v7.0.7 FIPS-CC Problems

[JayW]

Has anyone had any luck upgrading from 6.2.7 FIPS to 6.4.9 FIPS to 7.0.7 FIPS?

I have 2 500E. They are both upgraded from 6.2.7 FIPS to 6.4.9 FIPS but after the upgrade to 7.0.7 FIPS the CPU is 100% consumed.  Not enough CPU to connect to the internet or route internal packets. We end up rebooting and starting up the backup config.

I have an open ticket with Fortinet but so far they have proved to be useless.  They have tried upgrading and downgrading the ipsengine when we can get to the Fortiguard page but no changes to CPU.  

[gfleming]

This is an interesting one. You cannot follow the upgrade path because not all versions have a FIPS-CC image available.

I wonder if part of the issue here is not being able to do the upgrade path.

6.2.7	1190
6.4.6	1879
6.4.8	1914
6.4.10	2000
6.4.12	2060
7.0.7	0450

Can you feasibly load a non-FIPS-CC image to do the upgrade path and then convert to FIPS-CC for 7.0.7 last step?

It not perhaps talking to TAC would be best option here....

[JayW]

We have an open ticket with them.  Do I need to post the case number? While working on the issue with them Tuesday night we attempted the upgrade for a 4th or 5th time. The tech shift was over so he ended the call. I have come to the conclusion that TAC has no clue when it comes to FIPS. 

we are currently on 6.4.9 FIPS and it is running great. 

I have been given permission to POAM out the FIPS on the firewall. So I am thinking of factory default and upgrading to 7.0.11 and importing my config but am concerned the FIPS config will not convert. I would hate to have to redo hundreds of policies. 

[JayW]

I forgot to mention that we originally had the problem following the post upgrade path.  We thought the non-FIPS version was the issue so we went back to 6.2.7 FIPS and upgraded through FIPS only and ended up the same. 

[gfleming]

No point posting the case number here. If you need help with TAC you can try escalating through your account team.

I have never used FIPSS firmware or settings so I can't help you much more. Sorry!