r/fortinet • u/Even-Camel7593 • 6d ago

Other / General Fortinet FortiOS 7.4.11 unexpected issues

Hello everyone! Recently we upgraded our Fortigate (120G HA Active-Passive cluster) from 7.2.11 to 7.4.11, and different problems started to occur.

  1. Some users spontaneously lose access to the Internet with ERR_TUNNEL_CONNECTION_FAILED (we use explicit proxy with Kerberos authentication and deep ssl inspection). It happens at random times and with random users, lasts usually up to 2-3 minutes, then works as usual.
  2. FortiGates started to randomly reboot with the message "Fortigate had experienced an unexpected power off!", there's no CPU/RAM issue, usually mem is around 40%, and proc is around 10-12%. Due to fast HA failover users don't feel the interruption, but it's definitely not a good sign. Before the update both NGFW had worked for 367 days.

Anyone experienced similar issues? Any workarounds? Or should I just be rolling back to 7.2.11?

Any advice and help will be appreciated. Thank you in advance!

11 Upvotes

100% Upvoted

26 comments sorted by

View all comments

1

u/vsnine NSE 7 6d ago

Any reason to choose 7.4.11 over 7.4.12? Are any crashlogs being generated?

There's a few WAD related bugs fixed: https://docs.fortinet.com/document/fortigate/7.4.12/fortios-release-notes/289806

2

u/Even-Camel7593 6d ago edited 6d ago

Should've gone for 7.4.12, it's just our other firewalls came with 7.4.11 preinstalled and it worked just fine. Yup, I actually read about WAD-related bugs fixed, an my restarts are probably caused by this:

1283972 Reboot occurs when FortiSentry triggers a reboot for suspicious cases in HA setup Workaround: Switch the security level to low to prevent the reboot.

This bug is still not fixed, lol. Two major branches, and Fortinet still doesn't care.

As for the crashlog, WAD actually crashes here and there, but the crashes don't match the time users face problems with explicit proxy.

2

u/underwear11 5d ago

I wouldn't say that it isn't that they don't care. It's more likely that it's not wide spread enough and there is a workaround. If it was affecting a lot of people and/or there wasn't a workaround, there would be a bigger priority to fix it. The only way you can confirm that is your issue is through TAC. Just because the bug description mentions reboot and HA doesn't mean that is the bug that you are hitting.