FortiOS 6.2.5 is out!

Any early adopters? I have not tried 6.2 nor 6.4 yet though I am interested.

I upgraded my FGT201E saturday the 22nd from 6.2.4 to 6.2.5. The upgrade process went smooth. I do have problems with SSL Deep Inspection, especially (strangely enough) on exempted addresses.

In a proxy-based policy with "ssl deep inspection" enabled, some exempted addresses do not load in the browser, a connection failed error appears in the browser. I haven't pin pointed yet why certain sites that are exempted do not load while others do. In flow-based policies the problem does not occur.

My workaround for now is to add the same exempted addresses to a policy higher up in the processing order which does not have deep inspection enabled at all and is a flow-based policy. We don't mind that these addresses are not scanned, they were exempted in the first place. I use the same "address group" which holds my "SSL Deep Scanning Exempted addresses" both for the policy and for the SSL/SSH Inspection Security Profile.

I do notice from time to time that a page needs to be reloaded before an exempted wildcard address loads succesfully. This is probably because the address learned from the DNS-request wasn't yet loaded into the policy (https://docs.fortinet.com...-in-firewall-policies) thus the "lower" proxy-based policy is used instead.

With flow-based policies which have ssl deep inspection enabled the problem with exempted addresses does not occur. We need proxy-based policies though to enable us to block certain file types.

We use QUIC too (enabled), it doesn't seem to make a difference if we disable it.

We are in the same boat as JasperW, upgraded from 6.2.3 to 6.2.5 on a 200E Cluster and all proxy based policies with deep inspection were resetting the traffic to plenty pages. Switched the policy to Flow and everything works. 

But yeah, we also need a possibility to block users from downloading file types and used the DLP for that until today.

I was always a big fan from Fortinet and their products, but in the past few months, if not even years, they released so many bugs, we are close to decide to kick them out for all our subsidiaries worldwide  There is almost no concept in the builds, they remove a basic feature like DLP from the GUI, remove all DLP Filter settings from the existing policies after 6.2.2, switch it to the Webfilter and name it "File Filter", bring it back to the GUI in 6.4, sometimes I think they use dices to make decisions.