Firmeware update v7.6.5 build3651 changed Fortigate configuration IPSec

[jimsoda]

Had Fortigate set to automatic firmware updates. On Dec 11th, last update did three things that no update should do:

1. Changed password settings. Automatically turned on 12 character complex password with no authorization.
2. Disabled AP's from connecting to Fortigate. Manually had to authorized.
3. And the most damaging was to change the IPSec parameters.  Could not remotely connect to even diagnose what was going on. Change the DH Group setting for both Phase 1 and Phase 2 to 14, 20 and 21.

The default DH Group when creating a IPSec connection in Forticlient is 5 which is what we were using. 

Why are you changing my routers settings without my consent? And changing integral settings so as to render VPN connections useless. It took four days to figure out what was going on.

Unacceptable in my opinion. It is my hardware. It is my configuration. At least ask me to make those changes for security reasons.

[jasmimuse]

Unfortunately, everything works great after the hardware upgrade. The 101 gen1 has 4GB RAM, the IPS db has increased by so much, the only option was to ignore certain traffic or get something with more mem. I have a bunch of 40Fs that are currently doing the same thing, conserve mode at least once a week. So I am planning to take the 101s I just replaced and swap them for the 40F as a temp fix until I can budget for 91Gs.

[strongX509]

DH group 5 based on a 1536 bit prime number isn't really secure enough any more.  DH group 14 based on a 2048 bit prime is an absolute minimum, with DH group 20 based on ECP384 being both stronger and much faster.