Documentos de Académico
Documentos de Profesional
Documentos de Cultura
VERSION 5.2.2
FORTINETDOCUMENTLIBRARY
http://docs.fortinet.com
FORTINETVIDEOLIBRARY
http://video.fortinet.com
FORTINETBLOG
https://blog.fortinet.com
CUSTOMERSERVICE&SUPPORT
https://support.fortinet.com
FORTIGATECOOKBOOK
http://cookbook.fortinet.com
FORTINETTRAINING SERVICES
http://www.fortinet.com/training
FORTIGUARDCENTER
http://www.fortiguard.com
ENDUSERLICENSE AGREEMENT
http://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: techdocs@fortinet.com
TABLEOFCONTENTS
Change Log
Introduction
Supported models
Whats new in FortiOS 5.2.2
AV Engine
Endpoint Control
Firewall
FortiGate VM
Log & Report
Routing
SSL VPN
System
Web-based Manager
WiFi
Special Notices
FG-5001D operating in FortiController or Dual FortiController mode
Compatibility with FortiOS versions
FortiPresence
Default log setting change
Upgrade Information
Upgrading from FortiOS 5.2.0 or later
Upgrading from FortiOS 5.0.8 or later
Downgrading to previous firmware versions
FortiGate VM firmware
Firmware image checksums
5
6
6
7
7
7
7
7
7
7
8
8
8
8
9
9
9
9
9
10
10
10
10
10
11
12
12
14
15
17
17
17
18
Resolved Issues
Known Issues
Limitations
Citrix XenServer limitations
Open Source XenServer limitations
19
25
28
28
28
Change Log
Date
Change Description
2014-11-18
Initial release.
2014-11-19
2014-11-26
2014-11-28
2014-12-02
2014-12-19
2014-12-29
2015-01-15
Release Notes
Fortinet Technologies Inc.
Introduction
This document provides the following information for FortiOS 5.2.2 build 0642:
l
Introductionl
Special Notices
Upgrade Information
Resolved Issues
Known Issues
Limitations
Supported models
FortiOS 5.2.2 supports the following models.
FortiGate
FortiWiFi
FWF-20C, FWF-20C-ADSL-A, FWF-30D, FWF-30D-POE, FWF-40C, FWF-60C, FWF60CM, FWF-60CX-ADSL-A, FWF-60D, FWF-60D-3G4G-VZW, FWF-60D-POE, FWF80CM, FWF-81CM, FWF-90D, FWF-90D-POE
FortiGate Rugged
FGR-60D, FGR-100C
FortiGate VM
FortiSwitch
FS-5203B
FortiOS Carrier
Release Notes
Fortinet Technologies Inc.
Introduction
FG-3810D
Build 4790
AV Engine
l
Added an option to disable the Win32 emulator in AV scanning to improve email server responsiveness.
Endpoint Control
l
Added support for 32,000 plus FortiClient configuration distribution through Endpoint Control Network Access
Control.
Firewall
l
The %%PROTOCOL%% tag is now supported in replacement messages from the transparent proxy.
NTP source port translation for port values bigger than 1024.
FortiGate VM
l
Routing
l
Release Notes
Fortinet Technologies Inc.
Introduction
SSL VPN
l
System
l
Added hardware switch feature and SPAN functionality to 30D, 60D, and 90D series. Moved PoE ports out of the
internal switch to independent interfaces.
Web-based Manager
l
Added a warning when using deep SSL inspection mode in policy/SSL profile pages.
WiFi
Added broadcast/multicast suppression for local bridge mode SSID for different packet types.
Release Notes
Fortinet Technologies Inc.
Special Notices
FG-5001D operating in FortiController or Dual FortiController mode
When upgrading a FG-5001D operating in FortiController or dual FortiController mode from version 5.0.7 (B4625) to
FortiOS version 5.2.2, you may experience a back-plane interface connection issue. This is due to a change to the
ELBC interface mapping ID. After the upgrade, you will need to perform a factory reset and then re-configure the
device.
Affected models
Model
Part Number
FWF-60CX-ADSL
FG-600C
FG-600C-DC
FG-600C-LENC
FortiPresence
For FortiPresence users, it is recommended to change the FortiGate web administration TLS version in order to allow
the connection.
config system global
set admin-https-ssl-versions tlsv1-0 tlsv1-1 tlsv1-2
end
Release Notes
Fortinet Technologies Inc.
Upgrade Information
Upgrading from FortiOS 5.2.0 or later
FortiOS version 5.2.2 officially supports upgrade from version 5.2.0 or later.
operation mode
interface IP/management IP
DNS settings
VDOM parameters/settings
session helpers
FortiGate VM firmware
Fortinet provides FortiGate VM firmware images for the following virtual environments:
10
.out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
.out.OpenXen.zip: Download the 64-bit package for a new FortiGate VM installation. This package
contains the QCOW2 file for Open Source XenServer.
.out.CitrixXen.zip: Download the 64-bit package for a new FortiGate VM installation. This package
contains the Citrix XenServer Virtual Appliance (XVA), Virtual Hard Disk (VHD), and OVF files.
Release Notes
Fortinet Technologies Inc.
Upgrade Information
Linux KVM
l
l
.out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
.out.kvm.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains
QCOW2 that can be used by qemu.
Microsoft Hyper-V
l
l
.out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
.out.hyperv.zip: Download the 64-bit package for a new FortiGate VM installation. This package
contains three folders that can be imported by Hyper-V Manager on Hyper-V 2012. It also contains the file
fortios.vhd in the Virtual Hard Disks folder that can be manually added to the Hyper-V Manager.
.out: Download either the 32-bit or 64-bit firmware image to upgrade your existing FortiGate VM installation.
.ovf.zip: Download either the 32-bit or 64-bit package for a new FortiGate VM installation. This package
contains Open Virtualization Format (OVF) files for VMware and two Virtual Machine Disk Format (VMDK) files
used by the OVF file during deployment.
Release Notes
Fortinet Technologies Inc.
11
Web Browsers
Other web browsers may function correctly, but are not supported by Fortinet.
Other web browsers may function correctly, but are not supported by Fortinet.
FortiManager
FortiAnalyzer
12
Release Notes
Fortinet Technologies Inc.
FortiAP
5.0.8
You should verify what the current recommended FortiAP version is for your
FortiAP prior to upgrading the FortiAP units. You can do this by going to the
WiFi Controller > Managed Access Points > Managed FortiAP page in the
Web-based Manager. Under the OS Version column you will see a message
reading A recommended update is available for any FortiAP that is running
an earlier version than what is recommended.
2.0.3
FortiSwitch-ATCA
FortiController
5.2.0
FortiSandbox
1.4.2
1.3.0
FortiExplorer
Release Notes
Fortinet Technologies Inc.
13
FortiExplorer iOS
Language support
FortiExtender
AV Engine
5.159
IPS Engine
3.059
Linux KVM
Microsoft
Open Source
Virtualization Environments
Citrix
VMware
Language support
The following table lists language support information.
Language support
14
Language
Web-based Manager
Documentation
English
Chinese (Simplified)
Chinese (Traditional)
French
Japanese
Korean
Release Notes
Fortinet Technologies Inc.
Module support
Language
Web-based Manager
Documentation
Portuguese (Brazil)
Spanish (Spain)
To change the FortiGate language setting, go to System > Admin > Settings, in View Settings > Language select the
desired language from the drop-down menu.
Module support
FortiOS 5.2.2 supports Advanced Mezzanine Card (AMC), Fortinet Mezzanine Card (FMC), Rear Transition Module
(RTM), and Fortinet Storage Module (FSM) removable modules. These modules are not hot swappable. The
FortiGate unit must be turned off before a module is inserted or removed.
FortiGate Model
FG-310B, FG-620B, FG-621B, FG-3016B, FG-3810A,
FG-5001A
FG-200B, FG-311B, FG-1240B, FG-3040B, FG-3140B,
FG-3951B
FG-310B, FG-311B, FG-620B, FG-621B, FG-1240B,
FG-3016B, FG-3810A, FG-5001A
FG-3810A, FG-5001A
FG-3810A, FG-5001A
Release Notes
Fortinet Technologies Inc.
15
Module
Module: ADM-XE2
Module support
FortiGate Model
FG-3810A, FG-5001A
FG-3810A, FG-5001A
FG-3810A
FG-5001A
FG-310B, FG-311B
FG-5001A
FG-3950B, FG-3951B
FG-3950B, FG-3951B
FG-3950B, FG-3951B
FG-3950B, FG-3951B
FG-3950B
16
Release Notes
Fortinet Technologies Inc.
Installer
2307
2307
2307
Other operating systems may function correctly, but are not supported by Fortinet.
Web Browser
Other operating systems and web browsers may function correctly, but are not supported by Fortinet.
Release Notes
Fortinet Technologies Inc.
17
Antivirus
Firewall
Supported Microsoft Windows 7 32-bit and 64-bit antivirus and firewall software
Product
Antivirus
Firewall
18
Release Notes
Fortinet Technologies Inc.
Resolved Issues
The following issues have been fixed in version 5.2.2. For inquires about a particular bug, please contact Customer
Service & Support.
Endpoint Control
Bug ID
Description
0248014
0256732
Unexpected SSL connection shutdown from the client side causes the fcnacd daemon to consume CPU.
Firewall
19
Bug ID
Description
0202686
0235170
0246476
0248419
FortiGate does not use the User-Name from the RADIUS response.
0249510
0250583,
0252780
0251394,
0252331
Traffic that passes the FortiGate twice is blocked in transparent mode when UTM is enabled.
0252320
The wrong policy may be matched after the authenticated session becomes dirty.
0253540
The length validation code for the Indication IE in GTPv2 Modify Bearer Request is wrong, which
causes packet drop.
0253592
0254363
When a login user logs out in the keepalive page, the relevant sessions are not deleted until the
hard timeout. Traffic is still able to pass the FortiGate.
0254904
When using multiple one-to-one IPPools in policy, the same client can be mapped with several
IPs belonging to different pools.
Release Notes
Fortinet Technologies Inc.
Resolved Issues
Bug ID
Description
0255623
TNS sessions hang when a VIP is defined for a mapped IP address shorter than the external IP
address.
0256488
0257241
The SSL session unexpectedly terminates after client key exchange and a change cipher spec
message is displayed when proxy mode is enabled.
FortiCarrier
Bug ID
Description
0254230
FortiGate 3040B/3140B
Bug ID
Description
0249749,
0258264
FortiGate VM
Bug ID
Description
0252306
0259630
The option to enable VDOMs has been removed from the We-based Manager. The related CLI
command has been hidden.
High Availability
Bug ID
Description
0231555
IPsec VPN
Bug ID
Description
0247729
0248504
0251170
0251431
Release Notes
Fortinet Technologies Inc.
20
Resolved Issues
Bug ID
Description
0253221
0253680
Packets are tunnelled twice (ESP in ESP) by NP6 when the IPsec tunnel is terminated on an
npu-vlink interface.
0254898
An IPsec tunnel interface may not come up after the FortiGate unit reboots if the tunnel is using
DHCP mode.
0256492
When IPsec interfaces belong to the same zone, all existing established IPsec SA are brought
down with multiple configuration changes.
Description
0247483
0250058
The command execute log delete-old logs does not work as expected.
0252125
Added MAC device information into the sniffer traffic log so that the Web-based Manager can
display the device field.
Spam Filter
Bug ID
Description
0254508
0255345
Added multi-part boundary to an email in the right place to avoid attachment breaking.
0257510
SSL VPN
21
Bug ID
Description
0229536
0231666
Improved the submit button for editorial login page with SSO.
0231798
The PortForward connection tool should close the session as soon as it is closed by the backend
server.
0244399
Unable to handle remote web server return JavaScript as plain text type.
0251595
0252113
Release Notes
Fortinet Technologies Inc.
Resolved Issues
Bug ID
Description
0252337
0256000
Personal bookmarks of PKI users are not displayed in the web portal when the user logs in
again.
0259136
SSL proxy can only use SSLv3 for the server side connection. TLS should be supported for the
backend connection.
System
Bug ID
Description
0226128
0244082
To ensure nturbo works as expected, traffic should not be offloaded to NPU if there is an interface-based policy enabled.
0246224
0246849
0247062
FortiGate fails to update generic DDNS record when zone information is present in the server
response.
0250439
0250534
Adding or unsetting a member of an aggregation interface can cause the peer switch's interface
to be down.
0251221
The hardware switch span port does not work on FG-200D-POE and FG-240D-POE models.
0251269
0252333
XLR crash when packets with priority bits are set in the VLAN tag.
0252947
With a FortiGate previously registered to both FortiManager and FortiCloud, it will still send
management traffic to FortiManager even after it is unregistered from the FortiManager.
0253694
0253970
0254865
get system source-ip status does not scan LDAP server in VDOMs to report the
source-ip manual setting.
0256486
0256491
Release Notes
Fortinet Technologies Inc.
22
Resolved Issues
Bug ID
Description
0256498
0256727
cmdbsvr crash after restoring a large configuration file without entering the VDOM licence.
0256730
Changed the default digest method from SHA to SHA256 for certificate request generation.
0257277
After deleting a VDOM, error messages are displayed when executing get sys ha-nonsync-csum.
0257341
0257343
0258251
0258356
0260730
VoIP
Bug ID
Description
0233723
Removed port translation in the LocationConfirm packet when doing NAT for H.225.
Description
0253682
Improved WAN optimization HTTP 304 response processing in order to have the state synchronize properly.
0254020
0255010
Web proxy and session based authentication does not work for HTTP traffic when an ICAP profile is selected in policy.
0256228
0259651
Web-based Manager
23
Bug ID
Description
0193650,
0257997
Added an option to control the TLS and SSL versions for web administration.
0231693
Release Notes
Fortinet Technologies Inc.
Resolved Issues
Bug ID
Description
0235296
An Internal Server Error 500 is encountered when the group address is edited.
0243143
0245175
0248270
0249031
0249121
An Internal Server Error on SSL VPN page is displayed when changing sslvpn_tunnel_addr1
type to subnet.
0253573
Unable to properly create a new remote user group using the local user creation wizard due to a
missing OK button.
0253649
Certain specific configurations can lead to VLANs being hidden from the VDOM interface list.
0254300
0254301
The FortiGate Rugged 100C label is FortiGate 100C in the main header.
0257121
An Internal Server Error is displayed when accessing the Guest Management page.
Web Filter
Bug ID
Description
0255209
In transparent mode, if Web Filter FortiGuard categories have the action set to Warning, the client's connection is reset and unable to reach the requested URL.
Release Notes
Fortinet Technologies Inc.
24
Known Issues
The following issues have been identified in version 5.2.2. For inquires about a particular bug or to report a bug, please
contact Customer Service & Support.
Firewall
Bug ID
Description
0253505
0254210
Failed to block an EICAR sample on SMB 1.0 and 2.0 protocol when nturbo is enabled.
IPsec VPN
Bug ID
Description
0253651
FortiClient may encounter an IPsec traffic issue with a FortiGate that has NP6 NPU offload
enabled.
Routing
Bug ID
Description
0262033
The VRRP status should not flap when the VRDST is unreachable.
System
Bug ID
Description
0241646
Traffic may not go through VLAN interfaces based on LAG in transparent VDOMs.
Workaround: After finish the configuration, perform a reboot operation.
0243840
In order to acquire FortiCloud services from FortiManager, you need disable default servers
using the following command:
config system central management
set include-default-servers disable
end
0246126
25
Release Notes
Fortinet Technologies Inc.
Known Issues
Bug ID
Description
0253641
0257807
The default UDP custom service has tcp-portrange 0:0 in the configuration.
0257860
0257874
The diagnose npu np6 debug CLI command can cause kernel debug message appear.
0259448
The hardware-switch setting is not enable by default for FGR-60D and FWF-60D-3G4GVZW models.
0260799
XLP unable to process TCP traffic when fail-over occurs on an aggregate interface.
Upgrade
Bug ID
Description
0251511
Upgrades to version 5.2.1 will encounter a configuration error with the antivirus service and
HTTPS/FTPS/POP3S/IMAPS/SMTPS protocols because such configurations do not exist in
profile-protocol-options.
0255603
Web-based Manager
Bug ID
Description
0256449
The FortiAP Recommended Update does not support FAP-221C and FAP-320C models.
0257596
Flow based UTM profiles are not hidden in the explicit policy configuration page.
0258905
System event log column settings have duplicate and missing fields.
0259903
In FortiView, the All Session sent/received Bytes is not correct for NPUoffloaded session.
Workaround: Enable per session accounting under system np6.
config system np6
edit np6_0
set per-session-accounting enable
next
end
0260481
FortiView events may not be displayed due to timing issue caused by conflicts between the local
PC and FortiGate time setting.
0260594
The IPv6 policy configuration page does not display the IPv6 address group.
Release Notes
Fortinet Technologies Inc.
26
Known Issues
27
Bug ID
Description
0260711
A chart in the Cloud Application drill down tab for the 5 minute time period is empty.
0260754
An administrator that only has permission for Policy, Address, Service and Schedule configuration is unable to load the web pages related to those configuration objects.
0260795
FortiView may not display data due to the report database being unavailable.
0261864
Missing dependency checks for FortiView including report database and the new System, VPN,
and Admin pages.
Release Notes
Fortinet Technologies Inc.
Limitations
Citrix XenServer limitations
The following limitations apply to Citrix XenServer installations:
l
XVA (recommended)
VHD
OVF
The XVA format comes pre-configured with default configurations for VM name, virtual CPU, memory, and virtual
NIC. Other formats will require manual configuration before the first power on process.
28
Release Notes
Fortinet Technologies Inc.
Copyright (Undefined variable: FortinetVariables.CopyrightYear) Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other
marks are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of
Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests
under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance
results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a
binding written contract, signed by Fortinets General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expresslyidentified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For
absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinets internal lab tests. In no event does Fortinet make any commitment
related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in
full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this
publication without notice, and the most current version of the publication shall be applicable.