5.4.1 On All Production

[MikePruett]

Just wanted to give you guys an update. I have a wide range of production hardware running 5.4.1 now (models from FWF60D all the way up to FGT 300D so far).

Everything seems to be running fine and I haven't noticed any issues. Only real thing I had to do was do some tweaks on the proxy setup that 5.4 introduced and all is well.

This is not me saying that you should push to 5.4.1 by any means. Only update if it fixes a security issue, bug, or provides a feature you need.

[CyberNorris]

I've been running 5.4 beta and beyond since XTreme Team last fall and haven't had a single problem... granted the beta was only running on a 60D-POE in our SecOps Center, so it wasn't being pushed very hard. We did find some cosmetic issues that were fixed in the GA, but no bugs.

I've now got it on a couple of 60Ds and a 90D. We're about to have to put it on a couple of 100Ds in order to support 48 port FortiSwitches. I will hopefully have four 3700Ds going online late August or September that will need it to support the high end FortiSwitches. I'm certain Fortinet will make sure those puppies are stable.

[ecsupport]

CyberNorris - how is 5.41 running on the 100Ds? Ive got a big 6-location site in south amer backhauling through one big office, currently running about 200U on a 100D on 30M fiber (i know, i know). Lots & lots of shaping and UTM, not doing full SSL inspect yet just certificate, but very soon (with AD auth). A bunch of IPSEC tunnels & an SSL VPN for outside users.

It's on 5.10 now, and i finally got a spare down there that i'm tempted to either put 5.26 on (less bugs than some of the latter 5.2x since we use SSL VPNs!) or take the plunge on 5.4.1. Definitely an important site that can't be down, but i have the luxury of the existing 5.10 box i can have onsite team swap back in in a jiffy.

Thoughts on 5.4 vs 5.2?

[CyberNorris]

I've personally had no problems with 5.4, even back to the beta, though I only ran the beta at home. I only took a couple of 60D/90D to 5.4.0, but have moved a few more to 5.4.1.

Everything else is 5.2.6 to 5.2.8 due to published vulnerabilities.

The 100D that we took up has had no problems, though there was a small issue with FortiLink stacking flapping, but the latest switch firmware appears to have fixed that. Let me say that the switching never failed, it was just FortiLink that was flapping.

[Gianluca_Caldi]

Hi,

I've been running 5.4.1 on several 50E clustered boxes for some months now (coming from 5.2.8). Basically everything is working fine except for some small issues:

- SSL deep inspection has to be set to single protocols mode (and not "scan all ports") otherwise we experience periodic random 100% memory leak caused by proxyd

- FortiManager sometimes see a unit "disconnected" even if it's online. We have to correct it reclaiming the tunnel or, more often, redìstarting the remote unit.

- Some FSSO "glitch" from time to time we're still investigating (not sure if fw related but it appeared after the upgrade so...)

I'll not deploy 5.4.1 to our biggest boxes running 5.2.8 (100D, 200D, 600D) until a firmware upgrade will fix these issues.

Bye

Gianluca

[MikePruett]

Thanks for the update!

[Pacolo]

Hello guys,

Excuse me, I was new on the forum and I did not found this post, so I create a new post about the issues that I have found on the FortiOS 5.4.1, in case you want to check it.

https://forum.fortinet.com/tm.aspx?tree=true&m=141798

Regards,

Paco.