Fortianalyser problem, two RMA and lost of logs.

[jeaneric]

Last week I updated my Fortianalyser 400E from FAZ_400E-v5-build1082-FORTINET.out to FAZ_400E-v5-build1151-FORTINET.out

After that the device won't boot at all. I logged a ticket to support and passed two hours trying to make it boot. We formated the boot partition multiple times, uploading  and finally the support offered me an RMA.

New device come in, same issue won't pass the booting process.

I created another ticket and they issued another RMA.. should have my new device soon.

Did this happen to one of you? Is someone can help me getting out my logs from the first device that failed? The support told me this was "difficult" when the fortios don't boot. I'm able to go in the IPMI we console as the server is a supermicro but I can't boot on another operating system, the bios is password protected.

Here what we see from COM port, it stuck after the last line on both devices.

Reading boot image 3597061 bytes. Initializing FortiAnalyzer...

The disk was not unmounted properly. You should run 'diag sys fsck harddisk'.

Initialize file systems... Old version: v5.4.2-build1151 branchpt1151 161213 (GA) New version: v5.4.2-build1151 branchpt1151 161213 (GA) Global DB running version is 428, built-in DB schema version is 428

[scao_FTNT]

can you help do a check if downloaded image checksum is same as below?

ef9ad791270ea6cdd62f4687d6ebcd112b7e0e032cb8515f4c8f7b391041607439ce38918b973584d91a83039a158ca8c7da2c8995f1057b97a50cf01970378c FAZ_400E-v5-build1151-FORTINET.out and can you send me your ticket ID so I can follow up your case? Thanks Simon

[jeaneric]

I don't know from where your checksum come from but I already done a check if my image file was right, from the MD5 checksum code show on fortinet download page: db141a09c9d539bd5f2c7b2c99d71f8e

My first ticket is 2153958 and my second is 2162432

Do you have any info about the password needed when connected with a screen on the device? At boot it offer to press DEL or F11 but after it ask for a password, probably protected from bios. Without it and the impossibility to boot on FortiOS I'm kind of stuck because of the hardware.

Regards

JeanEric

[scao_FTNT]

sorry, my provided one is sha512 checksum and md5 is the one you provided

I will do a check for your tickets

Thanks

Simon

[jeaneric]

Update

Original fortianalyser:web access not working,  Port COM stuck after boot never see login page.

I received a new fortianalyser from RMA: Port COM was not working properly, I see the boot I was able to push a new boot image but never been able to have the login page prompt.

Support send me a second fortianalyser (RMA #2): same issue on port COM, tried with other computer and serial cable. Like the first RMA I was able to put the last firmware

Finally we have been able to log in from network cable with nic # 1 default ip [link]https://192.168.1.99.[/link]

I setuped network card #2 with static ip from my lan. I swapped the hard drives from original fortianalyser. 

The Raid10 worked fine on the new devices, I didn't loose my logs I only had to wait BD rebuild. 

To remember: don't trust serial connection with fortianalyser 400e, maybe a current issue support didn't told me more.

Regards