Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
emnoc
Esteemed Contributor III

v6.0 is here

I hope it 's  all good  ;)

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
3 Solutions
romanr
Valued Contributor

Andy Bailey wrote:

I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).

Hey,

 

I don't have that problem - works fine for me since Beta 3.

 

Can you run the following on a Command Line, while you try to modify a policy:

 

diag deb reset

diag deb ena

diag deb cli 8

 

... and post the output

 

Br,

Roman

View solution in original post

Jordan_Thompson_FTNT

romanr wrote:

Andy Bailey wrote:

I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).

 

Can you run the following on a Command Line, while you try to modify a policy:

 

diag deb reset

diag deb ena

diag deb cli 8

 

... and post the output

 

In addition, please enable "diag debug app httpsd -1" and include that output.

View solution in original post

thuynh_FTNT

Andy Bailey wrote:

I've attached the output your requested Roman and Jordan. Thanks for your help.

 

Nothing really obvious for me. I tried opening the policy and then clicking ok (no changes) and again (no changes) same result both times. I tried Edge instread of Firefox too- no changes there either.

 

The key lines seem to be:-

 

[httpsd 9510 - 1522869450    error] cmdb_commit_from_json[1426] -- error saving request object to CLI (-651) [httpsd 9510 - 1522869450    error] _api_cmdb_v2_config[1137] -- error editing object (nret=-651) [httpsd 9510 - 1522869450    error] api_return_http_result[516] -- API error -651 raised

Interestingly I can delete policies- I just tried deleting a couple of unused policies and that worked fine (highlighted from the "IPv4 Policy" list and then just delete.

 

Any other ideas?

Hi Andy, we've tried with several FGTs and were unable to reproduce your issue. Looks like it's specific to your config after upgrade. From your CLI debug output, the CLI is rejecting the change (any policy edit save) from the GUI.

0: config firewall policy 0: edit 15 0: set ssl-ssh-profile "SSL Certs-Block Untrusted\\Invalid" -651: end

 

Here are a few other things to try:

1. Can you use the CLI to edit a policy? You can use the above commands to see further error reported by the CLI

2. Can you use the GUI to create new Policy? if not, please also include CLI and httpsd debug message

3. Does this happen to any policy edit via the GUI? 4. Can you check if your interfaces are correctly upgraded?

5. Which FGT model are you using? if possible, can you share your full config with us? you can email me the config at thuynh@fortinet.com

 

Tri

View solution in original post

60 REPLIES 60
tanr

Anybody using IPsec VPNs on 6.0.0 yet? 

 

 

Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.

emnoc
Esteemed Contributor III

I have one static ipsec, no difference or any thing to report. I haven't crafted any thing new or any dynamic ipsec/sslvpn as of yet.

 

Ken

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Baptiste
Contributor II

tanr wrote:

Anybody using IPsec VPNs on 6.0.0 yet? 

 

 

Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.

Hi, 

Upgrade a 60E from 5.6.0->5.6.2->6.00, no issue when I check from cli (diagnose debug config-error-log read).

1 static Ipsec Tunnel, working fine before and after upgrade.

 

2 FGT 100D  + FTK200

3 FGT 60E  FAZ VM  some FAP 210B/221C/223C/321C/421E

2 FGT 100D + FTK200 3 FGT 60E FAZ VM some FAP 210B/221C/223C/321C/421E
ladeth
New Contributor II

tanr wrote:

Anybody using IPsec VPNs on 6.0.0 yet? 

 

 

Would appreciate hearing how both static and dial-up are working, if you had any issues upgrading, and from which version you upgraded.

Hi,

 

upgraded my configuration, hardware and firmware from FG110C Cluster 5.2.3 to FG60E Cluster 6.0.0 with at least 80 IPSEC VPN configured and no issue detected after the upgrade, all is working fine.

 

Regards.

FCNSP V.4, V.5

FCNSP V.4, V.5
Fullmoon

accidentally put space in between my FSSO name. Now if I edit it new FSSO name is prompted.

Fortigate Newbie

Fortigate Newbie
SEI
New Contributor II

8th of April we upgraded 1200D HA a-a and 2x 500E 1x600D (Security Fabric: 500E&600D Upstream to 1200D) from 5.6.3 to 6.0.0 and all seamed to working great.

Tested SSLVPNs (LDAP) with RDP and several other bookmarks and tunnel mode; VLANs,  dialupVPNs, DHCP sever, OSPF and DNS server ,..., FortiAnalyzer ,...,  and all seamed working fine.

Remark: We have 15VLAN and Aggregated 10GBit/s connecting to the Backbone to Monitor Traffic internally and to the Internet - so all traffic is "passing" the Cluster)

 

These Problems gradually came up and we have been forced to downgrade the 1200D HA (NOT 500E !) back to 5.6.3 on 29th of April and all working fine again.

1. 30 Users out of 70 could not authenticate anymore to SSLVPN

2. Outlook disconnected sporadically, sometimes it was possible to start Outlook in safe mode to get access to eMail

3. Connection(s) to Database-Server(s) dropped

4. UPS's "created" additional problems to the environment due to dropped connections

5. VoIP Servers "started" to continuously drop connection from Internet; even became inaccessible (VirtualIP)

6. FortiAP-Profiles for AP421E and AP221E had to be deleted and new profiles needed to be created ...

7. ... and finally accessing the Internet with Internet-Browser's started to fail (blank pages, frozen PC's,...)

 

After 2 weeks of deep investigation, however, nothing was really pointing to the FireWalls as the source of the problems ... finally we found the FGT1200D is actively closing connections!

 

It does not happen with "E" models (61E, 500E tested and still in Production with 6.0.0)!

 

As I mentioned, downgrade to 5.6.3 was the solution.

 

 

 

sam91
New Contributor

Found a problem with eBGP over inter-vdom links. Anyone else having trouble with it?

Neighborship isn't getting formed, state is "idle" and it says "Not directly connecte EBGP".

Although ping is working between the vdoms.

Same config as in 5.6, just updated it.

emnoc
Esteemed Contributor III

sam91 wrote:

Found a problem with eBGP over inter-vdom links. Anyone else having trouble with it?

Neighborship isn't getting formed, state is "idle" and it says "Not directly connecte EBGP".

Although ping is working between the vdoms.

Same config as in 5.6, just updated it.

Did you restart the BGP router process and what do you see if anything on  diag sniffer packet  any "port 179"

?

I would run two   ssh session and  restart the router process while running a packet capture and see if  you get any syn/syn-ack from the  ebgp peers.

 

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
sam91
New Contributor

emnoc wrote:

Did you restart the BGP router process and what do you see if anything on  diag sniffer packet  any "port 179"

?

I would run two   ssh session and  restart the router process while running a packet capture and see if  you get any syn/syn-ack from the  ebgp peers.

Just tried it but I can't see any packets :(

The get router info bgp neighbor command also shows that no messages have been sent out:

VDOM 1

 

BGP neighbor is 169.254.255.5, remote AS 65101, local AS 65100, external link
  BGP version 4, remote router ID 0.0.0.0
  BGP state = Idle
  Not directly connected EBGP
  Last read , hold time is 6, keepalive interval is 60 seconds
  Configured hold time is 6, keepalive interval is 2 seconds
  Received 0 messages, 0 notifications, 0 in queue
  Sent 0 messages, 0 notifications, 0 in queue
  Route refresh request: received 0, sent 0
  Minimum time between advertisement runs is 10 seconds

VDOM root

BGP neighbor is 169.254.255.6, remote AS 65100, local AS 65101, external link
  BGP version 4, remote router ID 0.0.0.0
  BGP state = Idle
  Not directly connected EBGP
  Last read , hold time is 180, keepalive interval is 60 seconds
  Configured hold time is 6, keepalive interval is 2 seconds
  Received 0 messages, 0 notifications, 0 in queue
  Sent 0 messages, 0 notifications, 0 in queue
  Route refresh request: received 0, sent 0
  Minimum time between advertisement runs is 10 seconds

Btw: eBGP with another FG via VPN works fine.

emnoc
Esteemed Contributor III

 CLI commands

 

 diag ip route bgp all

 diag debug en

PCNSE 

NSE 

StrongSwan  

PCNSE NSE StrongSwan
Announcements

Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Labels
Top Kudoed Authors