v6.0 is here

[emnoc]

I hope it 's  all good  ;)

[romanr · Accepted solution]

Andy Bailey wrote:

I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).

Hey,

I don't have that problem - works fine for me since Beta 3.

Can you run the following on a Command Line, while you try to modify a policy:

diag deb reset

diag deb ena

diag deb cli 8

... and post the output

Br,

Roman

[Jordan_Thompson_FTNT · Accepted solution]

romanr wrote:

Andy Bailey wrote:

I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).

Can you run the following on a Command Line, while you try to modify a policy:

diag deb reset

diag deb ena

diag deb cli 8

... and post the output

In addition, please enable "diag debug app httpsd -1" and include that output.

[kurtli_FTNT]

Hi Stephane,

    The proxy mode works well on my ENV. What is exact version of v6?

[SMabille]

Hi,

FortiGate-60E v6.0.0,build0076,180329 (GA)

help.netlfix.com appeared as if it was wrongly categorised on Fortiguard, at least on the cached data.

Tried to add it to web rating override without luck. I didn't had the time to troubleshoot further, such as attempting to flush cache... so the override might just not invalidate the cache?

If needed I could do some more testing and open a ticket if needed.

kurtli_FTNT wrote:

Hi Stephane,

    The proxy mode works well on my ENV. What is exact version of v6?

[kurtli_FTNT]

Thanks. I will reproduce in lab with the same version and target, will go back to you later.

[kurtli_FTNT]

Hi Stephane,

   So first, I suppose there is a typo in your post, 'netlfix' vs 'netflix'. No website is taking response for "help.netlfix.com". Thus, the category for that is 'General Interest - Business'. If correct it with 'help.netflix.com', then the category becomes to 'Bandwidth Consuming' and sub-cate is 'streaming media and download', which makes sense. 

   And the rating override works well against 'help.netflix.com' on proxy-mode. I override it to 'gambling' and can see it's blocked.

1: date=2018-04-19 time=16:19:08 logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="root" eventtime=1524179948 policyid=4 sessionid=1897 srcip=10.1.100.211 srcport=57073 srcintf="port5" srcintfrole="undefined" dstip=52.38.152.174 dstport=80 dstintf="port12" dstintfrole="undefined" proto=6 service="HTTP" hostname="help.netflix.com" profile="k" action="blocked" reqtype="direct" url="/" sentbyte=80 rcvdbyte=0 direction="outgoing" msg="URL belongs to a denied category in policy" method="domain" cat=11 catdesc="Gambling" crscore=30 crlevel="high"

    We do have a known issue on flow-mode and it will be fixed on the next release. 

Thanks

[emnoc]

The LDAP diag test auth ldap is working from cli-cmd but fails via the  WebGui  FortiOS v6.0

Who all here is seeing the same issues?

Ken

[fshuva_FTNT]

Hello Ken,

Can you please share some more configuration details ? 

Also when you do the test from GUI can you enable HTTPS debug.

To obtain debug: 

1. Open Command Line Interface for FortiGate

2. Type in 

diagnose debug enable

diagnose application httpsd -1 

3. Conduct Test from GUI and copy the debug information 

Thanks !

Farazi 

emnoc wrote:

The LDAP diag test auth ldap is working from cli-cmd but fails via the  WebGui  FortiOS v6.0

Who all here is seeing the same issues?

Ken

[emnoc]

Confirmed SANs cert with 8k bit key does NOT working for the admin-server for the FortiOS. It was tried into 2  FGTs btw

[Accionet]

Hello all.

We have upgraded same Fortigates to 6.0 FortiOS and users fail to login when use LDAP. Radius authentication with windows NPS work fine and we have configured as alternative.

If I create a new user in Active Directory works fine with LDAP authentication, but existing users fail to login.

Is there any solution to this issue?

Thank you in advance.

[emnoc]

Accionet 

Did you do any diag from the cli for test authentication and with LDAP? Since you said new users, I expect something is wrong from the AD side of things.

Start with  basic level diagnostics

    diag test authserver  ldap     diag test authserver  ldap-search   I'm on JumpCloud and have no users auth with LDAPS and v6.0 fwiw ken 

[Accionet]

Hello emnoc.

diag test authserver  ldap 

authenticate 'old_user' against 'LDAP_xxxx' succeeded!

Do not show groups, but 

authenticate 'new_user' against 'LDAP_xxxx' succeeded!

Group membership(s) - CN=Mobile Users,OU=Security Groups,OU=MyBusiness,DC=xxxxxxx,DC=local

CN=Usuarios Terminal Server,CN=Users,DC=xxxxxxx,DC=local CN=Remote Web Workplace Users,OU=Security Groups,OU=MyBusiness,DC=xxxxxxx,DC=local CN=GRUPOADMINISTRACION,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=xxxxxxx,DC=local CN=AccesoSSLVPN,OU=SBSUsers,OU=Users,OU=MyBusiness,DC=xxxxxxx,DC=local CN=Usuarios del dominio,CN=Users,DC=xxxxxxx,DC=local

Show all grups for this user.

It seems a problemm with permissions in AD. But in 5.6.3 work fine.

Thanks.