Help Blok because of virus

[sarif]

I have fortigate 310B with OS 5.07, before i upgrade the OS, everything is fine, but after i upgrade OS from 4.3.11 to 5.0.7, the error is appear when i open my webmail in internet, the message is : block because of virus. anyone can help me?

[ShrewLWD]

Hi Sarif, Well, right off the bat, that is not a recommended or supported upgrade path. See here... http://docs-legacy.fortinet.com/fgt/FortiOS-Upgradepath.pdf As for why, your logs should give a little more granularity as to what virus it thinks it is seeing. Please read Andrea' s post on setting/verifying logging here... https://forum.fortinet.com/FindPost/106095

[sarif]

Hi ShrewLWD Thank you for reply...i have turn off antivirus in fortigate unit, but the error still run. anyone can help me please ?

[AndreaSoliva]

Hi I think you did not 100% understand: - If you do not follow the Upgrade Path as mentioned in befor meaning upgrading from 4.3.11 to 5.0.7 your config is " CORRUPT" . This upgrade is not valid...not correct. Roll back to 4.3.11 and upgrade as the Upgrade Path is mentioning etc. After that it makes -if the error still happens- to troubleshoot. Before it does not make sense (specially for me). Hope this helps. have fun Andrea

[ShrewLWD]

Worse, it' s possible the system has formatted the system differently now. Also, by default, the system won' t allow you to downgrade. There is a CLi option to allow downgrades, however. The 310B should also allow dual images/partitions, so check and see if 4.3.11 is still there. If you have any kind of direct access to the box, it may be best for you to interrupt the boot sequence, format the system, and TFTP the firmware, to guarantee a clean process. If you do decide to do it this way, you would not need to start with 4.3.11, start with 4.3.15, load up your config file, then migrate to 5.0.7.

[sarif]

Thank you for reply..i have followed the upgrade path...any one have same problem? but the problem still occured

[AndreaSoliva]

Hi ok so far the config should be back and save! What you have now to deliver to investigate further is following: - Please deliver printscreen or exact message what is shown on the page and to which URL you try to login (Where is the server outside/inside world). - Next if this issue occurs please deliver the log entry for the FGT meanign within Antivirus as within Traffic Log - Next within this log you will recognize a Policy ID Number please deliver what is implemented within this policy meaning source, destination, service, profiles etc. This is base to further troubleshoot. hope this helps have fun Andrea