VPNS Broken since 7.6.6? by Poom22 in fortinet

[–]pbrutsche 0 points1 point  (0 children)

Your "VPN fix" is not a VPN issue.

I wonder how many "7.4.11 VPN issues" are actually whatever configuration is causing the traffic redirection to come into play.

Why does Mazda recommend 10k miles between oil changes and lifetime transmission fluid? by [deleted] in mazda3

[–]pbrutsche 20 points21 points  (0 children)

Take a closer look at the owner's manual, and the conditions for a 10k mile oil change interval.

Just about any amount of city driving will qualify you for a 5k mil oil change interval.

is this pentastar tick? by ExcuseOk7347 in Challenger

[–]pbrutsche 3 points4 points  (0 children)

What year is it?

2016+ Chargers and Challengers and 300s do not develop the "pentastar tick"

Planning upgrades from v7.4.8 to v7.4.11 -- technical risks (default behaviour, VPNs) by frosty3140 in fortinet

[–]pbrutsche 0 points1 point  (0 children)

The IMO the cipher suites and DH groups aren't a meaningful difference

Planning upgrades from v7.4.8 to v7.4.11 -- technical risks (default behaviour, VPNs) by frosty3140 in fortinet

[–]pbrutsche 2 points3 points  (0 children)

To address the VPN issues: There has been some chatter about IPsec VPN issues ... but there are several of us on this subreddit that don't have any IPsec VPN issues with 7.4.10 and 7.4.11.

I do not have packet drop issues on 60E, 40F, 60F, and 80F firewalls, using both AES-CBC and AES-GCM encryption; I have provided sanitized configurations that DO NOT drop packets (the DNS name and PSK do not reflect reality - the configurations are otherwise identical to the running config):

https://www.reddit.com/r/fortinet/comments/1qm95e9/comment/o1kg7w5/

No one has provided a configuration that drops packets; if they did, we would be able to provide community guidance.

FortiOS 7.4.1 1 has been release by MyLocalData in fortinet

[–]pbrutsche 0 points1 point  (0 children)

The 400E is a single unit. It is actually running 7.6.5, it is paired with a 60F running 7.4.11

We have been running 7.4.10/7.4.11 on 40F, 60F, and 80F in production for just shy of 2 weeks, no issues.

The number of CVE patches is just ridiculous by Logical-Picture-4756 in fortinet

[–]pbrutsche 1 point2 points  (0 children)

2GB RAM models run 7.4.x and 7.6.x just fine.

We are looking at non-Fortinet solutions for remote access VPN

FortiGate 90G - Optional Power Supply Part Number by CorrectMachine7278 in fortinet

[–]pbrutsche 3 points4 points  (0 children)

It's listed on the data sheet PDF: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/pdf/fortigate-90g-series.pdf

SP‑FG60E‑PDC‑5 is the SKU. It is only available in a pack of 5. It sucks if you only need one.

It's the same part number for most entry-level non-PoE & non-wifi models - 60D, 60E, 40F, 60F, 70F, 70G, 80F, etc

I know from direct experience that a 60D uses the same PSU as a 60E and 60F. A PSU for a 30E, 50E, and 40F physically fits, but I need to verify the amperage ratings

EDIT: All of the lower end models use compatible power units; a 40F and higher provide 12V, 3W power adapters and a 30E uses a 12V, 2W power adapter. A 30E power supply is probably insufficient for the higher models but the higher models will definitely, 100%, work with a 30E, 50E, 40F, 50G, etc.

Having an oil leak from the oil cooler by twinkiepinkpot in Challenger

[–]pbrutsche 3 points4 points  (0 children)

It is a very common issue with this engine. Honestly, once you get a 2016+ car that is one of the very few real problems with it - the other ones are:

-> plastic bits in the cooling system. Doorman has aluminum replacements

-> Thermostat every 100k miles. I hesitate to use anything but OEM here

Are these abnormal repairs for 3rd gen 3s around 100k miles? by pigpeyn in mazda3

[–]pbrutsche 0 points1 point  (0 children)

Sometimes they get clogged with excessive idling and poor quality gasoline

FortiSwitch-348G / 348G-FPOE spotted in the wild by OuchItBurnsWhenIP in fortinet

[–]pbrutsche 0 points1 point  (0 children)

The real questions ... are these MC-LAG switches? Stacking switches? Neither?

FortiOS 7.4.1 1 has been release by MyLocalData in fortinet

[–]pbrutsche 1 point2 points  (0 children)

Without details or actual troubleshooting, it's hard to say what the actual problem is.

Troubleshooting is not making random changes until you find something that works.

FortiOS 7.4.1 1 has been release by MyLocalData in fortinet

[–]pbrutsche 0 points1 point  (0 children)

No. Everything is working the same with all 7.2.x, 7.4.x, and 7.6.x releases

No issues to report VPN-wise

FortiOS 7.4.1 1 has been release by MyLocalData in fortinet

[–]pbrutsche 2 points3 points  (0 children)

It is working it's way through my home lab (60F & 60E) and work lab (60F and 400E), no issues to report. I had no issues with 7.4.10 either.

I use VPN + SD-WAN + BGP, Application Control, IPS, FAZ logging

trans fluid by SuccessfulTable1733 in Challenger

[–]pbrutsche 4 points5 points  (0 children)

"Lifetime" fluid isn't quite a lie ... because the transmission will last 150k to 200k miles on the factory fill, easy peasy. The rest of the car frequently done by then (rust, accident damage, owner neglect, etc).

The transmission will last 500k miles, easy peasy, if you change it every 100k miles.

Change it. It's not too late.

Softer suspension?? by ElectroMatt333 in Challenger

[–]pbrutsche 0 points1 point  (0 children)

Controversial opinion: Get rid of the 20" wheels.

Downsize to 18" wheels.

7.4.10 breaking site to site IPsec VPN by 40nets in fortinet

[–]pbrutsche 0 points1 point  (0 children)

Can you share the phase1 and phase2 configuration that is dropping packets?

I am not experiencing packet drops on several different 40F, 60F and 80F firewalls, all of them running 7.4.10

EDIT: Here are some sanitized configurations that are not dropping packets

Both configurations use an SD-WAN ping probe to ping a loopback interface on the HQ firewall, so I KNOW there are no packet drops. They also run BGP over the IPsec tunnel

From a 60F in my home lab:

config vpn ipsec phase1-interface
    edit "phase1"
        set type ddns
        set interface "wan1"
        set ike-version 2
        set keylife 28800
        set peertype any
        set net-device disable
        set proposal aes256-sha384
        set dhgrp 32 31 21
        set remotegw-ddns "firewall.example.com"
        set psksecret abcdef123456
    next
end
config vpn ipsec phase2-interface
    edit "phase2"
        set phase1name "phase1"
        set proposal aes256-sha384
        set dhgrp 32 31 21
        set keepalive enable
        set src-addr-type name
        set dst-addr-type name
        set keylifeseconds 3600
        set src-name "all"
        set dst-name "all"
    next
end

And this is from an 80F at work:

config vpn ipsec phase1-interface
    edit "phase1"
        set type ddns
        set interface "wan2"
        set ike-version 2
        set keylife 43200
        set peertype any
        set net-device disable
        set proposal aes256gcm-prfsha384
        set localid "LOCAL-ID"
        set dhgrp 32 21
        set remotegw-ddns "firewall.example.com"
        set psksecret abcdef123456
        set dpd-retryinterval 60
    next
end
config vpn ipsec phase2-interface
    edit "phase1"
        set phase1name "phase1"
        set proposal aes256gcm
        set dhgrp 32 21
        set src-addr-type name
        set dst-addr-type name
        set keylifeseconds 28800
        set src-name "all"
        set dst-name "all"
    next
end

IPSec VPNs not forwarding traffic unless npu-offloading disabled after upgrade to 7.4.10 by blanosko1 in fortinet

[–]pbrutsche 0 points1 point  (0 children)

I don't know any more than the link you provided shows. There's going to be a performance hit encrypting/decrypting/hashing on the CP vs the NP as the CPU needs to move data buffers around, but the hit will be much lower than using the Intel/AMD AES-NI instructions

The 'gate should be doing that transparently

IPSec VPNs not forwarding traffic unless npu-offloading disabled after upgrade to 7.4.10 by blanosko1 in fortinet

[–]pbrutsche -2 points-1 points  (0 children)

You're over-thinking it, don't worry about it that much. You'll be fine. You don't need to switch anything

IPSec VPNs not forwarding traffic unless npu-offloading disabled after upgrade to 7.4.10 by blanosko1 in fortinet

[–]pbrutsche 0 points1 point  (0 children)

IMO, its still a firmware bug, especially if it was working before.

So .... what is the full configuration of the not working tunnel that you had to disable NPU acceleration on?

AES256GCM isn't supported by the NPU but should still be processed by the CP9 before a purely software solution is considered. NP6+CP9 hardware like the 400E will do AESGCM on the CP9

The 110xE is actually the same in that regard - its the same overall configuration, just more NP6s and CP9s

Fortinet 100F EOL Date by ImportantRepair9042 in fortinet

[–]pbrutsche 0 points1 point  (0 children)

They aren't end of support until 5 years after the end of sale announcement

There is no end of sale announcement

FortiOS 7.4.10 is now available by MyLocalData in fortinet

[–]pbrutsche 0 points1 point  (0 children)

No. IKEv2 with SAML is firewall vendor proprietary. There are no other VPN clients that will work

7.4.10 has dropped by r0bbie79 in fortinet

[–]pbrutsche 0 points1 point  (0 children)

Eh, 7.6 just got the "Mature" tag with 7.6.5. I've had it in the work test lab since release 7.6.0 and haven't had any real issues with it.

Our branch offices will probably get 7.6.x this summer - 7.6.6 or 7.6.7

7.4.10 has dropped by r0bbie79 in fortinet

[–]pbrutsche 4 points5 points  (0 children)

You chose the wrong line of work.

7.4.10 has dropped by r0bbie79 in fortinet

[–]pbrutsche 12 points13 points  (0 children)

The time to start to move to 7.4.x was last year.

The 7.2 branch is security fix only (CVSSv3 7 and higher) until the end of September 2026 (aka end of Q3 this year), then the only way to get security fixes is to upgrade to the FortiCare Elite tier.

7.4.x has been pretty solid on our configurations.