FortiManager displays policy installation copy failures error when ipsec template gets unassigned.

Workaround: Please ensure a fresh FortiManager's backup is created prior to any changes. Instead of unassigning IPSec template, modify IPSec template and replace the reference to IPSec tunnel interface with another interface.

FortiManager fails to retrieve FortiGate's configuration when external-resource objects include a "g-" prefix.

Workaround: There are two workarounds; use the approach that works best for your environment. If it is possible, create a new backup of your FMG and FGT(s) before making any changes.

First workaround approach:

1. Re-create all threat feeds locally in VDOM configuration and update policies and security profiles that reference them to the local threat feed vs. the global feed.

2. Delete the global threat feed objects.

Second workaround approach:

1. Perform policy reinstallation. FMG adds original threat feed objects within the VDOM configuration without the 'g' prefix.

2. FMG reports 'install OK/verify FAIL' at the end of the policy installation.

3. Run scripts to delete the global threat feed objects (objects with the 'g' prefix) from the FGT.

4. Retrieve the FGT configuration from FMG.

5. Perform another policy installation to update the configuration synchronization status between the FGT and FMG. No commands are pushed during this stage according to the install wizard.

The "where used" feature does not function properly.

Syncing EMS tags from FortiManager fails when the EMS Connector is configured in multi-site mode.