Solved
FortiOS v5.2.6 is out...
new release is available in the download portal...
They always say that, "just upgrade". I'm beginning to think the biggest weakness is the infinite flexibility of these devices. My guess is you would take 100 users and each one would have a slightly different config making it nearly impossible to do effective testing for new firmware stability. That is all I can come up with or they have the most incompetent QC people in the industry. If you feel the same, share this with your rep. They need to keep hearing this until they do something about it.
I have a stand alone 500D that is running 5.2.3,build670. I have all filters enabled and we lock things down quite a bit here. Our connection is 100Mbps to the web. The following features are enabled:
Advanced Routing
VPN
AntiVirus
App Ctrl
DLP
IPS/IDS
Web Filter
Endpoint Control
Certs
DNS Database
Load Balance
Implicit Firewall Policies
Multiple Security Policies
Policy Based IPSec VPN
Traffic Shaping
WAN Link Load Balancing
!!Turn off features that you are not using!!
It has been rock solid for over 143 days, with one exception. I attempted to add a EC cert using the GUI and it broke the Cert portion of the GUI. Everything else works fine, but the cert GUI won't come up. I'm guessing I could go into the CLI and remove the CSR and that might fix it, but I decided to wait and hold for an updated stable firmware version. Looks like I'm still waiting!
I do have a second 500D that I'm using for testing. I upgraded it to 5.2.6 and then 5.4.0, but haven't had a chance to do further tests. No visible problems after upgrade, but I haven't put production traffic through it yet. As mentioned before, any time you do a firmware update, do the following:
[ol]
Based on my readings of these forums, it seems like lots of the problems revolve around HA. My company is fairly small with less than 200 employees so I've always elected to buy two firewalls. One stays in production and the other is used for testing/POC. I know this may not be an option for everyone but it has served us well. As many have learned "upgrading Fortigates on a whim" are a recipe for disaster. Using one unit for testing gives you greater flexibility and if the units are identical, it is trivial to take a backup config and load it on the second unit to duplicate your production system for troubleshooting/testing. It is of course critical to keep your config copies current in the event of a hardware failure.
Based on my experience, unless you have a security or technical reason for doing so, don't upgrade to minor versions. If you must, try to avoid versions where the firmware isn't at least the second or third version past GA release. Always read and understand the release notes, what works and what doesn't. Visit these forums often and learn from others' mistakes. Often in the past later versions make things more stable. I'm still not sure what happened with 5.2.4 and 5.2.5 as that doesn't seem to be the case.
Here's a slightly aged link but has additional detail on doing upgrades:
https://mbrownnyc.wordpress.com/2013/01/30/upgrading-the-firmware-on-a-fortigate-unit/
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
