FAC 2.2.0

[Carl_Wallmark]

When will the release notes be released ?

[Maik]

looking for the same. i' d like to get rid off my interim build.

[Maik]

what are your experience with FAC?

[Carl_Wallmark]

Overall good, But there are still room for improvements, like setting up backup connections to more than one Domain Controller. Then there is nasty bug with Tokens, after a while the FAC will loose the connection to FortiGuard servers, and this will fill the log and you cant activate tokens or change them, a reboot is required and then its good for a few more hours. They said it should be fixed in the next release, thats why I like to have a look at the release notes. Whats your experience ?

[Maik]

it does it' s job for a challenging price i already saw a lot of improvements from 2.0 to 2.1 (with 2.0 i was not able to implement some scenarios i had). 2.1 works for me, but has some bugs It does not handle special characters well: -àéöÜ etc break for example the LDAP sync. -User login fails when the first character in a password is a space. GUI Display does not show all fields in IE when accessing the box by IP or Hostname. Only with FQDN everything is displayed. with Chrome and FF all fields are visible. A design flaw: You cannot directly mix " remote" users with FAC " local" users in a group. (However there is a workaround syncing the Local user from localhost into the remote ldap group). Change management: They do not mention majorchanges in the release notes. The local LDAP Server has changed from 2.1 to my interim build that breaked the sync. (I wasn' t able to sync from localhost, I had to use the public IP afterwards, plus a BIND user (with localhost anonymous bind was possible). difficult troubleshooting: The log messages say not much about the real reason. for example: " Message Failed to sync remote users with “AD-Server” (yy.xx.zzz.abc:qqq): value too long for type character varying(25)" well, what is to long? Group Name? Number of users? User name? with the interim i have sudden reboots... well, it' s an interim :)

[Carl_Wallmark]

I see, thanks for sharing. I also noticed that usernames are case-sensitives :(

[Carl_Windsor_FTNT]

The release notes are ready, I am looking into why they were not uploaded to the support site with the release. In the mean time.... The following is a list of enhancements in FortiAuthenticator v2.0 MR2: • Remote user authentication for MSCHAP2 PEAP in Active Directory environments Support wireless user authentication via PEAP using MSCHAP2 when the user is a remote (LDAP) user account. FortiAuthenticator is now able to bind to the AD domain in order to validate the MSCHAP2 password hash. • Import tokens from FortiGate configuration Once activated, the FortiToken seed is removed from the FortiGuard Database. In order to simplify migration from FortiGate installations, FortiAuthenticator can import the FortiToken serial number and seed information from a FortiGate configuration backup. • Export configuration data Export user details to a CSV file for import into a second FortiAuthenticator system. • Adjust token drifts for time change New feature to simplify recovery following an out of scope system time change. For example, when the system and tokens have been initialized prior to setting the NTP server. • Strip realm information from the RADIUS account Added the ability to remove realm information from RADIUS accounting packets. • Remote LDAP admin authentication Added remote LDAP user support for FortiAuthenticator administration. • Manual FSSO users logout Enable users to be manually de-authenticated via Monitor > SSO > SSO Users. The issues resolved in this release includes (but is not limited to): 191806 LDAP user synchronization repeats on each attempt when the DN contains non-ascii characters. 196094 Administrative users can edit/disable super_admin user accounts regardless of the admin level. 196728 Authenticating users in Active Directory via DN breaks on OU change. 199427, 199069 Issues importing and synchronizing users if the user DN contains extended character sets. 202036, 202167 Socket error triggers an unable to resolve server domain name: directregistration.fortinet.com error log yet DNS functions correctly. 203662 Username is not included in the raw log download. 167779 Case sensitive usernames

[Carl_Wallmark]

Thank you Carl !

[Maik]

Thank you Carl. thinking about Carl' s response, I become aware that also the Fortinet TAC was very responsive to our requests. we got the interim in a very short time. the FAC seems to have some priorities inside Fortinet. (or they already knew about the bug and were coding earlier :)) another point from the release notes catched my attention: Remote user authentication for MSCHAP2 PEAP in Active Directory environments Support wireless user authentication via PEAP using MSCHAP2 when the user is a remote (LDAP) user account. FortiAuthenticator is now able to bind to the AD domain in order to validate the MSCHAP2 password hash. -> i was trying to 802.1x authenticate WLAN clients against AD. this might be a missing piece: my problem was that I' ve been able to authenticate " user" accounts before, but not " computer" accounts.

[Carl_Wallmark]

I just upgraded from 2.0.0 to 2.2.0 and the upgrade went smooth, however after a few minutes I received this in the log, any importance ? 82556 Fri Apr 26 12:15:07 2013 error Event System 30906 Failed to send registration update (code = -11) 82555 Fri Apr 26 12:15:07 2013 error Event System 30907 FGD SMS: unable to connect to server