FortiOS v5.2.6 is out...

storaid · ‎01-29-2016

new release is available in the download portal...

FWF60D x2 FWF60C x3 FGT80C rev.2 FGT200B-POE FAP220B x3 FAP221B x2

FSW224B x1

seadave · ‎02-16-2016

They always say that, "just upgrade". I'm beginning to think the biggest weakness is the infinite flexibility of these devices. My guess is you would take 100 users and each one would have a slightly different config making it nearly impossible to do effective testing for new firmware stability. That is all I can come up with or they have the most incompetent QC people in the industry. If you feel the same, share this with your rep. They need to keep hearing this until they do something about it.

I have a stand alone 500D that is running 5.2.3,build670. I have all filters enabled and we lock things down quite a bit here. Our connection is 100Mbps to the web. The following features are enabled:

Advanced Routing

VPN

AntiVirus

App Ctrl

DLP

IPS/IDS

Web Filter

Endpoint Control

Certs

DNS Database

Load Balance

Implicit Firewall Policies

Multiple Security Policies

Policy Based IPSec VPN

Traffic Shaping

WAN Link Load Balancing

!!Turn off features that you are not using!!

It has been rock solid for over 143 days, with one exception. I attempted to add a EC cert using the GUI and it broke the Cert portion of the GUI. Everything else works fine, but the cert GUI won't come up. I'm guessing I could go into the CLI and remove the CSR and that might fix it, but I decided to wait and hold for an updated stable firmware version. Looks like I'm still waiting!

I do have a second 500D that I'm using for testing. I upgraded it to 5.2.6 and then 5.4.0, but haven't had a chance to do further tests. No visible problems after upgrade, but I haven't put production traffic through it yet. As mentioned before, any time you do a firmware update, do the following:

[ol]

Backup your current config and download your existing firmware release if you need to factory reset and then downgrade. (You may need to do this via TFTP in a worst case scenario so make sure you know how that works and have a TFTP server setup on a laptop for such purposes ahead of time).

If you are in a low memory situation, disable logging and other unnecessary processes to free up mem during the upgrade.

Reboot once before upgrading to flush any hung processes.

Upgrade and upon reboot, log into the CLI and issue the command: diagnose debug config-error-log read

Note any errors that indicate portions of your old log file are not compatible and need to be updated.[/ol]

Based on my readings of these forums, it seems like lots of the problems revolve around HA. My company is fairly small with less than 200 employees so I've always elected to buy two firewalls. One stays in production and the other is used for testing/POC. I know this may not be an option for everyone but it has served us well. As many have learned "upgrading Fortigates on a whim" are a recipe for disaster. Using one unit for testing gives you greater flexibility and if the units are identical, it is trivial to take a backup config and load it on the second unit to duplicate your production system for troubleshooting/testing. It is of course critical to keep your config copies current in the event of a hardware failure.

Based on my experience, unless you have a security or technical reason for doing so, don't upgrade to minor versions. If you must, try to avoid versions where the firmware isn't at least the second or third version past GA release. Always read and understand the release notes, what works and what doesn't. Visit these forums often and learn from others' mistakes. Often in the past later versions make things more stable. I'm still not sure what happened with 5.2.4 and 5.2.5 as that doesn't seem to be the case.

Here's a slightly aged link but has additional detail on doing upgrades:

https://mbrownnyc.wordpress.com/2013/01/30/upgrading-the-firmware-on-a-fortigate-unit/

View solution in original post

rpedrica · ‎02-08-2016

@emnoc, you're getting off track here - I have read the release notes ( as I always do ) but I'm not going to take vendor's word at face value, that is why I asked the question if anyone has practical experience with 5.2.6 and whether they can confirm that the issue is resolved. Quite a simple question ...

Nils · ‎02-09-2016

rpedrica wrote:
@emnoc, you're getting off track here - I have read the release notes ( as I always do ) but I'm not going to take vendor's word at face value, that is why I asked the question if anyone has practical experience with 5.2.6 and whether they can confirm that the issue is resolved. Quite a simple question ...

I'm not sure what type of issue you are facing with the SSL Inspection.

I installed a new 500D cluster last week with 5.2.6 and SSL Inspection activated, and I haven't noticed any problems.

FGTuser · ‎02-10-2016

I have several FGT's (100D and smaller) more than 1 week running 5.2.6.

No problems so far, but no SSL inspection is configured on these ones.

seadave · ‎02-11-2016

To those with problems, after you upgrade, you should open the console and type:

diagnose debug config-error-log read

Nice page showing other debug commands: http://blog.webernetz.net/2015/12/21/cli-commands-for-troubleshooting-fortigate-firewalls/

BEING able to see what is wrong I think is one of FGs greatest weakness. Love these appliances, but troubleshooting needs to be easier.

matthew_koeman · ‎03-05-2016

dont forget... after updating to 5.2.6 yuo need to update your dc and ts agents aswell...!!

with us our sso fails until updated

John_Muggli · ‎03-09-2016

We upgraded to 5.2.6 about 3 weeks ago and everything appeared hunky-dory until yesterday morning when the IPS Engine crashed. A reboot took care of the problem but we were "down" for about 90 minutes. We have two FG3700s running in HA mode.

Below is Fortinet Support's reply: 2016-03-08 17:23:00 (PT)Hello, Thank you for your update. We do have a known issue reported for this version of the IPSengine on v5.2.6 which talks about this crash occurring once when you upgrade to v5.2.6 and therefore your IPSengine version also gets upgraded. However, as long as you are facing any high memory issues and this is not re-occurring then there should be any issues. While we are further investigating this issue on our end along with the IPS team please continue to monitor the unit and let me know of your status afterwards.

Cheers

john

ede_pfau · ‎03-10-2016

Seems the answer from TAC is missing 2 "not"s.

Ede

"Kernel panic: Aiee, killing interrupt handler!"

gontait · ‎03-11-2016

Hi All

Please help me to Solve this

I use Fortigate Fortigate 80D runs Firmware 5.0.9. I want to Upgrade to 5.2.6. I upgraded as Path: 5.0.9-5.0.11-5.2.6. Upgrade to 5.0.11 everything ok. But when i upgrade to 5.2.6, LAN can not access internet.

Someone have proble like me. Help me please

Bono · ‎03-15-2016

On 80D I'm still running 5.2.5 firmware and except SSL inspection everything is working fine.

MrSinners · ‎03-16-2016

gontait wrote:
Hi All

Please help me to Solve this

I use Fortigate Fortigate 80D runs Firmware 5.0.9. I want to Upgrade to 5.2.6. I upgraded as Path: 5.0.9-5.0.11-5.2.6. Upgrade to 5.0.11 everything ok. But when i upgrade to 5.2.6, LAN can not access internet.

Someone have proble like me. Help me please

Do you have a config file from before and after the upgrade? Have you checked the interface/routing/policy & NAT configuration in 5.2.6? Did you verify that internet and lan are reachable from the FortiGate itself?

You can also do a debug flow filter to see what happens with the traffic on the FortiGate arriving from the lan that is destined for the internet.