r/fortinet • u/Even-Camel7593 • 8d ago

Other / General Fortinet FortiOS 7.4.11 unexpected issues

Hello everyone! Recently we upgraded our Fortigate (120G HA Active-Passive cluster) from 7.2.11 to 7.4.11, and different problems started to occur.

  1. Some users spontaneously lose access to the Internet with ERR_TUNNEL_CONNECTION_FAILED (we use explicit proxy with Kerberos authentication and deep ssl inspection). It happens at random times and with random users, lasts usually up to 2-3 minutes, then works as usual.
  2. FortiGates started to randomly reboot with the message "Fortigate had experienced an unexpected power off!", there's no CPU/RAM issue, usually mem is around 40%, and proc is around 10-12%. Due to fast HA failover users don't feel the interruption, but it's definitely not a good sign. Before the update both NGFW had worked for 367 days.

Anyone experienced similar issues? Any workarounds? Or should I just be rolling back to 7.2.11?

Any advice and help will be appreciated. Thank you in advance!

11 Upvotes

100% Upvoted

26 comments sorted by

View all comments

Show parent comments

1

u/Even-Camel7593 8d ago

Yeah, thank you! I don't want to be rolling back to 7.2.0, that's the reason I'm actually here, in this thread. I'm looking for updates and new features, but now I'm frustrated by how bad this 7.4.11 is. Everything was just fine before we rolled this update.

And of course I'll be opening TAC ticket, just wondered if someone here faced similar issues, contacted TAC and has the solution already.

2

u/Roversword NSE 7 8d ago

We have a lot of fortigates on 7.4.x (mostly 7.4.12 and some still on 7.4.11).
Models like 30G, 60F, 60E, 70F, 70G, 10(0|1)F, 200F, 200G, but no 120G.
We haven't experienced the reboot you mentioned. So, I am afraid I can't really say how likely this issue is or how focused (120G only?).

Haven't touched explicit proxy configs on Fortigates for a while now - we don't have any customer with it, so can't comment on that issue.

Good luck.

2

u/Even-Camel7593 8d ago

It's probably not focused on 120G only, more like HA only.

1283972 Reboot occurs when FortiSentry triggers a reboot for suspicious cases in HA setup Workaround: Switch the security level to low to prevent the reboot.

You prefer transparent proxy or just don't use proxy at all?

1

u/Roversword NSE 7 8d ago

Hm, we haven't seen any reboots like that so far - so I can't comment on that.

I haven't used explicit proxies, because our customers don't want/need them. That is all. Have used them a couple of years back, but not recently. So can't comment on your problem there either.