The Letter I Sent To Fortinet

[#1]

I was lucky, I was going through my mailbox and found 3 emails from internal non-tech support people within fortinet. So I wrote this nifty email and sent to all of them: Dear Sirs, A few months ago we exchange a few brief emails regarding The Fortigate line of firewalls. At the time I thought that the fortigate was a true solution that offered features at a price that another vendor simply couldn’t deliver. Now, nearly 7 months later, myself and many other find themselves battling bugs in the FortiOS code that should never make it to general availability. A case in point is the PPTP bug in 2.5MR7 that literally broke all forms of PPTP traffic from passing through the unit. Many people use PPTP as their VPN solution because it interfaces so well with many Microsoft products. Another example is the memory leak that made it into 2.8MR3. This leak uses up valuable system memory and requires you to reboot the firewall on a regular schedule or risk a system crash. These issues are major and should have never made into a major release of the FortiOS software. There seems to exist a void between the Developers, Technical support, and Salesmen. In fact the growing concensous on the fortinet user forum http://support.fortinet.com/forum is that Fortinet conducts NO pre-release testing of their software prior to release. That or the developers are being forced to release code before it is ready for various reasons. I invite you to view the forum and browse the posts. I think you will find it most enlightening. Fortinet is a young company, and has to much riding on quality products to develop a bad reputation so early in its life. Many current customers are afraid to upgrade because of the severe bugs or because they will LOSE functionality. Currently we think that our voice is not being heard. Many of the users of the forum pleaded with Fortinet to hold the release of 2.8 until it was relatively bug free. This was not the case as 2.8 was release with many many bugs. I have sold and configured 2 FG-300’s, 2 FG-200’s, 2 FG-100’s, and 2 FG-50A’s. I am not sure that I will sell any more fortigate firewalls to my customers until the Quality Assurance testing of the code releases improves. I do ask that you view the forum. That where the true fans of the fortinet line post their opinions. If they are disgruntled, then fortinet has a major problem on its hands. Sincerely, Forrest Hamm Systems Engineer MCSA, MCP, CCNA, CCDA, A+ Blue Ridge Business Development Center 336-372-1525 Ext. 30 wOoT

[#2]

Great letter glad to see someone voice our concerns to their company, hopefully they will actually take you up on viewing the forum, and look into restructuring their QA and possibly version control, it would almost seem that one developer works on one bug , one on another and their code isnt merged, anyway enough rambling, great post keep up the good work you are doing in the forums, and maybe we should all take some time to write Fortinet a letter.

[UkWizard]

2.8 was supposed to be the new-generation bug free, thats why it took so long to come out (testing extensively, well supposedly). Imagine how i laughed when the FIRST 2.8 code that came out what MR3 and more buggy than all the others i think. Nice letter though, suspect it will fall on deaf ears, one thing i have learnt about this company so far, is they do not listen to there customers. Which i feel is a great shame, because the products have great potential.

[#4]

Even the forum board is buggy. Check out the number of active users.

[#5]

Umm, yeah. Now it says -39 @ 8:46am Pacific time on 8/19/04. Whatever... Travis.

[#6]

Hacked By Chinese! wOoT

[UkWizard]

maybe there is 47, you never know, theres the three of us for a start ..

[Johan_Lysen]

Hi Forrest (nice Beach-picture!) Greate letter, there need to be some pressure on Fortigate i think!. I also send a letter to the Swedish representative on Fortinet. The answer was " most of those problems is known and fixed in MR4/MR5" /Johan It´s originally a Word-doc with formatted text, but now... text only Summaraize of known problems in 2.8MR3 Created 2004-08-11 by Johan.Lysen@husera.se

---

Problems during Upgrade from 2.5MR9 to 2.8MR3 CAVEATS #1 : Custom Services can no longer hold multiple rows so config is lost during upgrade This is major, major problem and a really, really bad drawback of version 2.8 Of course a modern firewall must have the ability to create services with multiple port combinations (UDP,TCP,ICMP,CustomProtocol) with greate flexibility. Even create protocols on a higher level such as inside RPC, inside Citrix, inside HTTP, inside FTP, and so on like top-of-the-line firewalls are able to do. Already in version 2.5 we thought that Fortigates´s possibilities to create services and combinations of ports was a bit stiff - but we figured, in next version there will be even more flexibility on this front. Wrong! - in version 2.8 u can only create a service with one row. Stiff, unflexible and just not good enough. So before u upgrade u have to redesign every service/group u created to match this criterium, else u loose config during upgrade - just like that. And Yes - u can read about this in the release notes - but that doesn´t solve the real problem, right... BUG #2 : Multiple Gateways is lost during upgrade If u have configured multiple gateways / dual ISP in version 2.5MR9 u loose this config while doing the upgrade It´s possible to fix this manually after the upgrade, and it´s easy to do - but the result is not the same. In version 2.5 a " failover" to the other gateway/ISP was done in 20seconds on a normal config In version 2.5 a " failover" to the other gateway/SIP is done in 20seconds for NEW sessions, and 30-120seconds for OLD sessions - and as u know, it´s the OLD sessions that matter. I have a ticked ID on this case: 14297 BUG #3 : secondaryip settings are lost during upgrade If u have configured secondaryip on an interface, this is lost and must manually be fixed via CLI: BUG #4 : Lots of SNMP OID´s are missing after upgrade Actually the hole MIB is different, so u need to change all the config in your Network Managment Equipment. The problem is that the new MIB does´nt seem to be officially, also the traps have changed totally. A lots of info in the MIB/OID´s are lost, and maybe something has been added (like Network utilization) I have a ticked ID on this case: 15446 BUG #5: Some static routes are lost during upgrade, like a route to the net 128.0.0.1/24 If u have a static route to 128.0.0.0/255.255.255.255 to whatever net u loose this during upgrade. The problem while running 2.8MR3 is that u can´t add this route at all, it says " invalid ip address" . QFE: U can add 128.0.0.1/24 and then in routing monitor u can see that it says " 128.0.0.0/24" instead. I have a ticked ID on this case: 15559 BUG #6: (PDG at the forum): IPSec tunnels deleted during upgrade It just deleted IPSec tunnles (no more info, sorry) NOTEABLE #7 : The Adminpassword is reset This is not a real problem, but still a change during upgrade that the user need to attend manually. Problems while running version 2.8MR3 CAVEATS #1 and BUG#2 are a problem even running version 2.8MR3 from scratch BUG #8: (yuki at the forum): A vip and NAT problem yuki says: I have the problem about Virtual IP and NAT. The environment is as follows.(FG200) 1. A communication circuit is PPPoE of ADSL and is assigned eight IP from ISP. Assigned IP carries out as follows temporarily. 61.1.1.96/29(61.1.1.96 <-> 61.1.1.103) 2. internal 10.1.1.254/255.255.255.0 3. external 61.1.1.97/255.255.255.255(Unnumbered IP) 4. dmz 61.1.1.97/255.255.255.248(Here is one server.IP is 61.1.1.99.) 5. IP(10.2.1.100) of internal was assigned to IP(61.1.1.102) of external by Virtual IP(Static NAT). 6. IP(10.2.1.1) of internal was assigned to IP(61.1.1.100) of dmz by Virtual IP(Static NAT). Although No. 6 operates normally, No. 5 has the following problems. 1. It does not become the IP address expected by NAT.(It will be set to 61.1.1.97 although 61.1.1.102 is right.) 2. IP assigned by VIP(61.1.1.102->10.2.1.100) from the external network cannot be accessed. 2.5MR9 was carrying out operation expected in the same environment BUG #9: (JBult at the fourm): GUI Admin accounts management JBult says. If you have multiple Admin accounts set up, try to delete any of them from the 3rd one listed and downward. When I try to delete, it always returns a message asking if I would like to delete the 2nd admin account. Thankfully, it does delete the correct one. But, it' s a bug none the less. Here' s an example, if you' re confused: Admin Accounts: Admin ,JBult ,vanc ,UkWizard ,Forrest When I try to delete vanc, UkWizard, or Forrest I get a prompt asking, " Are you sure you want to delete admin user: JBult?" BUG #10: (JBult at the fourm): High Memory Usage JBult says. Abnomally High Memory Usage - I have spoken to my local Fortinet Sales Rep. about this one. He said that they are already aware of the issue so there is no need to submit a ticket. I have an FG-300 and am seeing memory usage extend well into the 70+% area during the day. If you' re thinking I may have a busy box, I have a single T1 with an average session count of about 275. BUG #11: (JBult at the fourm): Incorrect Log Rollover JBult says. Incorrect Log Rollover - I e-mailed support about this one yesterday. I haven' t heard from them yet. I have my log set to rollover every 30 days or 100MB. My Web Filter log reached 100MB and rolled over. The strange thing is, so did all the other logs. It even rolled over the logs that had no entries. BUG #12: (JBult at the fourm): Logfile discrepancy JBult says. Logfile discrepancy (Ticket No. 13753) - The file block log entries made in the Antivirus log are messed up. They are too long causing over flow into the next line of the log. BUG #13: (Optum at the forum): Policies randomly stopps functionally after a time period Optum says. Also DMZ->Internal firewall policies randomly stopped funtionning properly after 8 hours or so. When you enable and disable any policy in this group, everything starts working again. BUG #14: (Optum at the forum): Policies randomly stopps functionally after a time period Optum and JBult says. Filtering on status/sessions only filters current page. Not a big deal. BUG #15: (Trombone at the forum): URL List problems Trombone says: A. I have a web URL list of about 4800 URLs. I shoved that into the box and the Web URL blocking function no longer worked. I had to format the boot disk from the console on boot to get it working again. I found that it ultimately was because there were about 6 duplicate URLs. If the box can' t handle this I understand, but it should not allow me to upload the list then. I have since removed the duplicates . B. I entered all 4800 or so from the CLI and none of them were enabled by default. When I clicked the enable all check box in the GUI, it took about 15 min to enable all of them and the CPU sat at 50% until it was finished. I thought that was a bit excessive to use that much CPU just to enable Web URLs. What I like to see is a answer to all 15 BUG reports like this: A) This is not confirmed/known to us, and we will not fix it. B) This is known to us, and a fix is on it´s way in a near future release C) This is known to us, but it´s not going to be fixed in the near future release or ever. D) This is known to us, but we need much more information to be able to fix it. E) any other straight answer is also ok /Johan Lysén, Husera AB, Sweden, Johan.Lysen@husera.se, +46 70 6969544 Running one FG50A, two FG400 in a cluster and two FG1000 in a cluster

[skyhigh]

What I like to see is a answer to all 15 BUG reports like this:

Johan, If you are asking this question of Fortinet, then you need to open a ticket with Fortinet technical support. These forums are intended for users to ask questions of other users.

[Johan_Lysen]

Thanks for the concern. Most of these bug-reports has a ticket, and this summarized letter is sent to my Swedish contact at Fortinet, just because hi asked for it in this form.