v6.0 is here

emnoc · ‎03-29-2018

I hope it 's all good ;)

PCNSE

NSE

StrongSwan

romanr · ‎04-04-2018

Andy Bailey wrote:
I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).

Hey,

I don't have that problem - works fine for me since Beta 3.

Can you run the following on a Command Line, while you try to modify a policy:

diag deb reset

diag deb ena

diag deb cli 8

... and post the output

Br,

Roman

View solution in original post

Jordan_Thompson_FTNT · ‎04-04-2018

romanr wrote:
Andy Bailey wrote:
I've getting a "Failed to save some changes: Input value is invalid" message (showing in the attachment) when I try and modify a policy (for example add an anti-spam to an existing policy).

Can you run the following on a Command Line, while you try to modify a policy:

diag deb reset
diag deb ena
diag deb cli 8

... and post the output

In addition, please enable "diag debug app httpsd -1" and include that output.

View solution in original post

thuynh_FTNT · ‎04-11-2018

Andy Bailey wrote:
I've attached the output your requested Roman and Jordan. Thanks for your help.

Nothing really obvious for me. I tried opening the policy and then clicking ok (no changes) and again (no changes) same result both times. I tried Edge instread of Firefox too- no changes there either.

The key lines seem to be:-

[httpsd 9510 - 1522869450 error] cmdb_commit_from_json[1426] -- error saving request object to CLI (-651) [httpsd 9510 - 1522869450 error] _api_cmdb_v2_config[1137] -- error editing object (nret=-651) [httpsd 9510 - 1522869450 error] api_return_http_result[516] -- API error -651 raised
Interestingly I can delete policies- I just tried deleting a couple of unused policies and that worked fine (highlighted from the "IPv4 Policy" list and then just delete.

Any other ideas?

Hi Andy, we've tried with several FGTs and were unable to reproduce your issue. Looks like it's specific to your config after upgrade. From your CLI debug output, the CLI is rejecting the change (any policy edit save) from the GUI.

0: config firewall policy 0: edit 15 0: set ssl-ssh-profile "SSL Certs-Block Untrusted\\Invalid" -651: end

Here are a few other things to try:

1. Can you use the CLI to edit a policy? You can use the above commands to see further error reported by the CLI

2. Can you use the GUI to create new Policy? if not, please also include CLI and httpsd debug message

3. Does this happen to any policy edit via the GUI? 4. Can you check if your interfaces are correctly upgraded?

5. Which FGT model are you using? if possible, can you share your full config with us? you can email me the config at thuynh@fortinet.com

Tri

View solution in original post

RobertReynolds · ‎03-30-2018

https://docs.fortinet.com/uploaded/files/4328/fortios-v6.0.0-release-notes.pdf

Beta and interims have been good.

Nice Easter surprise.

Kenundrum · ‎03-30-2018

I'm reading through some of the documentation. I was interested in the fabric changes.

So far- you still cannot have VDOMs enabled and participate in a security fabric which is still ridiculous. Also- the guide appears to be inconsistent for setting up a fabric as far as what is required. The diagrams show that a fortianalyzer is required, but all the text makes it seem like it is optional by referring to it as a recommended item. As I understand it, in 5.4 you only needed fortigates, in 5.6 you need an analyzer to use fabric features. Is that requirement now dropped again? Unfortunately almost all my devices have multiple VDOMs (mixing transparent and NAT modes) so I haven't been able to verify myself.

CISSP, NSE4

khj · ‎04-01-2018

Totally agree.

I was excited about the new feature that attempts to make the swithcontroller work with mulitble VDOMs. I have not tried it yet, as the documentation says that some of the bare essentials like STP (and related), QoS, 802.1X etc. are not supported with this feature enabled.

It would be really helpful to know what is on the roadmap for VDOMs in the near future that actually works.

ede_pfau · ‎04-01-2018

@neonbit: FOS v5.4.8 fixes the 'policies all-expanded' GUI bug already.

Ede

"Kernel panic: Aiee, killing interrupt handler!"

rkhair · ‎03-31-2018

did the upgrade on my 100d, after i tested it on my DC 100d which was fine.. however the one in my office did the upgrade, comes up and all seems okay but cannot access the web interface through http or https.. ssh works fine and the firewall is letting traffic through and VPNs etc. are up, but the web interface on http or https is totally knackered! tried changing ports via SSH and enabling the http/https access on other interfaces, same thing!

Just a warning

neonbit · ‎04-01-2018

Upgraded 201E from 5.6.3 to 6.0 and working great for me so far. Tested local logging, SSLVPNs with RDP bookmarks and tunnel mode, VLANs, dialupVPNs, DHCP sever and DNS server and all working fine so far.

Registered the FortiClient Linux (beta) to the FGT and it now shows up on the FGT (including my avatar).

I like how when you open the policy section it now defaults to the collapse all view instead of the expand all one like it was before.

One thing that I noted in the release notes is if you're upgrading from 5.6.3 > 6.0.0 you can't have any VLANs tied to an interface, and then have a zone referencing the interface and the zone. Hope it doesn't burn anyone that didn't read the notes!

All up very happy with this build so far, especially for a X.0 GA build.

simonorch · ‎04-01-2018

rkhair wrote:
did the upgrade on my 100d, after i tested it on my DC 100d which was fine.. however the one in my office did the upgrade, comes up and all seems okay but cannot access the web interface through http or https.. ssh works fine and the firewall is letting traffic through and VPNs etc. are up, but the web interface on http or https is totally knackered! tried changing ports via SSH and enabling the http/https access on other interfaces, same thing!

Just a warning

Just a thought, that sounds like a certificate issue (if you have redirect to https enabled as well)

Check the 'admin-server-cert' setting under conf sys global.

Simon

NSE8
Fortinet Expert partner - Norway

rkhair · ‎04-01-2018

Simon, you are a legend. Thx for pointing me in right direction. Not sure why it broke but I did this.. 1) Changed admin SSL port back to 443 2) the 'admin-server-cert' was showing '' so I assigned the factory one to it.. using... set admin-server-cert "Fortinet_Factory" Not sure why it lost it on upgrade. Hopefully helps someone else who loses web admin access after v6.0 upgrade.

simonorch wrote:

rkhair wrote:
did the upgrade on my 100d, after i tested it on my DC 100d which was fine.. however the one in my office did the upgrade, comes up and all seems okay but cannot access the web interface through http or https.. ssh works fine and the firewall is letting traffic through and VPNs etc. are up, but the web interface on http or https is totally knackered! tried changing ports via SSH and enabling the http/https access on other interfaces, same thing! Just a warning
Just a thought, that sounds like a certificate issue (if you have redirect to https enabled as well) Check the 'admin-server-cert' setting under conf sys global. Simon

emnoc · ‎04-01-2018

Will I bit the bullet , my new FWF50E has a fresh v6.0 installed ;) The upgrade from v5.6.3 went off with zero issues. It did take a few longer minutes for the WebGUI to be present. I will upgrade a FWF60D next and see what a D model does.

FWF50E3U17002431 # get system status | grep ersion Version: FortiWiFi-50E v6.0.0,build0076,180329 (GA) BIOS version: 05000013 Release Version Information: GA

Ken

PCNSE

NSE

StrongSwan