Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Special Notices

This section highlights some of the operational changes that administrators should be aware of in 6.0.0.

FortiManager cannot add VDOM-enabled FortiGates

FortiManager managing FortiGates with VDOMs enabled and running FortiOS 6.0.0 or later is unable to import global ADOM objects from FortiGate devices. Before adding the FortiGate units to FortiManager, perform the following steps to unset the global ADOM objects. After the default configurations are unset, you can successfully add the FortiGate units to FortiManager.

  1. On the Fortigate for each VDOM, unset the following global ADOM objects by using the CLI:
    config wireless-controller utm-profile
        edit "wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
        next
        edit "g-wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
            set ips-sensor "g-wifi-default"
            set application-list "g-wifi-default"
            set antivirus-profile "g-wifi-default"
            set webfilter-profile "g-wifi-default"
            set firewall-profile-protocol-options "g-wifi-default"
            set firewall-ssl-ssh-profile "g-wifi-default"
        next
    end
    
    FGVMULCV30310000 (utm-profile) # ed g-wifi-default
    FGVMULCV30310000 (g-wifi-default) # sh
    config wireless-controller utm-profile
        edit "g-wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
        next
    end
    
  2. After the global ADOM objects are unset, you can add the FortiGate unit to FortiManager.

ADOM Upgrade for FortiManager 6.0

Upgrade is available for ADOM version 5.0 to migrate to version 5.2, 5.4, and 5.6. Currently, there is no ADOM upgrade option for ADOM version 5.6 to move to version 6.0.

Reconfigure SD-WAN after Upgrade

The SD-WAN module has been fully redesigned in FortiManager v6.0 to provide granular monitor and control. Upgrading SD-WAN settings from 5.6 to 6.0 is not supported. Please reconfigure SD-WAN after upgraded to v6.0.

FortiGate VM 16/32/UL license support

FortiOS 5.4.4 introduces new VM license types to support additional vCPUs. FortiManager 5.6.0 supports these new licenses with the prefixes of FGVM16, FGVM32, and FGVMUL.

Hyper-V FortiManager-VM running on an AMD CPU

A Hyper-V FMG-VM running on a PC with an AMD CPU may experience a kernel panic. Fortinet recommends running VMs on an Intel-based PC.

VM License (VM-10K-UG) Support

FortiManager 5.4.2 introduces a new VM license (VM-10K-UG) that supports 10,000 devices. It is recommended to upgrade to FortiManager 5.4.2 or later before applying the new license to avoid benign GUI issues.

FortiOS 5.4.0 Support

With the enhancement in password encryption, FortiManager 5.4.2 and later no longer supports FortiOS 5.4.0. Please upgrade FortiGate to 5.4.2 or later.

note icon

The following ADOM versions are not affected: 5.0 and 5.2.

SSLv3 on FortiManager-VM64-AWS

Due to known vulnerabilities in the SSLv3 protocol, FortiManager-VM64-AWS only enables TLSv1 by default. All other models enable both TLSv1 and SSLv3. If you wish to disable SSLv3 support, please run:

config system global

set ssl-protocol t1sv1

end

Special Notices

This section highlights some of the operational changes that administrators should be aware of in 6.0.0.

FortiManager cannot add VDOM-enabled FortiGates

FortiManager managing FortiGates with VDOMs enabled and running FortiOS 6.0.0 or later is unable to import global ADOM objects from FortiGate devices. Before adding the FortiGate units to FortiManager, perform the following steps to unset the global ADOM objects. After the default configurations are unset, you can successfully add the FortiGate units to FortiManager.

  1. On the Fortigate for each VDOM, unset the following global ADOM objects by using the CLI:
    config wireless-controller utm-profile
        edit "wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
        next
        edit "g-wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
            set ips-sensor "g-wifi-default"
            set application-list "g-wifi-default"
            set antivirus-profile "g-wifi-default"
            set webfilter-profile "g-wifi-default"
            set firewall-profile-protocol-options "g-wifi-default"
            set firewall-ssl-ssh-profile "g-wifi-default"
        next
    end
    
    FGVMULCV30310000 (utm-profile) # ed g-wifi-default
    FGVMULCV30310000 (g-wifi-default) # sh
    config wireless-controller utm-profile
        edit "g-wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
        next
    end
    
  2. After the global ADOM objects are unset, you can add the FortiGate unit to FortiManager.

ADOM Upgrade for FortiManager 6.0

Upgrade is available for ADOM version 5.0 to migrate to version 5.2, 5.4, and 5.6. Currently, there is no ADOM upgrade option for ADOM version 5.6 to move to version 6.0.

Reconfigure SD-WAN after Upgrade

The SD-WAN module has been fully redesigned in FortiManager v6.0 to provide granular monitor and control. Upgrading SD-WAN settings from 5.6 to 6.0 is not supported. Please reconfigure SD-WAN after upgraded to v6.0.

FortiGate VM 16/32/UL license support

FortiOS 5.4.4 introduces new VM license types to support additional vCPUs. FortiManager 5.6.0 supports these new licenses with the prefixes of FGVM16, FGVM32, and FGVMUL.

Hyper-V FortiManager-VM running on an AMD CPU

A Hyper-V FMG-VM running on a PC with an AMD CPU may experience a kernel panic. Fortinet recommends running VMs on an Intel-based PC.

VM License (VM-10K-UG) Support

FortiManager 5.4.2 introduces a new VM license (VM-10K-UG) that supports 10,000 devices. It is recommended to upgrade to FortiManager 5.4.2 or later before applying the new license to avoid benign GUI issues.

FortiOS 5.4.0 Support

With the enhancement in password encryption, FortiManager 5.4.2 and later no longer supports FortiOS 5.4.0. Please upgrade FortiGate to 5.4.2 or later.

note icon

The following ADOM versions are not affected: 5.0 and 5.2.

SSLv3 on FortiManager-VM64-AWS

Due to known vulnerabilities in the SSLv3 protocol, FortiManager-VM64-AWS only enables TLSv1 by default. All other models enable both TLSv1 and SSLv3. If you wish to disable SSLv3 support, please run:

config system global

set ssl-protocol t1sv1

end