FortiWiFi 60D units locking up

[Matt_Garrett]

In the past months we upgraded a large number of FortiWiFi 60D units to 5.2.4 and started seeing issues with units locking up and not responding randomly.   The only way to resolve is to unplug power and reboot.

We are seeing this on a number of units.  We send out logs to FortiAnalyzer and we found that after this hard reboot logging to memory is again enabled.  We contacted Fortinet Support and this is a known big to be fixed in 5.2.7.  I am not entirely convinced that this setting is causing the lock ups.  Logs indicate nothing and in fact some units have few to no logs prior to lock up.  Seems to be very random in nature, but also appears to only when during normal business hours.

Anyone else having any similar issues or thoughts on this?

-M

[Itguy]

Our company has around 100 60D's deployed with no lockup issues on 5.2.7. We've found if there are lockup issues they usually link back to IPS.

First we usually format the log disk.

diag sys top execute formatlogdisk , best thing to do is to optimize the settings. Like, reducing the session-ttl ( which is 3600 seconds may not be needed in most of the networks) and when can have increased session-ttl for specific protocols and ports if needed. Also, tweaking the below values (these are not default, they are recommended values):

config system global set tcp-halfclose-timer 30 set tcp-halfopen-timer 30 set tcp-timewait-timer 0 set udp-idle-timer 60 end Above techniques will help to optimize the performance of a device.

[ShrewLWD]

That's great that that works for you, but we are seeing;

no response on the LAN side

no response at the console

EDIT: Misread.  But have the exact same config across all our devices, and only a subset are experiencing this.

[Matt_Garrett]

Shrew-

Looks like you and I are having very similar issues.  100s of devices with nearly identical configs and only SOME lock up.  We have replaced units and they replacements exhibit the same behavior.  Last TAC tech stated the unit was not upgraded following the appropriate upgrade path. They stated it is was upgraded from 5.0.6 to 5.2.4 and 5.0.10 was skipped.  Unit arrived to our door from Ingram with 5.2.4 in January of 2016.  That same day we received a few new 60D units.  According to the TAC tech, they were all upgraded improperly BEFORE they were shipped to me. 

I wiped one of the 60D units and loaded a clean install on it, deployed it and it has not locked up once.

I have about 15-20 units out in the field that are doing this, but since I upgraded them from 5.0.1 years ago to 5.2.7 myself, I know it was done right.  However, I do not know if they were put on 5.0.1 correctly and possibly exhibiting behaviors from that.  Seems unlikely that I would just now be seeing issues, but FortiGates have done stranger things.

[Smartypants]

I have a pair of 900D's among other problems that the GUI crashes about every time I use it.

Back in April I started complaining about poor logging and GUI performance then we discovered a bug in the DoS GUI.

I got tired waiting for the bug fix on the DoS display (shows a blank screen) and opened a new case about the GUI locking up all of the time and forcing me to go to a different computer (IP address) to access the GUI.

It really said that Fortigate has all of these problems; its basically a nice product.

In retrospect it was a bad idea to purchase a newly released chassis as we did. The 900D was released just weeks before we purchased two of them. Should have stayed with the Cisco ASA's for a little while longer.