FortiOS v5.2.6 is out...

storaid · ‎01-29-2016

new release is available in the download portal...

FWF60D x2 FWF60C x3 FGT80C rev.2 FGT200B-POE FAP220B x3 FAP221B x2

FSW224B x1

seadave · ‎02-16-2016

They always say that, "just upgrade". I'm beginning to think the biggest weakness is the infinite flexibility of these devices. My guess is you would take 100 users and each one would have a slightly different config making it nearly impossible to do effective testing for new firmware stability. That is all I can come up with or they have the most incompetent QC people in the industry. If you feel the same, share this with your rep. They need to keep hearing this until they do something about it.

I have a stand alone 500D that is running 5.2.3,build670. I have all filters enabled and we lock things down quite a bit here. Our connection is 100Mbps to the web. The following features are enabled:

Advanced Routing

VPN

AntiVirus

App Ctrl

DLP

IPS/IDS

Web Filter

Endpoint Control

Certs

DNS Database

Load Balance

Implicit Firewall Policies

Multiple Security Policies

Policy Based IPSec VPN

Traffic Shaping

WAN Link Load Balancing

!!Turn off features that you are not using!!

It has been rock solid for over 143 days, with one exception. I attempted to add a EC cert using the GUI and it broke the Cert portion of the GUI. Everything else works fine, but the cert GUI won't come up. I'm guessing I could go into the CLI and remove the CSR and that might fix it, but I decided to wait and hold for an updated stable firmware version. Looks like I'm still waiting!

I do have a second 500D that I'm using for testing. I upgraded it to 5.2.6 and then 5.4.0, but haven't had a chance to do further tests. No visible problems after upgrade, but I haven't put production traffic through it yet. As mentioned before, any time you do a firmware update, do the following:

[ol]

Backup your current config and download your existing firmware release if you need to factory reset and then downgrade. (You may need to do this via TFTP in a worst case scenario so make sure you know how that works and have a TFTP server setup on a laptop for such purposes ahead of time).

If you are in a low memory situation, disable logging and other unnecessary processes to free up mem during the upgrade.

Reboot once before upgrading to flush any hung processes.

Upgrade and upon reboot, log into the CLI and issue the command: diagnose debug config-error-log read

Note any errors that indicate portions of your old log file are not compatible and need to be updated.[/ol]

Based on my readings of these forums, it seems like lots of the problems revolve around HA. My company is fairly small with less than 200 employees so I've always elected to buy two firewalls. One stays in production and the other is used for testing/POC. I know this may not be an option for everyone but it has served us well. As many have learned "upgrading Fortigates on a whim" are a recipe for disaster. Using one unit for testing gives you greater flexibility and if the units are identical, it is trivial to take a backup config and load it on the second unit to duplicate your production system for troubleshooting/testing. It is of course critical to keep your config copies current in the event of a hardware failure.

Based on my experience, unless you have a security or technical reason for doing so, don't upgrade to minor versions. If you must, try to avoid versions where the firmware isn't at least the second or third version past GA release. Always read and understand the release notes, what works and what doesn't. Visit these forums often and learn from others' mistakes. Often in the past later versions make things more stable. I'm still not sure what happened with 5.2.4 and 5.2.5 as that doesn't seem to be the case.

Here's a slightly aged link but has additional detail on doing upgrades:

https://mbrownnyc.wordpress.com/2013/01/30/upgrading-the-firmware-on-a-fortigate-unit/

View solution in original post

Paul_S · ‎02-01-2016

that was really fast! perhaps the new issue I just noticed is resolved in 5.2.6.

youtube.com won't load properly today. net::ERR_INSECURE_RESPONSE in google chrome console. only caused when webfiltering is enabled. I am using certificate inspection mode only.

FG200D 5.6.5 (HA) - primary [size="1"]FWF50B' s 4.3.x, FG60D's 5.2.x, FG60E's 5.4.x [Did my post help you? Please rate my post.][/size] FAZ-VM 5.6.5 | Fortimail 5.3.11 Network+, Security+

simonorch · ‎02-02-2016

And where are the release notes for FAP 5.2.5??

NSE8
Fortinet Expert partner - Norway

SMabille · ‎02-03-2016

Tested on 200D, about 50 policies, IDS, AV, SSL interception.

5.2.4 at boot, no traffic (<5Mb/s) memory <35%

5.2.6 same condition near 70%, entering in preservation mode straight away...

QA never been Fortinet strongest point but with 5.2.5, 5.2.6 and 5.4.0 we are reaching new low....

Paul_S · ‎02-03-2016

i'm on FG200D (ha pair) v5.2.5 with 300 policies. I am not doing SSL inspection outbound, only inbound to web server.

My memory level is 30%.

Since 5.2.5 has a major bug in the outbound SSL inspection, I wonder if bugs in that component are causing high memory in 5.2.6 too?

I wish QA was better too. :(

FG200D 5.6.5 (HA) - primary [size="1"]FWF50B' s 4.3.x, FG60D's 5.2.x, FG60E's 5.4.x [Did my post help you? Please rate my post.][/size] FAZ-VM 5.6.5 | Fortimail 5.3.11 Network+, Security+

PIDDLAW · ‎02-15-2016

SMabille wrote:
Tested on 200D, about 50 policies, IDS, AV, SSL interception.
5.2.4 at boot, no traffic (<5Mb/s) memory <35%
5.2.6 same condition near 70%, entering in preservation mode straight away...

QA never been Fortinet strongest point but with 5.2.5, 5.2.6 and 5.4.0 we are reaching new low....

we are having nothing but SSL vpn problems since a clean install of 5.2.6. ( we were on 5.2.4)

Can someone recommend the most stable build for our 100d?

as I will probably be re imaging the 100d with a older firmware this evening. But am not sure which.

NotMine · ‎02-15-2016

PIDDLAW wrote:

we are having nothing but SSL vpn problems since a clean install of 5.2.6. ( we were on 5.2.4)
Can someone recommend the most stable build for our 100d?
as I will probably be re imaging the 100d with a older firmware this evening. But am not sure which.

Hi PIDDLAW, if 5.2.4 was working fine, I would recommend you revert to it. "If it's not broken - do not fix it." I'm starting to like that saying. ;)

NSE 7

All oppinions/statements written here are my own.

Gianluca_Caldi · ‎02-16-2016

I've installed 5.2.6 on several different boxes (200B, 60C, 110C, 300C, 60D, 100D) for some weeks now. I've noticed no issue on any model. Only thing is some heavy CPU usage on the 60D boxes due to the SSL deep inspection (which somehow looks more resource consuming on these boxes than on the 60Cs) even with a not so big number of users.

FGT: 50E,100D, 200D, 600D
FMG: VM64

FAZ: VM64

PIDDLAW · ‎02-16-2016

my ssl disconnects and slowness was just explained by a ticket with forinet

that it is a bug.

From all i have read i am not sure the solution they mention is appropriate.

upgrade to 5.4 ( which by my reading of the forums may be less than ideal)

"The behavior you have mentioned in the update regarding SSL_VPN slowness and frequent disconnects is known to us. Our development has related them to bugs. FortiOS release 5.4 has this issue resolved. I would recommend Firmware upgrade to FortiOS 5.4. " anyone have any recommendations about if we should go to 5.4 or if we should reformat and go back to something earlier and 5.2.?

thanks

Dave

seadave · ‎02-16-2016

They always say that, "just upgrade". I'm beginning to think the biggest weakness is the infinite flexibility of these devices. My guess is you would take 100 users and each one would have a slightly different config making it nearly impossible to do effective testing for new firmware stability. That is all I can come up with or they have the most incompetent QC people in the industry. If you feel the same, share this with your rep. They need to keep hearing this until they do something about it.

I have a stand alone 500D that is running 5.2.3,build670. I have all filters enabled and we lock things down quite a bit here. Our connection is 100Mbps to the web. The following features are enabled:

Advanced Routing

VPN

AntiVirus

App Ctrl

DLP

IPS/IDS

Web Filter

Endpoint Control

Certs

DNS Database

Load Balance

Implicit Firewall Policies

Multiple Security Policies

Policy Based IPSec VPN

Traffic Shaping

WAN Link Load Balancing

!!Turn off features that you are not using!!

It has been rock solid for over 143 days, with one exception. I attempted to add a EC cert using the GUI and it broke the Cert portion of the GUI. Everything else works fine, but the cert GUI won't come up. I'm guessing I could go into the CLI and remove the CSR and that might fix it, but I decided to wait and hold for an updated stable firmware version. Looks like I'm still waiting!

I do have a second 500D that I'm using for testing. I upgraded it to 5.2.6 and then 5.4.0, but haven't had a chance to do further tests. No visible problems after upgrade, but I haven't put production traffic through it yet. As mentioned before, any time you do a firmware update, do the following:

[ol]

Backup your current config and download your existing firmware release if you need to factory reset and then downgrade. (You may need to do this via TFTP in a worst case scenario so make sure you know how that works and have a TFTP server setup on a laptop for such purposes ahead of time).

If you are in a low memory situation, disable logging and other unnecessary processes to free up mem during the upgrade.

Reboot once before upgrading to flush any hung processes.

Upgrade and upon reboot, log into the CLI and issue the command: diagnose debug config-error-log read

Note any errors that indicate portions of your old log file are not compatible and need to be updated.[/ol]

Based on my readings of these forums, it seems like lots of the problems revolve around HA. My company is fairly small with less than 200 employees so I've always elected to buy two firewalls. One stays in production and the other is used for testing/POC. I know this may not be an option for everyone but it has served us well. As many have learned "upgrading Fortigates on a whim" are a recipe for disaster. Using one unit for testing gives you greater flexibility and if the units are identical, it is trivial to take a backup config and load it on the second unit to duplicate your production system for troubleshooting/testing. It is of course critical to keep your config copies current in the event of a hardware failure.

Based on my experience, unless you have a security or technical reason for doing so, don't upgrade to minor versions. If you must, try to avoid versions where the firmware isn't at least the second or third version past GA release. Always read and understand the release notes, what works and what doesn't. Visit these forums often and learn from others' mistakes. Often in the past later versions make things more stable. I'm still not sure what happened with 5.2.4 and 5.2.5 as that doesn't seem to be the case.

Here's a slightly aged link but has additional detail on doing upgrades:

https://mbrownnyc.wordpress.com/2013/01/30/upgrading-the-firmware-on-a-fortigate-unit/