New Member

Solved

5.4.0 is Out

Forum|Forum|10 years ago
December 22, 2015
8 replies
100282 views

Hey, who is going first ?

Some small models like 40C are not support.

Just have a quick look at release notes, there is a loooooot of know issues...

Best answer by emnoc

IMHO In a production business env you should not upgrade to any new release unless it's a do or die must have feature that you need.

BaptisteAuthor

New Member

What's new is now available (122 pages !!!) : http://docs.fortinet.com/uploaded/files/2801/fortigate-whats-new-54.pdf

natech

New Member

Took the 5.4 plunge and was pleasantly surprised to see everything generally working. New interface is slick and fast, but still has some growing pains and idiosyncrasies. Switched from the default monochrome theme, as my eyes didn't appreciate everything being blurred together. :)

FGT 1000C previously running 5.2.5, with a few hundred policies along with dozens of objects and SSL VPN portals, FSSO authentication for two AD domains along with RADIUS accounting enabled from our wireless system, multiple VLANs running off an LACP trunk, two ipsec tunnels to Azure, and heavily utilizing application inspection, web filtering, IPS, and captive portals.

So far so good, but I will update if I hit any snags.

discoscott

New Member

Can anyone shed any more light on the new feature Virtual Wire Pair and whether its possible to bring a Layer 2 (pseudowire) VPN between two sites ? Or is it more a port grouping technology ?

Carl_Wallmark

New Member

discoscott wrote:
Can anyone shed any more light on the new feature Virtual Wire Pair and whether its possible to bring a Layer 2 (pseudowire) VPN between two sites ? Or is it more a port grouping technology ?

It´s more like "transparent vdom" between two interfaces but inside a NAT vdom.

There is no pseudowire in FortiOS, however they have added something called VXLAN, that could be used for L2 networks (I think), but it needs VXLAN headers in the packets, (vmware support it).

osipof

New Member

60C is not support, hope they release 5.4.1 for 60C don't want to buy another device yet.

SMabille

New Member

Just upgraded 200D:

Policy Based Routing not working since upgrade.

Does anyone using PBR upgraded successfully?

Thanks,

Stephane

Bipbaep

New Member

Any possibility to get old GUI back? New one is seriously ugly and hurt my eyes...

UnDocumented

New Member

does anyone recommend to upgrade on 200D?

hklb

Visitor III

If you don't need a new feature, don't upgrade before the 5.4.3..

kst

New Member

I have upgraded 2 FGT units with 5.4.0 but I have lost connectivity via my WAN dynamic PPPOE connections... I am able to access the gui, i have access to local network but no to the internet... after rolling back to previous version (5.2.5) I had no problems... Any idea?

Kenundrum

New Member

It appears that the vulnerability scanner function has been stripped out of 5.4 and relegated to the forticlient. I know that vulnerability scanning was kind of just a nice bonus stuck into the firewall builds a while ago (4.2? 4.3?), but it seems like a step backwards. It appears that the function on forticlient can only be activated on a client registered to a firewall and the client can only scan itself. Vulnerability scanning on the firewall allowed an almost unlimited number of endpoints to be scanned. This new setup would limit you to 10 machines that you have to be able to install forticlient on without having to spend more money on extra forticlient licenses. Is that actually what the intent appears to be? Or is there some update looming for forticlient that would allow it to scan ip ranges?

It was nice to have the vulnerability scanner as a second set of eyes in addition to other more robust vulnerability management solutions with workflows, etc. Especially since you could arbitrarily just scan anything with an IP address on demand. It also seemed to get better detections than our other dedicated internal vulnerability assessment platform (long story).

Salas

New Member

Tried to upgrade 2 clusters win 5.2.4 firmware. Both failed. One node is upgraded, and after reboot there is message in console:

"HA cannot be formed because the internal ports of box-***** is in different mode with this box. In order to form HA, please make them in the same mode first"

Had to slipt cluster, manualy upgrade another nod, and join cluster again.

I think it's because Internal interface type in 5.2.4 firmware is "set type physical" and after upgrade internal interface is "set type hard-switch".

Also reset counters on policy not working correctly.

mark_page

New Member

may not be the first but im dead sure I wont be the last.

Firstly to avoid any readers looking for a happy ending, you may jump ship now.

For compliance reasons, we have selected Fortinet products to provide access to our systems.

Must admit, I didn't really shop around, as the constraints of one certification or another meant it was either Fortinet, Cisco or some other Manufacturer I cant recall the name of

Immediately eliminated cisco, due to past experience with the commercial side of cisco, and general difficulty stabilising systems without overpriced "trained" experts having to tackle stuff, and mostly failing by causing knock on effects

My background has been with Zyxel USG range of firewalls, though sadly certification isn't one of their strong points, but aside that, the USG range has proven very reliable and manageable at every level.

Anyway, the pilot program is to use Fortinet 60d. in HA Active Passive mode, just 2 of them. That's all.

I received the units with 5.2.5 in late last year. Having now gotten round to "setting" them up, I entered a basic port forward configuration in, and got some external traffic coming in ok. I then install the latest 5.4.0 firmware on the second unit. Bad move. On this unit it is impossible to get ports forwarded. The GUI says yes, the actuality is no. After a week of waiting and batting CLI commands back and fourth with support, I'm going alone. I don't have that much time to waste.

This leads on to the fact that the logs show you nothing within the gui. Again, I'm used to the Zyxel range, and make strong use of the event log to track events (strangely) . This is impossible with the Fortinet. I am unable to gain any confidence ANYTHING is happening from the logs. Yes ive set the stupid tick box to show memory logs.

Ive followed numerous guides and "cookbooks" published by Fortinet. Very impressive literature, but almost completely useless with many technical ommissions, and assumptions made on the authors part, that the end user, should correctly assume fundamental settings. It is my experience that assumptions lead to ASS U ME. Hence I rely on documentation to not only tell me "what buttons to press", but ideally what effect this will have and why in good, solid technical terms. this way, the process of reading also teaches us skilled people how the thing is working. Without that, we are no more than burger flippers.

Needless to say, NONE of the "cookbooks" magically make HA work on my pair of fortinet 60d. with 5.2.5,5.2.6, or 5.4.0

I am now forced to raise a ticket for this purpose. This means a painful waiting game whilst awaiting response and drawing pictures of two fortinets, interconnected as per fortinets own documentation, and describing the problem.

The response to raising tickets is "enter this, enter that in CLI mode and send us the output". in between message exchanges we are talking 24-48 hours based on my last ticket raised because port forwarding simply wasn't working. Very disappointing.

The whole matter is so similar to my experience of CISCO products and support.

I guess if I pay for extra support they will log on, and "do it for me". sorry, not good enough. After 20 odd years developing products and working with firewalls, I really don't expect a relatively mature company to be providing software of this low quality.

Additionally, I have noticed pop up boxes on the GUI that don't close when you click on Close, HA slave units that don't appear when enabling HA, yet HA still works as if by magic. And the unit I'm looking at right now, negotiates HA then after 10 seconds rolls over and the system light goes off. Naturally the logs are completely useless.

I have wound back to firmware 5.2.5, but this presents more issues, and sadly, HA still fails to work, as far as the GUI is concerned.

Absolutely dismayed. Maybe my 12 year old daughter and hey Pi skills could be of use?

In summary, it seems like Fortinet have all the jigsaw pieces but either a split brain running the show, or no real substance on the QA side. All this for a premium product.

Thanks Fortinet for consuming yet more of my valuable time. I'm just deciding whether to give up with you, or not. Frankly I'm fearful of putting this into a production environment as I am severely struggling to do simple tasks with this box of bits and whilst I can kind of make it do what I want, I had hoped for something a little more robust. maybe I'm just being unreasonable and over expectant.

Be warned good people, as though the previous posts don't also say enough.

Disgraceful.

NotMine

Explorer III

Hi Mark,

I'm sorry to hear you're having such a bad experience. Overall, I'm happy with the FortiGate and the tech support that follows it, so I'm a little surprised by your ordeal. :) Version 5.4. is a bit rough on the edges and I would certainly not recommend it for a serious production yet, but 5.2.5 should work pretty well, especially on the HA field.

I mostly agree with you on documentation - it is plentiful, but it is sometimes missing some key information. Especially for products other than FortiGate. Having said that, I think that most Cookbook recipes are written for people who already have some background with the Fortinet products, or just to help 'sporadic' SOHO/SMB users (to whom firewall management is a second or third job role) set up the most basic stuff. So, I wouldn't expect much of it.

These are some 'must do' things when creating an HA cluster, from the top of my head:

[ul]

Both units must be of the same model;

Both units must have the exact same version of firmware;

On both units:[ul]

The 'switch' interface must be broken apart into individual interfaces;

All interfaces must have a static IP address (all zeroes are fine);

Devices should have different host names;

HA should be enabled on both units, in the same mode (A-P or A-A);

HA Group Name must be the same on both devices;

HA Password must be the same on both devices;

Heartbeat interfaces should be the same on both devices, so you can easily recognize and connect them.[/ul]

With only one ('master') device working, interconnect the devices through their HA Heartbeat Interfaces. Wait for at least 15 minutes (or 10 really timed minutes :)), and power on the second unit. Your HA cluster should be functioning.[/ul]

Hope this helps a bit. If you want, you can open a new thread on the subject, we'll be more than happy to help. Don't hesitate to send me a link to the thread in the PM or email.