Fortigate dos not reboot

[salsero_gallego]

Hi all I have a problem with a 60C in a remote office. The fortigate dos not work correct. I need to reboot the box. SSH access works, but I can' t reboot the Firewall. ########## hostname-fortigate # execute reboot This operation will reboot the system ! Do you want to continue? (y/n)y System is rebooting... ########## But the Fortigate dos not reboot. In the office there is no one who can turn off/on the box. Any ideas?

[salsero_gallego]

Behind the Firewall we have 2-3 Users, and one Server. No AV, No Webfilter or other UTM. Noting. one rule with Internet traffic, only standard Web traffic. 5 VPNs, where normally 1...2 are active. ISP line 10M The crach was, when a remote admin works on the Server via one VPN, and he hase downloaded a file via the other VPN => crash of the Firewall. Testet with MR2 P4 and MR2 P8. Then I have don a nearly same config in my Lab on a newer 60C WiFi. Here with MR3 P3 the same. Transfer via only 2 VPNs, both active, ISP line 2M and highest encryption (AES256-SHA256, the box crash. With AES128 and SHA1 works.

[rwpatterson]

ORIGINAL: salsero_gallego The crach was, when a remote admin works on the Server via one VPN, and he hase downloaded a file via the other VPN => crash of the Firewall. Testet with MR2 P4 and MR2 P8. Then I have don a nearly same config in my Lab on a newer 60C WiFi. Here with MR3 P3 the same. Transfer via only 2 VPNs, both active, ISP line 2M and highest encryption (AES256-SHA256, the box crash. With AES128 and SHA1 works.

He told us...

[emnoc]

Man that sucks

[harald21]

Hello, DES, 3DES, AES128, AES256 is done in hardware, MD5 and SHA1 too, but SHA256 is done in software, thats why your box was overloaded. You can check that at the CLI: #get vpn status ipsec Sincerely Harald

[ejhardin]

Enable the debug mode and check the crash logs... Fortinet found the problem with my device to be related to a bug with the first gen 60C and the sdhc storage. I brought my device only 6 months ago and was not happy that I was sold a first gen.

[FortiRack_Eric]

The encryption is handled in hardware (CP6) but you have to be aware that a CP6 cannot handle SHA-256 or higher in hardware, so if you select these higher hashing algorithms the complete VPN will be handled in software!!! you can check this with diag vpn ipsec status and you' ll see where the vpn is handled in NPU, CP or CPU (software). Cheers, Eric

[emnoc]

Now AES128 - SHA1 (for both, Ph1 and Ph2). Before it was higher.

So salsero, What did you had previously sha1 and AES or sha2 and AES? Your leaving us guessing on what was actually higher.

[emnoc]

Ah didn' t see that.

[fropert_FTNT]

KB article: FortiOS IPSec and SHA-2 Support Information

[salsero_gallego]

Thanks for all your help. I understand, that SHA-2 is not supported by Hardware. But again, it can not be, that when I use the " Software version" the Fortigate crash!! And then I can' t for example reboot to reset the Box.