Fortigate 60E with 5.4.4 Changes to Policies not being enforced until reboot

[netengwi]

I have had a couple of our Fortigate 60E firewalls (5.4.4) exhibit an issue where changes to the iPV4 policies are not actually applying until a reboot.  If I make a new rule or add services to an existing rule the changes appear in the GUI and CLI but the new rules are not applied to any traffic. 

Example:

1. Created a service for TCP Port 10020.

2. Modified an existing firewall rule to add this as an allowed service.

Result

Traffic still blocked to 10020.  After rebooting the firewall the rule applies correctly.

Additionally, in some of my testing I created a new rule to allow all traffic and put it as the first entry in a policy.  The byte counter never increments and in FortiView it shows all of the connections are still using the policies below the new one.  Even if I disable the policies and delete existing sessions, new sessions show up using the disabled policies.  I have even tried disabling a VLAN interface that was part of a policy and re-enabling it to see if that would force the changes to actually be enforced.  This didn't work either.  Only a reboot results in the add/remove/changes actually applying properly.

Is there any other thing I can try apart from rebooting the firewall to force the policies to re-apply?

Sincerely,

Shane

[emnoc]

The cil  diag debug flow is  your friend. I afraid iI have not seen that issue in   v5.4.4 or any v5.4.x versions

Ken

[StevieC]

We have a FortiWiFi 30E running v5.4.3,build1111 (GA) that runs fine after a reboot and then at some point, any changes to policies or new policies won't apply or take effect until the unit is rebooted.

Starting to get a bit annoying having to reboot the unit to get a simple policy to work.

Thanks

Steve

[romanr]

Hi,

I remember, that we ran into the same issue once also. On 50E models I believe...

New Policies have been displayed in the config on GUI and CLI. But did not match - After a reboot those policies did work..

Upgrading to current 5.4 builds did solve this issue!

Br,

Roman

[deum]

We are experiencing the same problems as well, sometimes a reboot needed before changes are applying. We’re using a Fortigate 80E with firmware version v5.4.5,build6225. Very annoying.

Regards,

Edwin.

[Ahmad_Hashem]

I have the same problem. with a difference that changes are activated after 6 hours without rebooting. How Can I find some solution to that? 

[poundy]

Ahmad Hashem wrote:

I have the same problem. with a difference that changes are activated after 6 hours without rebooting. How Can I find some solution to that? 

Are you also using 5.4.4? If not, I'd create your own thread, as you have a different problem. And if you are, the above suggests moving to a later build addresses this. If you do the upgrade and it still doesn't address your issue, I'd raise a tech support ticket direct to Fortinet support. 

[Ahmad_Hashem]

I have v5.6.9 build1673 (GA) 

[poundy]

you have a different problem. I'd suggest you raise a support ticket, if you can I'd consider upgrade to 6.0.x, or open a different thread and provide more detail about your environment and the behaviour so others can understand your issue. 

[Ahmad_Hashem]

How can I raise a new support ticket? Can you give the right link to start with?