Ansible fortinet.fortios Collection Idempotency Failure on Address Groups
The FortiOS REST API returns firewall address group members in non-deterministic internal object sequence, causing the Ansible fortinet.fortios collection to detect false state drift and issue redundant PUT updates on every playbook run.
Technical Root Cause Analysis
In automated NetDevOps pipelines, Ansible relies on strict idempotency: if the state defined in an infrastructure playbook matches the running configuration on the firewall, the execution must return changed: false. The fortinet.fortios.fortios_firewall_addrgrp module performs this validation by fetching the existing address group configuration via the CMDB REST API and calculating a JSON diff against the user's YAML specification.
In FortiOS 7.2.1 through 7.2.5, the CMDB API endpoint returns address group member lists ordered according to internal database allocation slots rather than alphabetical string sorting. When Ansible receives the response, it compares the unordered member array against the YAML list. Because array element positions differ, Ansible assumes an unauthorized configuration change has occurred and issues an HTTP PUT request to update the group. Every unnecessary PUT causes a configuration commit, generates a new revision checksum, and forces the FortiOS kernel to recompile policy lookup indices for all firewall policies referencing the group, generating high CPU spikes and breaking FortiManager sync status.
Affected Firmware & Blast Radius Matrix
| Component | Vulnerable Builds | Confirmed Clean Build | Status & Workaround |
|---|---|---|---|
| Ansible Collection | fortinet.fortios < 2.3.4 | v2.3.4+ | Upgrade collection or apply sort filter |
| FortiOS 7.2 | 7.2.1 – 7.2.5 | 7.2.6+ | Canonical API member sorting enabled |
| FortiOS 7.4 | 7.4.0 | 7.4.1+ | Native alphabetical sorting active |
Platform Impact: Affects all enterprise environments managing firewall address objects and groups via Ansible automation pipelines.
Step 01: Free Verification CLI (Safe Read-Only)
Run these diagnostic commands to verify current address group member ordering, check configuration checksum stability, and monitor REST API mutations:
Diagnostic Commands
# 1. View firewall address groups and current member ordering
show firewall addrgrp
# 2. Check local system configuration checksum to verify commit drift
diagnose sys checkum fgt
# 3. View address group configuration checksum specifically
diagnose sys checkum cfg-system firewall.addrgrp
# 4. Monitor real-time REST API mutations to catch repeated unnecessary PUTs
diagnose debug application httpsd -1
diagnose debug enableRemediation & Workaround Steps (Teaser Preview)
Review the complete idempotency restoration and collection upgrade guide inside the Ferrite interactive platform:
Frequently Asked Questions
The FortiOS API returns address group members sorted by internal memory index. Ansible compares this to the playbook's list, misinterprets the different sequence as an unauthorized change, and sends redundant update requests.
While data forwarding continues, each update triggers CPU spikes from kernel policy re-evaluations and invalidates FortiManager synchronization checksums.
The fortinet.fortios Ansible Galaxy collection v2.3.4+ and FortiOS 7.2.6/7.4.1+ resolve the issue by enforcing alphabetical member sorting.