FortiOS 5.2.10 - 5.4.1 RMA Claimed

[srsiddiqui]

Hi,

As per the TAC recommendations we had to Flash Format the 100D and eventually it didn't came back up. FortiOS version 5.2.10

So we have got the RMA claimed with FortiOS 5.4.1. Since the support contract was 24x7 but we received the device on 4th day after the claim was initiated and was bit in hurry to live it. So we have imported the config of 5.2.10 to 5.4.1 and started working. This was 3 weeks back. Link Monitor was configured with 2 ISP's

Started facing issues with all the options enabled on a single policy that is UTM, Deep inspection & SSL Certificate that users complaining that Websites are not opening properly "the webpage is unreachable", Error Connection Timeout, Error Connection Closed, DNS Host Suffix issues on three major browsers

As per TAC, The current configuration which you have on the fortigate is corrupted as well. Hence, you will have to flash format the box. Install 5.2.10 and reload configuration of 5.2.10. Then you can go to firmware 5.4.1 following a proper upgrade path. Upgrade path information is present in the support portal. Unfortunately, you will have to redo all the configurations which you had done on 5.4.1 in those 3 weeks

If UTM features in disabled in policy then there is no issue in Browsing

Since their is a lot of configuration done, device was running in Head Office. If we try to redo the complete config than it will take around 3-4 days of downtime which is not possible at all. Further if something missed out than it will be managed afterwards.

Is there any work around for converting the configuration of 5.2.10 to 5.4.1, remove Link-Monitor config part and again configure WAN LLB in order to minimize the downtime to max 1 day.

[srsiddiqui]

Hi Ede,

The device currently using was RMAed 4 weeks back. Do u still think I should order a replacement or Flash Format is the last resort

I have syslog configured and all the logs are saved on Syslog server.

[ede_pfau]

If I understand you correctly the currently used FGT is a replacement (RMA) unit you got 4 weeks ago.

I think your best bet is to follow the TAC. You are right that the hardware probably is not concerned as it is a replacement unit. But, as the config was 'forced' on it, parts of your original config were not translated correctly. That's why TAC advises you to downgrade to v5.2, restore the original config (without later changes), and upgrade up to v5.4.10. Staying at v5.2 would be possible as well but v5.4 fixes a lot of issues which may or may not be important for you as well. After all, v5.4 brings you SD-WAN, a simple and easy way to provide redundant WAN access.

Rebuilding the latest changes should not be too difficult (and not take a whole day) if you use a tool to show you the diff between

- the original v5.2 config, transformed via upgrade path to v5.4.x

- and the latest backup you took before starting the downgrade

You already stated that it is mainly about address objects and policies. You can paste these into the CLI during live operation without having to reboot.

So, in short, follow TAC, their advice is sound and based on experience.

[sw2090]

Ede,

it appears its you who hasn't read the original post deep enough ;)

srsiddiqui wrote he got a replacement unit for the corrupt one so he is supposed not to have any more corrupcy.

I don't think Fortinet would replace a broken unit with a broken unit.

So why should he then do the unneccessary flash format on a plain new factory defaulted unit?

I still see no reason...

[srsiddiqui]

Hi Ede & sw2090,

Since we have uploaded the config of 5.2.10 directly into 5.4.1 and as per TAC this is a wrong method.

The RMAed device came with 5.4.1 and now its not default unit any more

[sw2090]

yep but it' not corrupt either.

just exec factory-reset and it goes  back to the config it was shipped with and you can start anew.

The firmware itself on the rma'ed device should be ok (if it were not then fortinet did something wrong in the RMA).

Formatting wold destroy the firmware and require you the reinstall it via tftp wih is completely unneccessary

[srsiddiqui]

For now i am moving forward with solution provided by sw2090

If this didn't work out the Flash Format is the only solution