FG300E restarts about every 3 minutes

j_such · ‎02-23-2018

Hello,

I put new configured FG300E HA with FortiOS 5.4.7 into production network and this FG started to reboot about every 3 minutes and few seconds.

Crashlog gives no information about source.

How to debug this case ?

I don't want to move to FortiOS 5.6.x because many older FortiAPs will not be supported. I'm afraid to move to FortiOS 5.4.8 because of known bug: 470399 The FG-300E/301E and FG-500E/501E reboots with kernel panic errors

Perhaps downgrade to FortiOS < 5.4.6 ?

A few days ago I've made ticket in Fortinet Support but no helpful suggestions received ...

Janusz Such

Toshi_Esumi · ‎02-23-2018

First, you should call in the number in your country/region. You might need to be in queue some time but hopefully not long. Since you already open a TT via support web site, you don't have to get it created by the first rep before you're placed in a queue. You must have attached config and other log data so it would be shorter for the tech who you grabbed to get to the speed.

But likely need to flush the boot drive and reload the image either 5.4.7 or previous version you upgraded it from via TFTP, and upload the saved config of the version. Then you can upgrade to 5.4.8.

View solution in original post

yoda · ‎02-23-2018

Hello,

this kind of FG300E rebooting might be linked to the usage of WiFis provided by FortiAPs managed by the FG300E. In our case after upgrade to FortiOS 5.6.3 no more such rebooting observed. If upgrade to FortiOS 5.6.3 is not an option then you might manage your FortiAPs by a separate FortiGate (connected to the FG300E).

Yoda

View solution in original post

tanr · ‎02-23-2018

Have you hooked up a laptop directly to the console (RJ45 serial) port to watch the whole sequence?

That should show you all output during the reboot, much of which you can miss if you're just using SSH or HTTPS to access it.

View solution in original post

ede_pfau · ‎03-07-2018

About the pings: they are most probably not blocked but just 'vanish from sight'.

Typically, after a new session is established, only 2 pings are forwarded by the CPU and then the session is offloaded to the NP ASIC. The built-in sniffer cannot display ASIC traffic and so it seems that traffic is blocked. But it's only offloaded and invisible.

Ede

"Kernel panic: Aiee, killing interrupt handler!"

View solution in original post

yoda · ‎03-14-2018

Hello! In the meantime (as mentioned earlier) the FG300E is on FW 5.6.3. I try to remember how I managed it with 5.4.7 and a separate firewall controlling the FortiAPs: So we had two firewalls (both with FW 5.4.7): - FW1 : the FG300E providing the network interface to which the FortiAPs are connected and located in a productive network environment on separate floors (separate network switches in use) - FW2 : another firewall (in our case a FG100D) acting as WiFi controller only On FW1 : On the network interface where FortiAPs are connected to a new VLAN with DHCP enabled (for administration of FortiAP connections/policies) has to be defined, example : name "Mgmt_FAP", VLAN ID 50, IP 10.50.11.1/24, DHCP server enabled, HTTPS,PING,CAPWAP,SSH enabled A link between both firewalls (connected via physical network patch cable) using a /30 linknet has to be established, port x on FW1 and port y on FW2 are both parts of this common /30 linknet , CAPWAP to be enabled on involved interfaces. examples for interfaces used for the link network : FW1, port x : name "lk2fg100d" , IP 172.16.100.1/30 FW2, port y : name "lk2fg300e", IP 172.16.100.2/30 On each of these new interfaces a separate VLAN for each WiFi needed has to defined no CAPWAP, no DHCP server, role LAN, examples: FW1 : interface name: "lk2fg100d_vl71", VLAN ID 71, IP 172.16.71.1/30, FW2 : interface name: "lk2fg300e_vl71", VLAN ID 71 , IP 172.16.71.2/30 On FW2 a default route to interface "lk2fg300e", gateway IP : link network IP1 of FW1 (in our example 172.16.100.1 ) has to be defined On FW1 services "CAPWAP": UDP5246,5247 has to be defined and a FW policy for traffic from "Mgmt_FAP" port to "lk2fg100d" and services "CAPWAP" is needed. Again as an example a WiFi on FW2 has to be defined as follows: - SSID: "FAP_example_71" with IP 172.16.171.1/24, DHCP server enabled, propagating SSID:"example_71", default settings for DNS, NTP, etc. as you prefer - Policy routes for traffic from WiFi to Link-interface of FW1, example : incoming interface: FAP_example_71, src adr:172.16.171.0/24,

outgoing interface: lk2fg300e_vl71, gw addr:172.16.71.1 - FW policies for traffic from WiFi to Link-interface of FW1, example: incoming interface: FAP_example_71, outgoing interface:lk2fg300e_vl71, NAT enabled Also needed on FW1: - Static routes for (retour) traffic to WiFis on FW2, example : destination:172.16.171.0/24, device:lk2fg100d_vl71, gateway:172.16.71.2 - Various policies from VLANs initiated at FW2 to various targets on interfaces on FG1 interface, example: lk2fg100d_vlan71 to [WAN and other interfaces], NAT enabled The FortiAPs should be configured via separate management VLAN and controlled by FW2. As an example please have a look onto according FortiAP configuration commands like cfg -a AP_MGMT_VLAN_ID=50 cfg -a AC_IPADDR_1=172.16.100.2 Yoda

View solution in original post

kphed · ‎05-18-2018

Despite all the vulnerabilities/CVEs we were forced to use v5.4.4 (which is not available on the Fortinet Support page, I had to create a Support ticket to be sent the firmware image). Reading through the FortiOS v5.4.9 release notes, it appears the 300E issues have been resolved. Will advise if any issues arise.