Najnowsza aktualizacja dla oprogramowania FortiOS w wersji 6.4.15 jest już dostępna a w niej poprawki dotyczące jakości oraz bezpieczeństwa. Ponadto producent wraz z wprowadzeniem nowej aktualizacji rozwiązuje problem z portami SFP+ które podłączone do przełącznika usuwały konfigurację portów 10 Gigabit. Sytuacja dotyczyła FG-40xF, FG-60xF, FG-300xF. Więcej szczegółów o aktualizacji można znaleźć w artykule poniżej.
Aktualnie wspierane modele:
| FortiGate | FG-40F, FG-40F-3G4G, FG-60E, FG-60E-DSL, FG-60E-DSLJ, FG-60E-POE, FG-60F, FG-61E, FG-61F, FG-80E, FG-80E-POE, FG-80F, FG-80F-BP, FG-80F-POE, FG-81E, FG-81E-POE, FG-81F, FG-81F-POE, FG-90E, FG-91E, FG-100E, FG-100EF, FG-100F, FG-101E, FG-101F, FG-140E, FG-140E-POE, FG-200E, FG-200F, FG-201E, FG-201F, FG‑300D, FG-300E, FG-301E, FG‑400D, FG‑400E, FG-400E-BP, FG‑401E, FG‑500D, FG‑500E, FG-501E, FG-600D, FG-600E, FG-601E, FG-800D, FG‑900D, FG-1000D, FG-1100E, FG-1101E, FG‑1200D, FG-1500D, FG-1500DT, FG-1800F, FG-1801F, FG-2000E, FG-2200E, FG-2201E, FG-2500E, FG-2600F, FG-2601F, FG-3000D, FG-3100D, FG‑3200D, FG-3300E, FG-3301E, FG-3400E, FG-3401E, FG-3600E, FG-3601E, FG-3700D, FG-3800D, FG‑3810D, FG-3815D, FG-5001D, FG-3960E, FG‑3980E, FG-4200F, FG-4201F, FG-4400F, FG-4401F, FG-5001E, FG‑5001E1 |
| FortiWiFi | FWF-40F, FWF-40F-3G4G, FWF-60E, FWF-60E-DSL, FWF-60E-DSLJ, FWF-60F, FWF-61E, FWF-61F, FWF-80F-2R, FWF-81F-2R, FWF-81F-2R-POE, FWF-81F-2R-3G4G-POE |
| FortiGate Rugged | FGR-60F, FGR-60F-3G4G |
| FortiGate VM | FG-SVM, FG-VM64, FG-VM64-ALI, FG-VM64-ALIONDEMAND, FG-VM64-AWS, FG-VM64-AZURE, FG‑VM64‑GCP, FG‑VM64-GCPONDEMAND, FG-VM64-HV, FG-VM64-IBM, FG‑VM64-KVM, FG‑VM64‑OPC, FG‑VM64-RAXONDEMAND, FG-VMX, FG-VM64-XEN |
| FortiFirewall | FFW-3980E, FFW-4200F, FFW-4400F, FFW-VM64, FFW-VM64-KVM |
| Pay-as-you-go images | FOS-VM64, FOS-VM64-HV, FOS-VM64-KVM, FOS-VM64-XEN |
Rozwiązane problemy:
System
| Bug ID | Description |
|---|---|
| 858633 | When any 10 Gigabit (SFP+) port is connected a switch, all configurations related to the 10 Gigabit ports is removed (trunks) when traffic is flowing upon boot. Affected platforms: FG-40xF, FG-60xF, FG-300xF. |
Anti Spam
| Bug ID | Description |
|---|---|
| 877613 | Mark as Reject can be still chosen as an Action in an Anti-Spam Block/Allow List in the GUI. |
Firewall
| Bug ID | Description |
|---|---|
| 719311 | On the Policy & Objects > Firewall Policy page in 6.4.0 onwards, the IPv4 and IPv6 policy tables are combined but the custom section name (global label) is not automatically checked for duplicates. If there is a duplicate custom section name, the policy list may show empty for that section. This is a display issue only and does not impact policy traffic.
Workaround: rename the custom section to unique name between IPv4 and IPv6 policies. |
| 770541 | Within the Policy & Objects menu, the firewall, DoS, and traffic shaping policy pages take around five seconds to load when the FortiGate cannot reach the FortiGuard DNS servers.
Workaround: set the DNS server to the FortiGuard DNS server. |
| 843554 | If the first firewall service object in the service list (based on the order in the command line table) has a protocol type of IP, the GUI may incorrectly modify its protocol number whenever a new firewall service of the same protocol type IP is created in the GUI.
This silent misconfiguration can result in unexpected behavior of firewall policies that use the impacted service. For example, some 6K and 7K platforms have firewall service ALL (protocol type IP) as the first service, and this can cause the ALL service to be modified unexpectedly. Workaround: create a new service in the CLI, or move a non-IP type services to the top of the firewall service list. For example, if config firewall service custom
edit "unused"
set tcp-portrange 1
next
move "unused" before "ALL"
end
|
FortiView
| Bug ID | Description |
|---|---|
| 683654 | FortiView pages with FortiAnalyzer source incorrectly display a Failed to retrieve data error on all VDOM views when there is a newly created VDOM that is not yet registered to FortiAnalyzer. The error should only show on the new VDOM view. |
GUI
| Bug ID | Description |
|---|---|
| 440197 | On the System > FortiGuard page, the override FortiGuard server for AntiVirus & IPS Updates shows an Unknown status, even if the server is working correctly. This is a display issue only; the override feature is working properly. |
| 602397 | Managed FortiSwitch and FortiSwitch Ports pages are slow to load when there are many managed FortiSwitches. |
| 653952 | The web page cannot be found is displayed when a dashboard ID no longer exists.
Workaround: load another page in the navigation pane. Once loaded, load the original dashboard page (that displayed the error) again. |
| 688016 | GUI interface bandwidth widget does not show correct data for tunnel interface when ASIC offload is enabled on the firewall policy. |
| 695163 | When there are a lot of historical logs from FortiAnalyzer, the FortiGate GUI Forward Traffic log page can take time to load if there is no specific filter for the time range.
Workaround: provide a specific time range filter, or use the FortiAnalyzer GUI to view the logs. |
| 743477 | On the Log & Report > Forward Traffic page, filtering by the Source or Destination column with negation on the IP range does not work. |
HA
| Bug ID | Description |
|---|---|
| 771999 | Sessions not synchronized to HA secondary on an FGSP and FGCP combined setup. |
| 779180 | FGSP does not synchronize the helper-pmap expectation session. |
| 917159 | HA cluster upgrade fails for primary unit but works for the secondary unit if upgrading from FortiOS 6.4.11 and earlier. Affected platforms: FG-601F only.
Workaround: disable uninterruptable upgrades, or break the cluster and upgrade the devices separately. |
Hyperscale
| Bug ID | Description |
|---|---|
| 734305 | In the GUI, an FQDN or ISDB can be selected for a DoS policy, which is not supported (an error message appears). The CLI shows the correct options. |
| 760560 | The timestamp on the hyperscale SPU of a deny policy (policy id 0) is incorrect. |
| 796368 | Traffic shaping profile does not seem to have an effect on TCP/UDP traffic in hyperscale. |
| 802369 | Large client IP range makes fixed allocation usage relatively limited. |
Intrusion Prevention
| Bug ID | Description |
|---|---|
| 763736 | IPS custom signature logging shows (even after being disabled) after upgrading to FortiOS 6.4.7. |
Log & Report
| Bug ID | Description |
|---|---|
| 850642 | Logs are not seen for traffic passing through the firewall caused by numerous simultaneous configuration changes. |
| 860822 | When viewing logs on the Log & Report > System Events page, filtering by domain\username does not display matching entries.
Workaround: use a double backslash (domain\\username) while filtering or searching by username only without the domain. |
Proxy
| Bug ID | Description |
|---|---|
| 604681 | WAD process with SoC SSL acceleration enabled consumes more memory usage over time, which may lead to conserve mode.
Workaround: disable SoC SSL acceleration under the firewall SSL settings. |
REST API
| Bug ID | Description |
|---|---|
| 759675 | Connection failed error occurs on FortiGate when an interface is created and updated using the API in quick succession. |
Routing
| Bug ID | Description |
|---|---|
| 924940 | When there are a lot of policies (several thousands), the interface member selection for the SD-WAN Zone dialog may take up to a minute to load.
Workaround: use the CLI to configure the SD-WAN zone. |
Security Fabric
| Bug ID | Description |
|---|---|
| 614691 | Slow GUI performance in large Fabric topology with over 50 downstream devices. |
SSL VPN
| Bug ID | Description |
|---|---|
| 710657 | The dstaddr/dstaddr6 of an SSL VPN policy can be set to all when split tunnel mode is enabled and only the default portal is set. |
| 730416 | Forward traffic log does not generate logs for HTTP and HTTPS services with SSL VPN web mode. |
Switch Controller
| Bug ID | Description |
|---|---|
| 925130 | If the FortiGate manages a FortiSwitch with a FortiSwitch port exported to a tenant VDOM, the Status dashboard on the tenant VDOM cannot load due to an issue with the Security Fabric widget. The loading issue may also impact the loading of subsequent pages.
Workaround: remove the Security Fabric widget in the tenant VDOM’s Status dashboard. |
System
| Bug ID | Description |
|---|---|
| 555616 | When NTurbo is enabled, it is unexpectedly provided with the wrong traffic direction information (from server or from client) to decide the destination for the data. This causes the traffic to be sent back to the port where it came from. |
| 602141 | The extender daemon crashes on Low Encryption (LENC) FortiGates. |
| 648085 | Link status on peer device is not down when the admin port is down on the FG-500. |
| 664856 | A VWP named .. can be created in the GUI, but it cannot be edited or deleted. |
| 666664 | Interface belonging to other VDOMs should be removed from interface list when configuring a GENEVE interface. |
| 669645 | VXLAN VNI interface cannot be used with a hardware switch. |
| 685674 | FortiGate did not restart after restoring the backup configuration via FortiManager after the following process: disable NPU offloading, change NGFW mode from profile-based to policy-based, retrieve configuration from FortiGate via FortiManager, and install the policy package via FortiManager. |
| 724085 | Traffic passing through an EMAC-VLAN interface when the parent interface is in another VDOM is blocked if NP7 offloading is enabled.
Workaround: set the |
| 751715 | Random LTE modem disconnections due to certain carriers getting unstable due to WWAN modem USB speed under super-speed. |
| 879769 | If the firewall session is in check-new mode, FortiOS will not flush its NPU offload entry when there is a MAC address update of its gateway. |
| 904486 | The FortiGate may display a false alarm message and subsequently initiate a reboot. |
| 923364 | System goes into halt state with Error: Package validation failed... message in cases where there are no engine files in the FortiGate when the BIOS security level is set to 2.
Workaround: set the BIOS security level to 0 or 1. |
| 931299 | When the URL filter requests the FortiGuard (FGD) rating server address using DNS, it will try to get both A (IPv4) and AAAA (IPv6) records. |
Upgrade
| Bug ID | Description |
|---|---|
| 767808 | The asicdos option for enabling/disabling NP6XLite DoS offloading is missing after upgrading to 6.4.9. Affected platforms: NP6XLite. |
| 840921 | When upgrading from 6.0.15 to 6.4.11, an existing explicit flow-based web filter profile changes to proxy-based. |
| 903113 | Upgrading FortiOS firmware with a local file from 6.2.13, 6.4.12, 7.0.11, or 7.2.4 and earlier may fail for certain models because the image file size exceeds the upload limit. Affected models: FortiGate 6000 and 7000 series, FWF-80F-2R, and FWF-81F-2R-POE.
Workaround: upgrade the firmware using FortiGuard, or manually increase the HTTP request size limit to 200 MB. config system global
set http-request-limit 200000000
end
|
User & Authentication
| Bug ID | Description |
|---|---|
| 778521 | SCEP fails to renew if the local certificate name length is between 31 and 35 characters. |
| 823884 | When a search is performed on a user (User & Authentication > User Definition page), the search results highlight all the groups the user belongs to. |
| 920157 | When using Guest Management and creating a new guest user where the User ID is set to Specify, the GUI does not allow administrators to configure the User ID.
Workaround: use the Email or Auto Generated User ID type for guest accounts, or generate a specific user ID in the CLI. # diagnose test guest add <guest_group> <user_id> <username> <password> <company> <expiry_time_in_seconds> |
VM
| Bug ID | Description |
|---|---|
| 596742 | Azure SDN connector replicates configuration from primary device to secondary device during configuration restore. |
| 617046 | FG-VMX manager not showing all the nodes deployed. |
| 639258 | Autoscale GCP health check is not successful (port 8443 HTTPS). |
| 668625 | During every FortiGuard UTM update, there is high CPU usage because only one vCPU is available. |
| 764392 | Incorrect VMDK file size in the OVF file for hw13 and hw15.
Workaround: manually correct the hw13 and hw15 OVF file’s |
WiFi Controller
| Bug ID | Description |
|---|---|
| 662714 | The security-redirect-url setting is missing when the portal-type is auth-mac. |
Notatki producenta: FortiOS 6.4.15
Pozdrawiamy,
Zespół B&B
Bezpieczeństwo w biznesie