FortiOS 5.2.10 - 5.4.1 RMA Claimed

[srsiddiqui]

Hi,

As per the TAC recommendations we had to Flash Format the 100D and eventually it didn't came back up. FortiOS version 5.2.10

So we have got the RMA claimed with FortiOS 5.4.1. Since the support contract was 24x7 but we received the device on 4th day after the claim was initiated and was bit in hurry to live it. So we have imported the config of 5.2.10 to 5.4.1 and started working. This was 3 weeks back. Link Monitor was configured with 2 ISP's

Started facing issues with all the options enabled on a single policy that is UTM, Deep inspection & SSL Certificate that users complaining that Websites are not opening properly "the webpage is unreachable", Error Connection Timeout, Error Connection Closed, DNS Host Suffix issues on three major browsers

As per TAC, The current configuration which you have on the fortigate is corrupted as well. Hence, you will have to flash format the box. Install 5.2.10 and reload configuration of 5.2.10. Then you can go to firmware 5.4.1 following a proper upgrade path. Upgrade path information is present in the support portal. Unfortunately, you will have to redo all the configurations which you had done on 5.4.1 in those 3 weeks

If UTM features in disabled in policy then there is no issue in Browsing

Since their is a lot of configuration done, device was running in Head Office. If we try to redo the complete config than it will take around 3-4 days of downtime which is not possible at all. Further if something missed out than it will be managed afterwards.

Is there any work around for converting the configuration of 5.2.10 to 5.4.1, remove Link-Monitor config part and again configure WAN LLB in order to minimize the downtime to max 1 day.

[SecurityPlus]

Was your 100D firewall working properly when running 5.2.10? Do you have a config backup when it was running 5.2.10 successfully? What prompted using or upgrading to FortiOS 5.4.1?

[srsiddiqui]

yes 100D was working fine before, before RMA the device was having ongoing CPU spike issues and have to restart the firewall sometimes 2-3 times a day or after 7-10 working days

Yes i have the backup with me

New device came with 5.4.1, I didnt downgraded it

[ede_pfau]

Having both a backup from v5.2.10 and v5.4.1, you can obtain a diff to get a 'recipe' of what your changed in the 3 weeks. Both FortiOS versions do have their differences but depending on what you see in the diff you could paste in blocks of code (config) one at a time - all 'live', with no downtime.

Of course you will have to be extremely careful in doing this.

You could better do this offline - just modify a copy of the v5.2 config to incorporate the changes. If to avoid downtime is your primary concern then I would prefer to do the merge offline.

This will get difficult when you come to features which syntax has changed from v5.2 to v5.4. One of it being WLLB / SD-WAN.

Finally, take the FGT offline, downgrade to v5.2.10 and restore the amended config. Check `diag debug conf read` to see which parts didn't work. Before re-loading, clear it with `diag debug conf clear`.

A lot of hassle only because you didn't prepare the replacement unit properly, i.e. downgrade to the version used currently. v5.4.1 isn't a 'gold' version either, once you have cleared this mess up you should upgrade to v5.4.10 as soon as possible to get over the most prominent bugs fixed in the meantime.

[srsiddiqui]

Hi Ede,

So in short we have to flash format the device first and install 5.2.10 after that we can upgrade to 5.4.1 and later on to 5.4.10

I have made changes in Policy Routes, Policies, Address & Address Groups

[sw2090]

you don't need to flash format.

An exec factory-reset on cli will do a reset to factory defaults.

Then downgrade it to 5.2.10.

Then Apply your 5.2.10 config backup.

Then upgrade to 5.4.10 accoarding to the upgrade path specfied in the fortinet support portal.

[srsiddiqui]

Hi,

After factory-reset, I will only have to upload the firmware 5.2.10 from the Firmware Management > Upload

It will then downgrade the Firmware from 5.4.1 to 5.2.10

Correct me if I am wrong

[sw2090]

yes! Factroy default does not require any upgrade paths.

Once you have installed 5.2.10 and reapplied your config you must follow the upgrad path to 5.4.xx in order to not corrupt your config.

You could also try to use FortiConverter to convert your config but I made the experience that this doesn't work very well.

[srsiddiqui]

ok thanks, i will update you once i try this tonight

[ede_pfau]

sw2090 says:

you don't need to flash format.

TAC says:

The current configuration which you have on the fortigate is corrupted as well. Hence, you will have to flash format the box. Install 5.2.10 and reload configuration of 5.2.10. Then you can go to firmware 5.4.1 following a proper upgrade path. Upgrade path information is present in the support portal.

@sw2090: sorry, you should have read the original post. This advice will lead the OP into trouble.

TAC suspects (and I do as well) that the filesystem on flash is corrupt, probably by wear and tear of the flash itself, with single cells failing.

The only remedy is to reformat the flash. All flash cells are tested and defective ones are excluded, then a new filesystem is created on top of this. Of course, this will erase all of the information stored: firmware, configuration, logs, certificates etc. You restore the firmware using the boot procedure (and a TFTP server) and then restore the saved backup copy of the old config.

From there, I would upgrade (following the recommended upgrade path, found in Support portal) up to v5.4.10 and re-configure the changes you've made in the last 3 weeks. Address objects, groups and policies can all be added without downtime.

In contrast, a factoryreset just resets all settings to a default value. This will neither repair the filesystem nor test the hardware. You will run into just the same situation as before.

In the long run you should consider getting a replacement hardware. I suspect that you activate logging to disk. The flash disk onboard is not suited for heavy logging. Each write operation will shorten the life time of the flash. Newer FGTs have SSDs which are suited for logging. IMHO, if you need detailed logs, get a FortiAnalyzer.

Keep current backups of your config. Either automatically (config system global - set revision- enable) onto flash, or on an external USB drive. And never skip the recommended upgrades if you are interested in a valid config.