Internet-service version(3) is not supported.

[tanr]

Hi All,

After a manual update of AV and IPS (from the GUI) FortiGate 300D 5.4.2 became unresponsive, except for ping.  Nothing from the console port as well.

Finally did a hard reboot, and the system seemed to come back up okay, except for many many lines of:

    Internet-service version(3) is not supported

Checking through the GUI, the Internet Service Database now shows 195 database items (like Amazon-NTP etc.) but all with 0 Entries, EXCEPT for Google-NTP, with protocol Number 0, TCP, and number of entries 36308258!

Attempted to update AV and IPS again but no improvement, except that the system didn't hang this time.

diag debug config-error-log read shows nothing

get app internet-service-summary shows:

 

Version: 00003.00001

Timestamp: 201611111300

Number of Entries: 1314

Any suggestions on best method to recover from this?  I can roll back the config, but I don't think the internet service database is directly stored in the config...

[MikePruett]

I have a few clients experiencing this on 5.4.1

One has a 500D another on a 300D.....

[tanr]

I'm on the line with Fortnet now, working on this.

Did your clients find any workaround other than factory reset and restore config?

[MikePruett]

Their devices aren't becoming unresponsive.....we are just seeing the error.

So no work around has been necessary as of yet. More of an annoyance currently.

[tanr]

Were your clients getting an Internet Service Database with almost all empty entries?

My concern would be whether AV, IPS etc. reference the Internet Service Database and then don't work correctly.

Fortinet support said they have seen this issue with 5.4.2, where it can't handle version 3 of the Internet Service Database.  

We deleted the files for the ISD and then did an "exec update-now" which pulled down version 2 of the ISD.

I believe (now) 5.4.2 will automatically keep working with version 2 of the ISD.  However, I don't know why it pulled down version 3 in the first place.

[MikePruett]

Not sure off hand. I'll jump into their boxes a little later tonight and see though.

[pcraponi]

fixed in 5.4.3