Problems with several fortigates : lost config

[tvengel]

Hello, Since the last half year I had several clients which had a fortigate that lost his config after a reboot. The latest example is a fortigate 50A which had problems with passing the emails through. When we guide our client to the web console, and let hem choose " Reboot" in the main pages (100% user he has choosen reboot" . After the reboot, the firewall looks like he doesn' t work anymore. When I visit our client onsite a couple hours after that (during the night) I see that the firewall has almost all " factory-default" . Everything is lost, EXCEPT the LAN-IP, that is still like it was before. I had this problem allready for 5-6 times (2 times after a firmware upgrade). And once with a Fortigate 60 which had his full configuration, but the policies were gone. FYI : Upgrading was done with a supported upgrade path. Does anyone else encountered this problem too? If this should happen more often then it will be a huge problem. Because of the " factory default" it isn' t possible the manage it remotely and we then have to drive to our client (last time 2 x 2h15 minutes). Regards, Tim Van Engeland

[abelio]

FYI : Upgrading was done with a supported upgrade path. Does anyone else encountered this problem too? If this should happen more often then it will be a huge problem. Because of the " factory default" it isn' t possible the manage it remotely and we then have to drive to our client (last time 2 x 2h15 minutes).

Hello Tim, every upgrading process includes a mandatory first step to avoid those issues: backup I' ve only experienced such problems in entry boxes (50/60) after several cycles of down/upgrading to test things, so I cannot tell you more. Nevertheless, there was a notice important a few weeks ago, about a new IPS engine that could be cause similar behaviours like you describe; look post http://support.fortinet.com/forum/tm.asp?m=32030&appid=&p=&mpage=1 Maybe related, maybe not.

[UkWizard]

I have seen a similar problem when a box has been upgraded firmware wise, and the config not " touched" until it powered off, when it then loses its config. many upgrade steps require you to touch the config, so that it gets fully written back to the box before its powered off. slim possibility. although a bigger possibility is that the user select factory reset instead by accident, as on certain firmware levels its in the same drop down box (from memory).

[tvengel]

Hello Abelio and UkWizard, Thanks for your replies. About the " important notice" . I' ve received that information a few days before and checked the firewalls that they were running the current config and they did. But the problem allready existed before that. I think the problem is somehow like UkWizard described, but normally I change some little thing so the config will be adapted. I know the " factory reset" option is in the same dropdown box as reboot, but I' m more then 100% sure that the client has choosen the right option. Regards, Tim Van Engeland

[rwpatterson]

Take a look at the release notes for MR3 patch 12. Fits this scenario to a T!