Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
bommi
Contributor III

FortiOS 6.2.5 is out!

NSE 4/5/7
2 Solutions
James_G

6.4.2 still seems to have less issues, I am seeing reports of this one (6.2.5) breaking SSL inspection.

View solution in original post

bbilut
New Contributor III

Looks like they recently added these two issues to the list of "Known Issues" with 6.2.5

 

630070 - HA is failing over with crashes. 645848 - FortiOS is providing self-signed CA certificate intermittently with flow-based SSL certificate inspection.

View solution in original post

18 REPLIES 18
MartinOlszynski
New Contributor

Fortigate 101E:

Upgrade issue

 

JasperW
New Contributor

I upgraded my FGT201E saturday the 22nd from 6.2.4 to 6.2.5. The upgrade process went smooth. I do have problems with SSL Deep Inspection, especially (strangely enough) on exempted addresses.

In a proxy-based policy with "ssl deep inspection" enabled, some exempted addresses do not load in the browser, a connection failed error appears in the browser. I haven't pin pointed yet why certain sites that are exempted do not load while others do. In flow-based policies the problem does not occur.

My workaround for now is to add the same exempted addresses to a policy higher up in the processing order which does not have deep inspection enabled at all and is a flow-based policy. We don't mind that these addresses are not scanned, they were exempted in the first place. I use the same "address group" which holds my "SSL Deep Scanning Exempted addresses" both for the policy and for the SSL/SSH Inspection Security Profile.

I do notice from time to time that a page needs to be reloaded before an exempted wildcard address loads succesfully. This is probably because the address learned from the DNS-request wasn't yet loaded into the policy (https://docs.fortinet.com...-in-firewall-policies) thus the "lower" proxy-based policy is used instead.

With flow-based policies which have ssl deep inspection enabled the problem with exempted addresses does not occur. We need proxy-based policies though to enable us to block certain file types.

 

We use QUIC too (enabled), it doesn't seem to make a difference if we disable it.

MasterBratac

JasperW wrote:

I upgraded my FGT201E saturday the 22nd from 6.2.4 to 6.2.5. The upgrade process went smooth. I do have problems with SSL Deep Inspection, especially (strangely enough) on exempted addresses.

In a proxy-based policy with "ssl deep inspection" enabled, some exempted addresses do not load in the browser, a connection failed error appears in the browser. I haven't pin pointed yet why certain sites that are exempted do not load while others do. In flow-based policies the problem does not occur.

We do have the same problem on a cluster with two FG100D. Funny thing is, that the exempted Fortinet websites didn't work a all ... we went back to 6.2.4.

I also had chat contact to fortinet support .... they said, that this problem is not yet known ... 

So I'm glad, that I'm not the only one ... anything new on this toppic?

bbilut
New Contributor III

Looks like they recently added these two issues to the list of "Known Issues" with 6.2.5

 

630070 - HA is failing over with crashes. 645848 - FortiOS is providing self-signed CA certificate intermittently with flow-based SSL certificate inspection.

NeilG

That would imply that even flow based deep inspection is having issues, where the prior posts were indicating that flow based fixed the proxy-based deep inspection breaking lots of pages especial those that are whitelisted/exempted.

 

That is not good at all.

bbilut
New Contributor III

I'm still on 6.2.4 and I normally decrypt with a cert that I imported into the unit. I just exported the stock self-signed (Fortinet cert) from the firewall and added into my Windows group policy so all my Windows machines will have that cert as well.

andr_gin

Installed 6.2.5 von our 60F. Many websites including this forum are not accessible. Rolled back to 6.2.4

Even 6.2.4 seems to have some serious issues with with packet capture and I suspect SSL inspection, but at least it somehow works.

bbilut
New Contributor III

I see these recently added this to the release notes.

 

2020-09-10 - Added FGR-60F to Special branch supported models.

Wayne11
Contributor

We are in the same boat as JasperW, upgraded from 6.2.3 to 6.2.5 on a 200E Cluster and all proxy based policies with deep inspection were resetting the traffic to plenty pages. Switched the policy to Flow and everything works. 

But yeah, we also need a possibility to block users from downloading file types and used the DLP for that until today.

 

I was always a big fan from Fortinet and their products, but in the past few months, if not even years, they released so many bugs, we are close to decide to kick them out for all our subsidiaries worldwide  There is almost no concept in the builds, they remove a basic feature like DLP from the GUI, remove all DLP Filter settings from the existing policies after 6.2.2, switch it to the Webfilter and name it "File Filter", bring it back to the GUI in 6.4, sometimes I think they use dices to make decisions.

Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors