v6.0 is here

[emnoc]

I hope it 's  all good  ;)

[romanr · Accepted solution]

Andy Bailey wrote:

I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).

Hey,

I don't have that problem - works fine for me since Beta 3.

Can you run the following on a Command Line, while you try to modify a policy:

diag deb reset

diag deb ena

diag deb cli 8

... and post the output

Br,

Roman

[Jordan_Thompson_FTNT · Accepted solution]

romanr wrote:

Andy Bailey wrote:

I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).

Can you run the following on a Command Line, while you try to modify a policy:

diag deb reset

diag deb ena

diag deb cli 8

... and post the output

In addition, please enable "diag debug app httpsd -1" and include that output.

[tanr]

Anybody using IPsec VPNs on 6.0.0 yet? 

Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.

[emnoc]

I have one static ipsec, no difference or any thing to report. I haven't crafted any thing new or any dynamic ipsec/sslvpn as of yet.

Ken

[Baptiste]

tanr wrote:

Anybody using IPsec VPNs on 6.0.0 yet? 

Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.

Hi, 

Upgrade a 60E from 5.6.0->5.6.2->6.00, no issue when I check from cli (diagnose debug config-error-log read).

1 static Ipsec Tunnel, working fine before and after upgrade.

[ladeth]

tanr wrote:

Anybody using IPsec VPNs on 6.0.0 yet? 

Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.

Hi,

upgraded my configuration, hardware and firmware from FG110C Cluster 5.2.3 to FG60E Cluster 6.0.0 with at least 80 IPSEC VPN configured and no issue detected after the upgrade, all is working fine.

Regards.

[Fullmoon]

accidentally put space in between my FSSO name. Now if I edit it new FSSO name is prompted.

[SEI]

8th of April we upgraded 1200D HA a-a and 2x 500E 1x600D (Security Fabric: 500E&600D Upstream to 1200D) from 5.6.3 to 6.0.0 and all seamed to working great.

Tested SSLVPNs (LDAP) with RDP and several other bookmarks and tunnel mode; VLANs,  dialupVPNs, DHCP sever, OSPF and DNS server ,..., FortiAnalyzer ,...,  and all seamed working fine.

Remark: We have 15VLAN and Aggregated 10GBit/s connecting to the Backbone to Monitor Traffic internally and to the Internet - so all traffic is "passing" the Cluster)

These Problems gradually came up and we have been forced to downgrade the 1200D HA (NOT 500E !) back to 5.6.3 on 29th of April and all working fine again.

1. 30 Users out of 70 could not authenticate anymore to SSLVPN

2. Outlook disconnected sporadically, sometimes it was possible to start Outlook in safe mode to get access to eMail

3. Connection(s) to Database-Server(s) dropped

4. UPS's "created" additional problems to the environment due to dropped connections

5. VoIP Servers "started" to continuously drop connection from Internet; even became inaccessible (VirtualIP)

6. FortiAP-Profiles for AP421E and AP221E had to be deleted and new profiles needed to be created ...

7. ... and finally accessing the Internet with Internet-Browser's started to fail (blank pages, frozen PC's,...)

After 2 weeks of deep investigation, however, nothing was really pointing to the FireWalls as the source of the problems ... finally we found the FGT1200D is actively closing connections!

It does not happen with "E" models (61E, 500E tested and still in Production with 6.0.0)!

As I mentioned, downgrade to 5.6.3 was the solution.

[sam91]

Found a problem with eBGP over inter-vdom links. Anyone else having trouble with it?

Neighborship isn't getting formed, state is "idle" and it says "Not directly connecte EBGP".

Although ping is working between the vdoms.

Same config as in 5.6, just updated it.

[emnoc]

sam91 wrote:

Found a problem with eBGP over inter-vdom links. Anyone else having trouble with it?

Neighborship isn't getting formed, state is "idle" and it says "Not directly connecte EBGP".

Although ping is working between the vdoms.

Same config as in 5.6, just updated it.

Did you restart the BGP router process and what do you see if anything on  diag sniffer packet  any "port 179"

?

I would run two   ssh session and  restart the router process while running a packet capture and see if  you get any syn/syn-ack from the  ebgp peers.

[sam91]

emnoc wrote:

Did you restart the BGP router process and what do you see if anything on  diag sniffer packet  any "port 179"

?

I would run two   ssh session and  restart the router process while running a packet capture and see if  you get any syn/syn-ack from the  ebgp peers.

Just tried it but I can't see any packets :(

The get router info bgp neighbor command also shows that no messages have been sent out:

VDOM 1

BGP neighbor is 169.254.255.5, remote AS 65101, local AS 65100, external link
  BGP version 4, remote router ID 0.0.0.0
  BGP state = Idle
  Not directly connected EBGP
  Last read , hold time is 6, keepalive interval is 60 seconds
  Configured hold time is 6, keepalive interval is 2 seconds
  Received 0 messages, 0 notifications, 0 in queue
  Sent 0 messages, 0 notifications, 0 in queue
  Route refresh request: received 0, sent 0
  Minimum time between advertisement runs is 10 seconds

VDOM root

BGP neighbor is 169.254.255.6, remote AS 65100, local AS 65101, external link
  BGP version 4, remote router ID 0.0.0.0
  BGP state = Idle
  Not directly connected EBGP
  Last read , hold time is 180, keepalive interval is 60 seconds
  Configured hold time is 6, keepalive interval is 2 seconds
  Received 0 messages, 0 notifications, 0 in queue
  Sent 0 messages, 0 notifications, 0 in queue
  Route refresh request: received 0, sent 0
  Minimum time between advertisement runs is 10 seconds

Btw: eBGP with another FG via VPN works fine.

[emnoc]

 CLI commands

 diag ip route bgp all

 diag debug en