Troubleshooting

In FireSight. The FortiManager connection uses an API token only. If Test fails:

An HTTP error (such as HTTP 401) or a permission message: the token is wrong, was regenerated, or the API administrator's trusted hosts don't include the FireSight server. Generate a new key, then Edit the connection and paste it.
cannot reach FortiManager: check the address, port, firewall rules between FireSight and FortiManager, and Verify the TLS certificate (turn it off only for a lab with a self-signed certificate).
environment variable FMG_… is not set: the variable named under Or read the token from an environment variable isn't set in the app container.
no API token configured: edit the connection and paste a token.

In the export script. sign-in refused by FortiManager usually means the account can't use a password with the API: it's an API user, signs in through RADIUS, LDAP, TACACS+ or SAML, has two-factor sign-in, a password that must be changed, or no JSON API access. Use a read-only API administrator and its token (--token-env), and run with --diagnose to see FortiManager's answer. See The FortiManager export script.

Sync shows warnings

Synced with warnings means some parts couldn't be read. The warning text says which:

Warning	Usual cause
…: no policy counters (…)	FortiManager can't reach that FortiGate, so hit counts are missing. Never hit and Inactive can't be judged for it.
…: routing table unavailable / interfaces unavailable / zones, policy routes and SD-WAN unavailable	The same: FireSight reads these from the FortiGate through FortiManager's device proxy. Placement on that firewall may be incomplete.
workspace mode unavailable	The API administrator can't read FortiManager's global settings. Set the management domain's (ADOM's) workspace mode by hand.
…: normalised interfaces unavailable	The API administrator can't read the ADOM's normalised interfaces.

Upload too large

the upload is too large (200 MB at most) or the files are too large (200 MB at most):

Compress the files with gzip (.gz); FireSight expands them (up to 1 GB each once expanded).
For a FortiManager export, export a few ADOMs (management domains) at a time with --adom and load each as its own snapshot.
Upload at most 50 files at a time.

… expands to more than 1024 MB: export fewer ADOMs at a time means a compressed file is too big once expanded.

FortiManager backups (.dat) may be up to 4 GB.

A snapshot can't be read

Message	What to do
this doesn't look like a FortiOS configuration file	Upload a plain-text `.conf` backup. Password-protected backups can't be read as configuration files; back up without a password, or load it as a backup with its password.
no firewall policies or interfaces were found in this file	The file isn't a full configuration.
this isn't a FortiManager export made with FireSight's export tool	Upload the `.json.gz` from `fmg-export.py`.
the backup is encrypted: enter the password it was made with	Enter the Backup password.
the password is wrong, or this backup uses an encryption FireSight doesn't know yet	Check the password. FortiManager 7.4 backups can't be read yet: use the export script.

Download failed on the activation request

Download activation request shows Download failed when this FireSight build can't make an activation request: it doesn't hold the portal's encryption key yet. The server's actual reason is this FireSight build doesn't have the portal's encryption key yet, so it can't make an activation request; give the portal this system's serial number instead.

What to do:

Copy the System serial from Settings, License.
Contact FireSight support with the serial. Support either issues the license for it, or gives you a value for FIRESIGHT_PORTAL_REQUEST_KEY (see Server configuration).
Upgrade to a release that includes the portal key when one is available.

The same message appears if your session has ended; sign in again and retry.

License messages

See Licensing for every message when installing a license, and Register a system for the portal's activation request messages.

Common situations:

A banner says deployments stop on a date. You're in a grace period: over the licensed firewall count, the license expired, or the hardware changed. Renew, ask for more firewalls, or request a re-host before that date.
Deployments are refused with New deployments are stopped by the FireSight license. Install a valid license. Back-out, approvals, sync and audit keep working meanwhile.
Firewalls in use is higher than expected. Every firewall on a live connection counts, unless it is Removed from FortiManager. Firewalls reached through two connections count once. See What counts as a firewall.

Device health shows Not checked

Cause	What to do
Monitoring is off or hasn't run	Check Check firewall health every (minutes) isn't 0, and that `FIRESIGHT_SCHEDULER` isn't `false` on every copy of FireSight. Click Check now.
Health couldn't be read: … in Issues	The connection couldn't be asked. Click Test on the connection. Through FortiManager, the FortiGate must be connected to FortiManager and its monitor API readable through the device proxy.
The firewall isn't in a management domain	Sync the connection.
Brand new	Interface load needs two checks; wait one interval.

A firewall FortiManager reports as disconnected shows as down (after Down after missed checks), not as Not checked.

The form expired (portal)

The form expired. Go back, reload the page and try again. appears on the customer portal when a form was open for a long time or the portal's cookies were blocked.

Go back, reload the page and submit again.
Use the portal's normal address, https://portal.firesightsystems.com, and allow its cookies.

If the message says This portal is set up for … but you opened it at …, open the portal at the address it names.

The plan has changed

the plan has changed since you opened it; review the firewalls again before confirming (FireSight) means the request was re-planned after you opened it. Reload the request, check the firewalls again and confirm.

the rule base changed since this plan was made means policies changed in the meantime. Edit the request and save it to re-plan it, then confirm again. See Create a rule request.

Signed out unexpectedly

invalid or expired session or being returned to the sign-in page means your session ended: it ran out (Session length (minutes), 8 hours by default), you closed the tab, or your password or roles were changed or Sign out everywhere was used. Sign in again.

Single sign-on fails

this sign-in link has expired or was already used; sign in again: the one-time code is valid for 60 seconds. Sign in again.
Redirects go to the wrong address: set Public address of FireSight under Settings, Sign-in methods, General.
your account isn't in any group that has access to FireSight: map the person's group to a role, or set a default role. See Sign-in methods.

Audit log shows the proxy's address

Add the proxy to FIRESIGHT_TRUSTED_PROXIES. See Reverse proxy.

FireSight won't start

set strong values (32+ chars) for: FIRESIGHT_SECRET_KEY, … or FIRESIGHT_CORS_ORIGINS must list origins explicitly in production in docker compose logs app: set the values in .env and restart. See Install FireSight.

Still stuck

Contact FireSight support with the FireSight version (Settings, System), the system serial (Settings, License) and the exact message.