Skip to main content
hklb
hklb
New Contributor
March 18, 2015
Solved

FortiOS 5.2.3 is out

  • March 18, 2015
  • 33 replies
  • 99743 views

.

Best answer by VicAndr

...discovered another bug with v.5.2.3. Administrators who are restricted to provision guest accounts only, can't actually print those accounts (to hand over login IDs and passwords to relevant users). In attempt to do so a FortiGate responds with "Error 500: Internal Server Error".

 

...didn't have this problem before the upgrade [&:].

33 replies

FGTuser
FGTuser
New Member
March 19, 2015

I don't see any release notes in download dir or anywhere else.

Jeroen
Jeroen
New Member
March 20, 2015

OndrejD wrote:

I don't see any release notes in download dir or anywhere else.

http://docs.fortinet.com/d/fortigate-whats-new-for-5.2

natech
natech
New Member
March 20, 2015

Just checked, and release notes are in the download directory. Search for fortios-v5.2.3-release-notes.pdf. 

 

First impressions after upgrading from 5.2.2 on a FortiGate 1000C with a few hundred policies and objects:

 

FortiView received some performance refinements and searching is more consistent throughout.

 

We had a few policies which used an SSL inspection object with "protect SSL server" enabled. These stopped working with 5.2.3 until I removed the SSL inspection object on them. I will properly investigate when time permits, but it's not a big issue for us now. 

 

Log viewing has received a significant overhaul. Reverse DNS is showing up consistently for sources and search results will no longer randomly come up empty. I had to chuckle a bit, as I was praising the FortiOS platform to a potential adopter the other week, but had to voice some frustration about the so-so log viewer performance.

 

Still testing some of our web filtering policies that previously worked better with flow-based vs proxy and vice versa, but so far everything seems stable and consistent. Fingers crossed....

dfroe
dfroe
New Member
March 21, 2015

natech wrote:
We had a few policies which used an SSL inspection object with "protect SSL server" enabled. These stopped working with 5.2.3 until I removed the SSL inspection object on them. I will properly investigate when time permits, but it's not a big issue for us now.

Did you use flow-based or proxy-based SSL inspection? It mainly depends on which kind of AV you apply to that policy. Proxy-based SSL inspection will completely terminate the SSL session on the FG (resulting in different cipher suites towards the client) while flow-based does some kind of "don't touch, only look" and tries to decrypt the passing stream without modifying it.

 

With proxy-based SSL inspection there was a bug that the FG did not reply the complete certificate chain which broke everything with chained certificates. I was in contact with tech support and after several months they finally fixed it. Since 5.2.3 GA the proxy-based SSL inspection now also works with chained certificates.

 

So my first impression with 5.2.3 is that the "protect SSL server" is now working better than before.

I just hope that they didn't break anything else while fixing this issue.

 

At the moment I am only having some problems with "protect ssl server" and long idle (>5min) connections (like IMAP IDLE). But that's nothing new and still under investigation with tech support.

 

Maybe you can share your results when you were able to finish your investigations.

 

Besides that 5.2.3 fixed several tiny nasty bugs and makes a good impression after upgrading the first set of firewalls.

Paul_S
Paul_S
New Member
May 4, 2015

dfroe wrote:

Did you use flow-based or proxy-based SSL inspection? It mainly depends on which kind of AV you apply to that policy. Proxy-based SSL inspection will completely terminate the SSL session on the FG (resulting in different cipher suites towards the client) while flow-based does some kind of "don't touch, only look" and tries to decrypt the passing stream without modifying it.

 

With proxy-based SSL inspection there was a bug that the FG did not reply the complete certificate chain which broke everything with chained certificates. I was in contact with tech support and after several months they finally fixed it. Since 5.2.3 GA the proxy-based SSL inspection now also works with chained certificates.

 

So my first impression with 5.2.3 is that the "protect SSL server" is now working better than before.

I just hope that they didn't break anything else while fixing this issue.

 

At the moment I am only having some problems with "protect ssl server" and long idle (>5min) connections (like IMAP IDLE). But that's nothing new and still under investigation with tech support.

 

Maybe you can share your results when you were able to finish your investigations.

 

Besides that 5.2.3 fixed several tiny nasty bugs and makes a good impression after upgrading the first set of firewalls.

 

dfroe,

 Did tech support help you with the connection with long idle times? I have a similar issue with Exchange active sync. Event logs tell me to make sure my firewall is not closing connections too soon: https://support.microsoft.com/en-us/kb/905013

 

Do you have a bug ID for the SSL chain issue? that may be affecting me.

ede_pfau
SuperUser
ede_pfau
SuperUser
March 20, 2015

Yesterday I upgraded an FG-80C (1 G) from 5.0.11 first to 5.2.2 and then to 5.2.3 (as I didn't know of the new release in the morning).

On both occasions, the FGT behaved way too slow after the reboot. The GUI was sluggish and really a pain. Operation though was fine, except for the "custom service" in 5.2.2 which was wrong (this has been on the forums quite often now).

 

Additionally, the FortiGuard status was wrong: hardware 'licensed' but AV and IPS 'not registered' which clearly was wrong. An inspection with 'get sys fortiguard-service status' showed an AV engine version '1.000', the log was full of messages 'FortiGuard servers unreachable' and an 'exec update-now' produced 'error 6'.

I ran a 'exec formatlogdisk' with a reboot and after that everything worked fine.

After 'exec update-now' the engine and signatures were up-to-date.

 

This was repeated after the upgrade from 5.2.2 to 5.2.3. 'exec formatlogdisk', reboot and Bliss!

 

The update to 5.2.3 corrected several minor config errors, such as

firewall services custom

'set tcp-portrange 0' is replaced by 'unset tcp-portrange' in services

ALL, ALL_UDP, DHCP, IKE, QUAKE, RAUDIO, RIP, SIP, SYSLOG, TALK, TFTP, MGCP, DHCP6, RADIUS, RADIUS-OLD, TRACEROUTE, LDAP_UDP, NetBios-NS, NetBios-DS

in 'ALL_CUSTOM', 'set protocol-number 6' was added

in 'NONE', 'set tcp-portrange 0' was added.

 

So for admins still running 5.2.2 and having upgraded from 5.0.x you should have a look at these service definitions.

 

One last observation:

I had a static route defined for a dial-in IPsec VPN. The upgrade to 5.2.3 removed it rightfully as the dial-in VPN will create a dynamic route entry according to the (dynamic) proxy addresses.

Carl_Wallmark
Carl_Wallmark
New Member
March 21, 2015

Does anyone have FSSO working with 5.2.3 ?

storaid
storaid
New Member
March 23, 2015

Selective wrote:

Does anyone have FSSO working with 5.2.3 ?

TEST MODEL: 200B-POE

 

 

Carl_Wallmark
Carl_Wallmark
New Member
March 23, 2015

hmm, thanks, mine does not work.

 

What version of FSSO do you have on your server ?

storaid
storaid
New Member
March 23, 2015

Selective wrote:

hmm, thanks, mine does not work.

 

What version of FSSO do you have on your server ?

latest version...

Carl_Wallmark
Carl_Wallmark
New Member
March 23, 2015

Thank you Storaid,

 

May I ask how your groups are configured and policys using these FSSO groups ?

 

 

Carl_Wallmark
Carl_Wallmark
New Member
March 23, 2015

Nevermind,

 

It seems like it doesn´t work when you use LDAP server in the FSSO setup.

 

TheJaeene
TheJaeene
New Member
March 23, 2015

My Lab 80C crashed after 4 Days running 5.2.3

SSH & Telnet frozen... Only a Coldstart brought the Box back to life!

 

Yeah Baby Yeah!

 

storaid
storaid
New Member
March 24, 2015

system error after a wifi interface has been removed.......

I can not go to any management console, includes CLI......

anyone have this problem????

this problem sucks...

 

 

VicAndr
VicAndr
New Member
March 25, 2015

storaid wrote:

system error after a wifi interface has been removed...

You shouldn't remove WiFi interface from System > Network > Interfaces GUI section. The right way to remove it is - through WiFi Controller > WiFi Network > SSID - the same place where you created it in the first place.

 

I had a number of issues with WiFi Networks in the past while performing "in-place" upgrade to a major FortiOS version (i.e. 4.3 to 5.0; usually not while applying a patch on the same firmware branch). FortiOS upgrade scripts which transform FG configuration do not always work as expected and sometimes after upgrade you may have a hard time to fix and even remove a broken WiFi interface.

 

The best way to resolve the issue in your case would be...

[ol]
  • downgrade FortiOS to a pre-upgrade version;
  • restore configuration you've backed up right before the upgrade;
  • remove SSID in question;
  • upgrade to v.5.2.3;
  • recreate the SSID (if needed).[/ol]

    Another way to fix it might be...

    [ol]
  • backing up post-upgrade configuration (provided you can access management interface either through GUI or CLI);
  • edit configuration text file manually on your computer - removing troubled WiFi interface/SSID and all relevant dependencies;
  • restore modified configuration to your box;
  • recreate the SSID (if needed).[/ol]

     

    • Show more replies
    Terms & ConditionsCookie settingsAccessibility statement