapping the FMG will override the existing mapping without any notice or comment. So you neither notice there already was a mapping on this nor that it was replaced unlike the usuall way I wrote in the first stanza. The next check will then end up with yet more missing mappings due to that and the same problem again.
Then there are interfaces you cannot use in policies, like the modem interface or the ssl.vpn interface or also all members of the WLLB (virtual-wan-link) Interface. If you chose one of these FMG accepts that as a mapping but then fails to roll that out to the corresponding FGT because the FGT doesn't accept it. You then see the corresponding error in the log.
If you have a load of FGT in your FMG (we have 20) this could rather mess you up and is very annoying.
I consider this a bug or not been noticed by the developers even. Due to this I also openend up a ticket with TAC.
Maybe someone else ran into this issue and this might be helpful then.