How about stability of FortiOS 5.4.1 release?

[thrillseeker]

Hi all,

Just want to know about the community experience with FortiOS/FortiManger 5.4.1 stability in production environments.

For our company we have plan's to go with 5.4.1 soon because of new HW. We will just need basic Firewalling (Layer3), NAT/VIP and HA functionality, no fancy UTM features and no VDOM's so far. Of course we would like to use FortiManager 5.4.1 as well for centralized management (probably with ADOM's). Are there any issues/problems when going with FortiOS and FortiManager 5.4.1 version right now? Or does it make sense to go with latest 5.2.9 more stable release?

Thanks a lot for any feedback

cheers thrillseeker

[kst]

I had lot of issues with 2-3 upgrades FortiOS 5.2.8 & 5.2.9. Especially cpu usage (IPS ) On fortigate 200b and 70D

70D was brand new and I set it up with 5.2.8, after upgrading it to 5.2.9 some hours later I got call from client with many complains about speed etc. A rollback to 5.2.8 saved the situation.

Comparing it with other clients with the same equipment (70D) but version 5.2.7 CPU utilization is much lower.

On the 200B after upgrading it from 5.2.7 to 5.2.8 and keeping it for 4-5 days I had also a lot of complains for slow internet and time outs. Cpu was stuck on 99%

I did create a ticket the second day after the upgrade.

I got answer 2 days later, I had already downgraded it to FortiOS 5.2.7 which also saved the situation. Anyway the technical support suggested to me to backup, format the internal disk and upgrade it to 5.2.9 (I guess through TFTP) and they were positive that this could decrease the utiliziation and the time outs. Unfortunately I could not interrupt the client's connection so I did not procceed.

I also hope that 5.4.x will be ok but personally I would  not suggest you to upgrade to 5.2.8 & 5.2.9

In conclusion I think that the most stable release is 5.2.7

[emnoc]

With for  5.4.2+ if you want to be cautious but so far I have 3 devices on 5.4  build1064 with good luck. They are NOT doing anything special tho.

Ken

[tanr]

I've been running a 300D and a 100D with 5.4.1.  I'm not running FortiManager, so can't speak to that.

In general 5.4.1 on the FortiGates has worked well and been stable.  

I have run into a bunch of fit-and-finish details, some with the GUI and more with documentation that hasn't kept up with feature changes, but nothing that has been a show stopper.

One issue that I've observed but have not confirmed is truly a problem seems related to IPS memory use.  I'm using a few different IPS sensors in a number of security policies.  I can track an increase in use of system memory of about 0.75% per day, that appears to be mostly in ips monitor and ips engine.  Restarting those services (diag test application ipsmonitor, then option 99) drops the memory use back down.  I don't know if this is truly a memory leak or just related to caching of data.  Not much an issue for you if you're not using UTM features.

Are you going to be using the FortiGates for IPSec VPN?

[MikePruett]

5.4.1 for the most part has been fairly stable for me. I am patiently waiting on 5.4.2 in hopes that it fixes some little bugs (mostly annoyances) that I am experiencing on some of my smaller gear.

[ted_barker]

My consultants all told me that 5.4.1 on FG1500D is not recommended. What is the best forum to find out? Does Fortinet have a recommendation service, i.e. where they actually tell you what works and what won't work according to the latest available information. Also what type of functionality a deployment uses and give a stability rating? We had to start with 5.2.9 and FAZ 5.2.9. But I would like to know if there is some experts exchange and other means for us to get information in the future.

[MikePruett]

The 5.4.2 release notes are on the fortinet document site. It mentions the fixes for 1500D's as well as known issues. Check that and it might provide guidance. I wouldn't run 5.4.1 on big enterprise grade equipment though. Not yet at least.

[tanr]

I've been running a 300D on 5.4.2 for 5 days (of light use).  Haven't had any problems and didn't see the issue some have seen where upgrading borked their passwords or certificates.

One nice difference with 5.4.2 is that I haven't seen the slow increase in use of system memory.  With 5.4.1 I could count on memory use going up approximately 0.75% per day, but with 5.4.2 it has stayed steady for 5 days.