FortiOS v5.2.4 is out(Unstable GUI, Bad SSLVPN)....

[storaid]

a little disappointed..

no enhancements..

it's just a bugs fixed release....

[size="5"]definitely 1 of terrible f/w for FOS...[/size]

UNSTABLE GUI

[size="6"]ANNOYING SSL VPN problem..............[/size]

[size="3"]fortinet, I think you must quickly push out next fixed release or give some explains.........[/size]

201508020844, CSB-150730-1-Partial-Config-Loss

FortiGate models listed below may lose configuration pertaining to IPsec interface, virtual access point interface, loopback interface, or virtual-switch interface after a reboot when the FortiGate is deployed with FortiOS 5.2.4 with build number 0688 and time 150722.

FGT20C3X12000161 # get sys stat

Version: FortiGate-20C v5.2.4,build0688,150722 (GA)

Potentially Affected Products:

FortiGate: FG-20C, FG-20C-ADSL, FG-30D, FG-30D-PoE, FG-40C

FortiWiFi: FW-20C, FW-20C-ADSL, FW-30D, FW-30D-PoE, FW-40C

Resolution:

FortiOS 5.2.4 software images for the models above have been rebuilt and re-posted on the customer support web site with build number 0688 and time 150730.

[seadave · Accepted solution]

Why does this keep happening?  Fortinet makes such great hardware, but they have seriously burned some of us with bad firmware releases.  I'm a constant Fortinet advocate, but this kind of crap demonstrates a lack of QC and concern for the customer environment.  These type of issues should definitely be exposed by a good QC system and if the firmware has the potential to wipe a config, for godness sakes it should not be released.  Those of us who are long time Fortinet customers have learned to be wary of new releases and to always reboot the appliance, take a back up, and wait for others to expose the bugs, but it doesn't need to be that way with the right internal controls at Fortinet.  Pick up the slack guys.  You make a great product but you are tripping over your own feet when you release builds like this.

[seadave]

ISOffice wrote:

We also have upgraded to v5.2.4 (build 688) on our FG 100D cluster. Whilst not having experienced any major faults with it (other than the slightly annoying failure to display the right pane on occasion), the amount of posts here complaining about it does give me cause for concern and I'm thinking of rolling back to v5.2.3 (build 670).

Therefore I'm asking if the following is an acceptable way to downgrade to a previous version.

In the System Information widget, under Firmware Version, select Update.

Under Available Firmware, All Available, I can see several previous versions of FortiOS (image attached). I have the option to choose any of these versions, select Confirm Version Downgrade and click on Backup Config and Downgrade.

Is this a viable (and indeed advisable) way to go about downgrading our appliances? Apparently it may "result in the loss of some configuration". Can anyone be specific about what this may be?

Many thanks,

John P

If you aren't seeing conflicts impacting operation other than GUI then I would stick with it.  I'm still at 5.2.3 and as a result can't load a EV cert that I purchased!  Ugh.  Like you said, because of the other comments here I'm trying to wait, but not sure that will be better.  I put in a ticket for my cert problem and support said upgrade to 5.2.4!  I have a second unit fortunately so I'm testing that recommendation.

[ISOffice]

Thanks for the input guys, much obliged.

I think I'll stay where I am for the time being. The GUI issue is mildly annoying but not enough to warrant any major change at this time. Hopefully the issues raised in this thread will be addressed by Fortinet soon.

Best regards,

John P

[apex]

If I may ask - is anyone actually running 5.2.4 without any problems?

I've been waiting for this release for quite a while, hoping that I can finally upgrade to 5.2 and not to worry about headache related problems, but looks like I'll have to wait a bit longer..

[seadave]

apex wrote:

If I may ask - is anyone actually running 5.2.4 without any problems?

I've been waiting for this release for quite a while, hoping that I can finally upgrade to 5.2 and not to worry about headache related problems, but looks like I'll have to wait a bit longer..

I just upgraded my 5.2.3 config to 5.2.4.  The biggest issue for me was when I attempted to load an EV Cert, it broke the Certificates GUI.  The upgrade to 5.2.4 appears to have fixed that.  It is hard for me to test other items, because I'm doing this on my backup 500D.  We have two.  One for production running 5.2.3 and one for testing/backup for situations like this.  I took my 5.2.3 config and restored it to 5.2.3 running on my backup system and then upgraded to 5.2.4.

Others seem to report issues with VPN, will see if I can test without too much fooling around.

If you do upgrade, follow the good practices.  Reboot before upgrading.  Take a config backup before and between each firmware update.  Read the release notes for each firmware revision so you know what order of the firmware revisions you need to install.  That way if you do have a problem, you can TFTP the box to factory and restore.

[apex]

Many thanks,

[digimetrica]

Weird beahaviour from me after a 5.2.3 -> 5.2.4 upgrade.

The device has TWO wan connection.

Wan1 works properly.

Wan2 public IP stopped answering to all services exept PING. I can ping it but I can't access to the GUI, ssh, SSL-VPN... anything. The ping works!!!!

When trying to access the https port I can see the traffic generated on the sniffer so t he firewall actually is receiving data on that port but nothing else happens.

I don't know why this is happeneing, especially I can't see any problem to the other public interface (haven't tested ssl-vpn on Wan1 though, so i can't say).

[pcraponi]

digimetrica wrote:

Weird beahaviour from me after a 5.2.3 -> 5.2.4 upgrade.

The device has TWO wan connection.

Wan1 works properly.

Wan2 public IP stopped answering to all services exept PING. I can ping it but I can't access to the GUI, ssh, SSL-VPN... anything. The ping works!!!!

When trying to access the https port I can see the traffic generated on the sniffer so t he firewall actually is receiving data on that port but nothing else happens.

I don't know why this is happeneing, especially I can't see any problem to the other public interface (haven't tested ssl-vpn on Wan1 though, so i can't say).

It's a know bug... Fortinet will fix it on patch 5

[SecurityPlus]

In the last few days I upgraded two FortiWiFi 60D's to 5.2.4. One unit was an upgrade from 5.2.3. The other was running 5.0.9 and I first upgraded to 5.2.2, then after this upgraded to 5.2.4. Both units seems to be running fine and appear to be working normally. They are simple installations with wireless, FortiAP, and VPN. They are not running HA and they each only have one WAN connection.

[fabianopaixaoGC]

We have the same problem here, in a HA with 200D.

We found an important information on 5.2.4 Release Notes(pages 5 and 32):

287871 - Administrative access to the FortiGate using HTTPs and SSLVPN access with the second WAN interface may fail upon upgrading to 5.2.4.

And, to solve this issue, we perform downgrade to 5.2.3 version. regards,

Fabiano

[Jones]

I had this problem, I upgraded to 5.2.4, was connected to the equipment by ssl vpn when the upgrade finished I no longer accessed the equipment with https, http, ssh or telnet FortiGate just received ping packets.