FortiOS v5.6.1 is released...!!

[storaid]

well...

after long time ago, now it's out...

[storaid · Accepted solution]

annoying bug..

JSON string....=^=

[emnoc · Accepted solution]

Other problems noted in 5.6

1: the  diag debug flow show console enable is missing as a option

2: still can NOT upload a  x509 certificate via GUI ( pkcs12  or  via pem cert+key )

3: a valid certificate self-sign  for admingui access does NOT work no matter how or what type of certificate that we try to craft standard, wildcard or SAN if we paste it in via the cli "config vpn certificate local "

More to come ;)

[emnoc · Accepted solution]

Again my  FWF60D has hungs up.  We thought it crashed but come to find out the  HTTP process is hung.  Since this is a remote hosted FW, I'm downgrading ....Sorry but v5.6.1 is a no-go for me ;(

[storaid · Accepted solution]

inexplicable radius server test:

[pcraponi · Accepted solution]

Maybe it's a database migration? Have you tried to format log-disk?

[SMabille]

My 2 cents rant:

FG-200D, no HA, no VDOM, upgraded from 5.4.5:

- FortiView / Cloud App:

      . Without FAZ: FortiView / Cloud app: httpsd crash often and 100% reproductible when trying to dig YouTube

      . With FAZ: No crash but YouTube completely ignored

- xfer-fas file drops still unclear what files: IPS upload off, Fortisandbox cloud working, issue present with or without FAZ, (looks like a widespread issue)

- httpsd and wad unstable (crashlog). FAZ improve httpsd stability vs local disk logging. 

- unclear when/how internet service database is updated and support process is. Netflix addresses already out of date.

- FAZ mandatory to be able to enforce FortiClient telemetry (was not the casse under 5.4.x)

Upgrade process relatively painful (lots of entries on diag debug config-error read):

- Conversion from multiple CASI profiles not/badly supported

- Wildcard FQDN part of address group used on policies, not enforced/checked under 5.4.x and now rejected)

But also basic configuration options:

>>> "set" "service-expire-notification" "disable" @ global.system.global:command parse error (error -61) >>> "set" "enc-offload-antireplay" "enable" @ global.system.npu:command parse error (error -61) >>> "set" "offload-ipsec-host" "enable" @ global.system.npu:command parse error (error -61)

>>> "set" "polling-id" "1" @ root.user.adgrp.CN=Domain Users,CN=Users,DC=....:command parse error (error -61) >>> "set" "polling-id" "2" @ root.user.adgrp.CN=Domain Admins,CN=Users,DC=...:command parse error (error -61) >>> "config" "webfilter" "override-user" @ root:command parse error (error 1) >>> "config" "webfilter" "ftgd-warning" @ root:command parse error (error 1)

>>> "set" "certname" "Fortinet_SSLProxy" @ root.firewall.ssl-ssh-profile.deep-inspection:command parse error (error -61) >>> "set" "certname" "Fortinet_SSLProxy" @ root.firewall.ssl-ssh-profile.certificate-inspection:command parse error (error -61)

In my opinion still nowhere close to production ready (and some widespread issues should have been picked up by QA), still unsure if I'll downgrade my home lab.

Rant over!

[jnliu_FTNT]

SMabille wrote:

But also basic configuration options:

>>> "set" "service-expire-notification" "disable" @ global.system.global:command parse error (error -61) >>> "set" "enc-offload-antireplay" "enable" @ global.system.npu:command parse error (error -61) >>> "set" "offload-ipsec-host" "enable" @ global.system.npu:command parse error (error -61)

>>> "set" "polling-id" "1" @ root.user.adgrp.CN=Domain Users,CN=Users,DC=....:command parse error (error -61) >>> "set" "polling-id" "2" @ root.user.adgrp.CN=Domain Admins,CN=Users,DC=...:command parse error (error -61) >>> "config" "webfilter" "override-user" @ root:command parse error (error 1) >>> "config" "webfilter" "ftgd-warning" @ root:command parse error (error 1)

>>> "set" "certname" "Fortinet_SSLProxy" @ root.firewall.ssl-ssh-profile.deep-inspection:command parse error (error -61) >>> "set" "certname" "Fortinet_SSLProxy" @ root.firewall.ssl-ssh-profile.certificate-inspection:command parse error (error -61)

@ SMabille

By cmdb daemon checking, it normally prints out what configuration lost during upgrading. Therefore, it displays "diag debug config-error-log" in the console. However, most of them are removed by design and command change. 

In your case, all errors are removed by design and command change.

Jining

[jnliu_FTNT]

SMabille wrote:

FG-200D, no HA, no VDOM, upgraded from 5.4.5:

- FortiView / Cloud App:

      . Without FAZ: FortiView / Cloud app: httpsd crash often and 100% reproductible when trying to dig YouTube

@SMabille,

This is a known Fortiview issue and will be fixed on FOS5.6.2.

Thanks for your test.

Jining

[brycemd]

Andy Bailey wrote:

The second issue is:-

Existing anti-virus profiles seem to have lost their "Suspicious Files Only" for "Send Files to FortiSandbox Cloud for Inspection". It looks like I need to recreate the AV profiles and update all the policies currently using the old profile.

Not sure why that would be?

I have however noticed my first file ever being sent to FortiSandbox Cloud- which I guess is positive?

Kind Regards,

Andy.

I believe that was removed earlier than this firmware. At least I don't have the option on 5.6.0, maybe a legacy policy would have. If the fortigate is sending files it already deems suspicious it kind of defeats the purpose of the sandbox. The sandbox is supposed to catch files the fortigate missed/didn't know about.

[storaid]

weird ipv6 command display:

[emnoc]

My FWF60D  crashed and need  a hard reboot.Very sad that it seems like every upgrade leads into bigger problems.

ken

[Jzhang_FTNT]

Thank you for your feedback. I can reproduce this issue on my device.

storaid wrote:

weird ipv6 command display:

[andrewbailey]

storaid wrote:
weird ipv6 command display:  

I'm seeing exactly the same issue- also on a FG-60E. My IPv6 connectivity is completely broken on 5.6.1 now, but I've not diagnosed where the problem lies. Certainly "unset" ing the ip6-manage-flag and the resetting it to enable still gives the enable/ disable weirdness. I'm seriously think I may have to roll back to 5.6.0. Too many issues in a software version which should only really be fixing bugs. Andy.

[bommi]

My IPv6 connectivity using an delegated prefix works on 5.6.1 with my FortiWifi 30E.

[andrewbailey]

bommi wrote:
My IPv6 connectivity using an delegated prefix works on 5.6.1 with my FortiWifi 30E.

Are using stateless IPv6 config? I'm using a stateful config with DHCPv6 and I think the manage flag issue (mentioned earlier by myself and one other person) means the advertisements aren't working as expected. In my config I can see connectivity is there from the Fortigate to other internal and external devices. However most of my devices aren't requesting IPv6 addresses- presumably because they aren't seeing the manage flag correctly? It did all work correctly under 5.6.0. Kind Regards, Andy.