FortiOS 5.0

[Carl_Wallmark]

Do we have any brave soul who already have upgraded their production unit to FOS 5.0 ? Tell us how it went ;)

[seadave]

SNMP shows up under System...Config..SNMP for me. Not sure why it isn' t there for you and is for me. I may have enabled in CLI, but it is now in GUI. Fortinet has a bad habit of not clearly defining what will and what will not work on specific models. I' m finding the 16GB of flash disk on the 100D makes a big difference. I had a FG-60 for a long time and that was always limited. I' m having an issue with PDF reports not showing data. Also the HTTPS scanning is confusing. I always go to the EICAR test site and non-SSL files are detected as viruses but files downloaded via SSL are getting through which makes me nervous. That being said, enabling deep scanning the past always caused issues as it broke SSL between client and host. You had to deploy a cert on each client to force it to trust the fortigate which was frustrating. Not sure how they are doing it now, but I don' t get any errors when turning it on. Regarding traffic shapping it most likely is CPU intensive and requires more RAM/CPU than the 40c has.

[seadave]

I think I figured out the SSL scanning. Under Policy...UTM Proxy Options...SSL Inspection Options you can enable all ports or only standard ones. I enabled it and it appears to be working. Doesn' t break logging into gmail or comcast email and now when I download the EICAR test file it detects it as a virus on SSL connections. Cool!

[billp]

Ede, I assume you can always install a custom cert on the workstation to get rid of those errors as you could do in earlier FortiOS versions, right?

[VirTechSystems]

Do you have a document that outlines how to do this? Web browsers and email clients both complain when a FGT gets in the middle and I have yet to find the right certificate to give to the workstation to make it stop complaining. Thanks

[billp]

Virtech, Here are a couple: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD32404&sliceId=1... and another: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD30586&sliceId=1... There are also some how-to' s buried in the forums and in some of the docs, I believe. The first link above is probably the simplest since it just requires you to import the existing Fortinet cert as a trusted CA in your browser. The other link requires you to create your own certificate using opensource tools. I assume the same principles above apply to 5.0 GA somehow.

[ede_pfau]

@Bill: yes, right. Cert import won' t make the FGT invisible, though. Newer browsers display the secure site icon in front of the address bar, and that won' t be from the site you' re surfing to but your Fortigate' s. So still there' s a need to explain that to your users (I' ve had fierce comments from users suspecting a man-in-the-middle attack when their FGT was proxying SSL traffic).

[billp]

Ede, Thanks for the clarification. That makes completes sense. The Fortigate is essentially performing a man-in-the-middle attack to decrypt the traffic. Wouldn' t every other SSL-decrypting firewall would have the same issue?

[ede_pfau]

IMHO yes. To ' impersonate' a secure web server the FGT would need the server' s private key, and this will never happen.

[ether]

I don' t see an update for the 224B. Does that mean there' s no support on this model for 5.0...even though older (and much lower end) models are?

[romanr]

The 224B will not be supported in FortiOS 5! br, Roman