FortiOS 5.2.11 is Out

[Baptiste]

I won't be able to test it until next week

http://docs.fortinet.com/uploaded/files/3654/fortios-v5.2.11-release-notes.pdf

but I will  :

Resolved Issues

388594 FortiOS local admin password hashes could be obtained.

[x_member]

We'll be looking to move to this (from v5.2.7) to resolve long standing issues with SSL deep inspection.

I can't see us scheduling the move before the latter part of May / early June due to planned staff absences but I'm keen to get any feedback available from anyone else who makes the jump ahead of us.

[x_member]

Other than https://forum.fortinet.com/tm.aspx?m=148640 I'm not seeing any feedback in this forum.

So is no news good news?

[kwilley]

seems okay after a week w/ 100D HA

[emnoc]

We have  a pair of 3240C that are doing great.

Ken

[kallbrandt]

Running on a few 800c and 600D. No issues as far as I know.

[YNOT]

CodeMonkey wrote:

We'll be looking to move to this (from v5.2.7) to resolve long standing issues with SSL deep inspection.

What's long standing issues with SSL deep inspection in your case ? We using 5.2.7 and hits lot of odd issues at Web Filtering / SSL deep inspection too, can you share with us and advise if the cases can be fixed after v5.2.11 ?  Many thanks.

[romanr]

YNOT wrote:

What's long standing issues with SSL deep inspection in your case ? We using 5.2.7 and hits lot of odd issues at Web Filtering / SSL deep inspection too,

Hi,

we have also seen odd issues with deep inspection and 5.2.7 - but those were already mainly fixed since 5.2.8 as far as i remember. Didn't notice any troubles with 5.2.10 oder 5.2.11 in that area.

5.2.11 fixed some memory leaks for us since 5.2.10...

Br,Roman

[x_member]

YNOT wrote:

CodeMonkey wrote:

We'll be looking to move to this (from v5.2.7) to resolve long standing issues with SSL deep inspection.

What's long standing issues with SSL deep inspection in your case ? We using 5.2.7 and hits lot of odd issues at Web Filtering / SSL deep inspection too, can you share with us and advise if the cases can be fixed after v5.2.11 ?  Many thanks.

SSL deep inspection has essentially been unstable and caused connectivity issues both outbound, and inbound. This has been most notable on a TLS 1.2 win2012r2 webserver we host.

All browsers would (at varying points) fail to connect, with Chrome /  IE giving ssl handshake errors and Firefox reporting SSL_ERROR_BAD_MAC_ALERT. The Fortigate crashlog would show a signal 11 fault with backtrace to the ipsengine.

Problems started in June 2016 with FortiOS 5.2.7 + IPSEngine 3.0167.

Initially this was diagnosed as Issue # 0372309 to be fixed with a patched IPSEngine v3.00284; this patch failed to fix the issue.

Subsequently we were provided with an IPSEngine 3.0301 patch; this patch also failed.

We declined to disable hardware acceleration which we were told was a workaround 

Subsequently a hotfix IPS Engine 3.0301 was provided to fix the issue; it did not fix it due to a dependency on FortiOS.

We were asked to disable hardware acceleration as a workaround but we continued to run with SSL inspection disabled and pushed for a proper fix that wouldn't impact performance.

The bug id that was provided was 0371254, which is apparently fixed in v5.2.9+, however we decided to wait for 5.2.11.

Currently our plan is to implement 5.2.11 on 11th June (barring any horror stories from the community here) and then begin a slow rollout of SSL inspection (both inbound and outbound). 

It's not been the greatest customer experience overall.