While attempting to push a NetFlow configuration script through the FortiManager policy package: an administrator encounters an error stating that an object is unrecognized in line 4. What must the administrator do to successfully apply the NetFlow configuration script and avoid the object unrecognized error?

The script fails at the line set source-ip $(vdom) because the predefined metadata variable $(vdom) resolves to the name of the Virtual Domain (e.g., "root" or "AGEUSR"), which is a string. The set source-ip command requires a valid IP address, not a string name. The "object unrecognized" error occurs because the FortiGate CLI parser does not recognize the VDOM name as a valid IP address.

To resolve this, the administrator must create a custom metadata variable (e.g., netflow-source-ip) and assign the correct source IP address value to this variable for each specific VDOM. The script should then be modified to use this new variable, for example: set source-ip $(netflow-source-ip).

A. A permissions issue would likely generate a "permission denied" error, not an "object unrecognized" error related to an invalid value in a script.

B. Running the script on the device database bypasses the policy package model and does not fix the underlying script error, which is the incorrect use of the $(vdom) variable.

D. Normalized interfaces are used to abstract physical interface names for use in firewall policies within a policy package, and are not relevant to system-level CLI configurations like NetFlow.

1. FortiManager Administration Guide 7.4.1

Chapter: Device Manager

Section: Scripts

Subsection: Using variables in scripts.

This section details the use of both predefined variables and custom metadata variables (referred to as Device VDOM variables). It explains that $(vdom) resolves to the VDOM name. It also describes how to create custom variables and assign device-specific or VDOM-specific values

which is the required solution to provide a valid IP address in this scenario. (p. 268-270)