FortiOS 6.2: Upgrade Notes

As with every software product, even the latest and greatest releases have some known glitches. That’s one of the reasons why you should review the release notes as part of the upgrade process.

But even then you might face a not-yet-documented issue. You’ll find some notable examples below.

FortiAPs won’t connect anymore (6.2.1)

Some customers have reported, that their FortiAPs won’t connect anymore after upgrading to FortiOS 6.2.1. Fortinet has confirmed that this is a know issue only when using trusted hosts to restrict the administrative access to the FortiGate.

The official workaround is to add the FortiAP’s IP or subnet as an additional trusted host entry on one of the admin users:

config system admin 
   edit "adminuser"
     set trusthostx 10.33.33.3 255.255.255.255 <-- IP Address of the FortiAP
   next
 end

RADIUS Server behind VPN-Tunnel not working (6.2.1)

When using a RADIUS server behind an IPsec-tunnel, you most likely had to configure the source-ip in the radius configuration (normally to the internal address of the firewall). A bug in FortiOS 6.2.1 prevents this from working. As a workaround you’ll have to use an ip address owned by the outgoing interface.

config user radius
  edit "nps-server"
    set source-ip "192.168.101.99" <-- IP Address of the outgoing (IPsec)interface
  next
end 

What’s new with FortiOS 6.2: Update issue with certificate for WebUI

Recently we have had a few support cases where a customer was unable to log in to the firewall via WebUI after the firmware update. But SSH access worked fine.

It turned out that during the update process the server certificate used for the WebUI is lost.

Config with v6.0.4 (it does not happen with „self-signed“ only):

config system global
set admin-server-cert "self-signed"
end
„What’s new with FortiOS 6.2: Update issue with certificate for WebUI“ weiterlesen

Fortinet Wireless FAQ

Die Fortinet WiFi Produkte erfreuen sich schon länger zunehmender Beliebtheit. Dies nicht zuletzt, weil die FortiAP und Controller je länger je angewandtere Technologien bieten und daher unterdessen praktisch alle vorstellbaren Einsatzszenarien abdecken.

Da mit dem Featureset zugleich auch die Komplexität der Systeme mit wächst, möchten wir ihnen mit diesem Artikel einen Überblick über die Technologie, die Funktionalität  und deren Einschränkungen verschaffen.

„Fortinet Wireless FAQ“ weiterlesen

WatchGuard Fireware 12.5

Watchguard is going to release Fireware version 12.5 in the next few days / weeks. From the public beta phase some new features are already known, which I would like to introduce here:

Update: Fireware 12.5 has been released.
Please check the “ What’s New in Fireware v12.5 “ presentation for detailed information.

Reverse Proxy for the Access Portal

In the Access Portal configuration, you can now configure reverse proxy actions so remote users can connect to internal web applications and Microsoft Exchange services with an external URL. With reverse proxy actions, you can give remote teams access to internal resources without the need for a VPN. Multi-factor authentication is supported as well.

„WatchGuard Fireware 12.5“ weiterlesen