Ferritaas Incident Intelligence
Defect Intelligence Report Bug 0883901 Severity: Medium (P3)

Terraform fortios Provider Schema Mismatch When Mutating SD-WAN Zones

Architectural CMDB REST API changes across FortiOS 7.2.4 to 7.4 cause legacy Terraform fortinetdev/fortios providers to drop SD-WAN member interface weights during zone mutations, defaulting weights to 0 and overloading primary links.

🚀 Open Full Runbook & Live Automation on Ferrite → Browse Known Issues Directory
⏱️ Est. Triage: 6–8 mins | Automated CLI Available

Technical Root Cause Analysis

Automated FortiGate SD-WAN deployments utilizing Terraform rely on the official fortinetdev/fortios provider to configure fortios_system_sdwan resources. In FortiOS 7.2 releases, member interface metrics—including weight, priority, and cost—were serialized within the nested members list under the root SD-WAN object.

In FortiOS 7.4, Fortinet restructured the underlying CMDB REST API to decouple zone definitions from member interfaces and allow multi-zone member assignment. When using Terraform provider versions prior to v1.18.0 against FortiOS 7.4.x, the provider's schema parser fails to map the relocated member weight attributes. During terraform plan and apply cycles, the provider interprets missing attributes as intentionally removed parameters (weight = null). The resulting HTTP PUT payload omits the weight field, causing the FortiOS CMDB daemon to reset all interface weights to the factory default of 0. As a result, weighted load-balancing algorithms fail, diverting all outbound traffic onto a single WAN uplink and causing severe packet loss and application latency.

Terraform Plan Output: # fortios_system_sdwan.default will be updated in-place ~ zone { name = "virtual-wan-link" ~ members { - weight = 20 -> null # attribute dropped by schema mismatch - cost = 10 -> null } } [httpsd 9411] [api] PUT /api/v2/cmdb/system/sdwan: member weight omitted, resetting to default 0 [sdwan] SD-WAN member 1 (port1) weight set to 0; member 2 (port2) weight set to 0 [sdwan] SLA steering algorithm: weighted load balancing disabled, falling back to sequential fill

Affected Firmware & Blast Radius Matrix

FortiOS Branch Vulnerable Builds Confirmed Clean Build Status & Workaround
FortiOS 7.4 7.4.0 – 7.4.2 7.4.3+ Upgrade provider to v1.18.0+
FortiOS 7.2 7.2.4 (during migration) 7.2.5+ Use explicit member resource blocks
FortiOS 7.0 Not Affected 7.0.x Branch Clean Uses legacy monolithic schema

Platform Impact: Affects automated cloud (AWS, Azure, GCP) and on-premises SD-WAN FortiGate clusters managed via Terraform CI/CD pipelines.

Step 01: Free Verification CLI (Safe Read-Only)

Execute these commands to verify whether your SD-WAN member weights have been silently zeroed out and inspect live link utilization:

Diagnostic Commands

# 1. Display active SD-WAN zone configuration and member associations
diagnose sys sdwan zone

# 2. Inspect running SD-WAN member configurations, weights, and gateways
show system sdwan

# 3. Check live SD-WAN member status, link metrics, and SLA status
diagnose sys sdwan member

# 4. View real-time REST API mutations and payload decoding
diagnose debug application httpsd -1
diagnose debug enable

Remediation & Workaround Steps (Teaser Preview)

Review the complete step-by-step schema migration guide and non-disruptive Terraform refactoring in the Ferrite platform:

Step 02: Audit Terraform Provider Version and Schema Mapping

Verify current provider lock files and identify incompatible resource declarations across your infrastructure repositories.

🔒 Interactive CLI Available in Ferrite Runbook #14

Step 03: Update Terraform Manifest to Decoupled SD-WAN Resource Model

Migrate configuration from monolithic fortios_system_sdwan to discrete zone and member resource blocks.

🔒 Interactive CLI Available in Ferrite Runbook #14

Step 04: Execute Non-Disruptive State Refresh and Metric Convergence

Import running firewall state and reapply member interface weights without tearing down active IPsec tunnels.

🔒 Interactive CLI Available in Ferrite Runbook #14
⚡ Ferrite Platform Superpowers

Execute the Complete Runbook with Live Browser Automation

Connect to your FortiGate via browser console (Web Serial) or jumpbox SSH bridge, verify SD-WAN member weights in real time, generate automated Terraform fix scripts, and generate TAC P3 evidence dossiers.

⚡
Live Browser Automation Direct terminal interface with real-time SD-WAN metric validation.
📟
1-Click Tera Term (.ttl) Instant script generation for air-gapped jumpbox audits.
🛡️
Zero-Trust Scrubber Strips API keys, public WAN IPs, and gateway tokens locally.
📄
TAC Escalation Dossier Standardized evidence export with SHA-256 seal.

Frequently Asked Questions

What causes Bug 0883901?

The FortiOS REST API restructured SD-WAN zone and member hierarchies in 7.4. Older Terraform providers fail to serialize member weights, causing the firewall to reset weights to 0.

What are the operational consequences of zeroed member weights?

Weighted load-balancing rules fail, dumping all enterprise traffic onto a single WAN uplink while other circuits sit unused.

Which provider version resolves Bug 0883901?

Terraform provider fortinetdev/fortios v1.18.0 and above natively supports the updated 7.4 schema without dropping member weights.