Fortinet black logo

Special Notices

Special Notices

This section highlights some of the operational changes that administrators should be aware of in 6.2.1.

Import Authentication Rules and Schemes

With FortiManager support of Explicit Proxy Authentication at the ADOM level, FortiManager must import all authentication rules and authentication schemes to the ADOM after upgrade.

Common Vulnerabilities and Exposures

FortiManager 6.2.1 is no longer vulnerable to the issue described in the following link - https://fortiguard.com/psirt/FG-IR-19-144.

Support of the NGFW mode in 6.2.1

Within a version 6.2 ADOM, policy package with NGFW mode set as policy based only supports FortiOS 6.2.1.

Managing FortiGate with VDOMs that use Global, Shared Profiles

FortiManager managing FortiGates with global, shared g-xx profiles in VDOMs and running FortiOS 6.0.0 or later is unable to import global, shared g-xx profiles from FortiGate devices.

Before adding the FortiGate units to FortiManager, perform the following steps to unset the global ADOM objects. After the default configurations are unset, you can successfully add the FortiGate units to FortiManager.

  1. On the Fortigate for each VDOM, unset the following global ADOM objects by using the CLI:
    config wireless-controller utm-profile
        edit "wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
        next
        edit "g-wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
            set ips-sensor "g-wifi-default"
            set application-list "g-wifi-default"
            set antivirus-profile "g-wifi-default"
            set webfilter-profile "g-wifi-default"
            set firewall-profile-protocol-options "g-wifi-default"
            set firewall-ssl-ssh-profile "g-wifi-default"
        next
    end
    
    FGVMULCV30310000 (utm-profile) # ed g-wifi-default
    FGVMULCV30310000 (g-wifi-default) # sh
    config wireless-controller utm-profile
        edit "g-wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
        next
    end
    
  2. After the global ADOM objects are unset, you can add the FortiGate unit to FortiManager.

Managing FortiAnalyzer Devices

FortiManager 6.2 can only manage and process logs for FortiAnalyzer 6.2 devices.

IOC Support on FortiManager

Please note that FortiManager does not support IOC related features even when FortiAnalyzer mode is enabled.

Hyper-V FortiManager-VM running on an AMD CPU

A Hyper-V FMG-VM running on a PC with an AMD CPU may experience a kernel panic. Fortinet recommends running VMs on an Intel-based PC.

SSLv3 on FortiManager-VM64-AWS

Due to known vulnerabilities in the SSLv3 protocol, FortiManager-VM64-AWS only enables TLSv1 by default. All other models enable both TLSv1 and SSLv3. If you wish to disable SSLv3 support, please run:

config system global

set ssl-protocol t1sv1

end

Special Notices

This section highlights some of the operational changes that administrators should be aware of in 6.2.1.

Import Authentication Rules and Schemes

With FortiManager support of Explicit Proxy Authentication at the ADOM level, FortiManager must import all authentication rules and authentication schemes to the ADOM after upgrade.

Common Vulnerabilities and Exposures

FortiManager 6.2.1 is no longer vulnerable to the issue described in the following link - https://fortiguard.com/psirt/FG-IR-19-144.

Support of the NGFW mode in 6.2.1

Within a version 6.2 ADOM, policy package with NGFW mode set as policy based only supports FortiOS 6.2.1.

Managing FortiGate with VDOMs that use Global, Shared Profiles

FortiManager managing FortiGates with global, shared g-xx profiles in VDOMs and running FortiOS 6.0.0 or later is unable to import global, shared g-xx profiles from FortiGate devices.

Before adding the FortiGate units to FortiManager, perform the following steps to unset the global ADOM objects. After the default configurations are unset, you can successfully add the FortiGate units to FortiManager.

  1. On the Fortigate for each VDOM, unset the following global ADOM objects by using the CLI:
    config wireless-controller utm-profile
        edit "wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
        next
        edit "g-wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
            set ips-sensor "g-wifi-default"
            set application-list "g-wifi-default"
            set antivirus-profile "g-wifi-default"
            set webfilter-profile "g-wifi-default"
            set firewall-profile-protocol-options "g-wifi-default"
            set firewall-ssl-ssh-profile "g-wifi-default"
        next
    end
    
    FGVMULCV30310000 (utm-profile) # ed g-wifi-default
    FGVMULCV30310000 (g-wifi-default) # sh
    config wireless-controller utm-profile
        edit "g-wifi-default"
            set comment "Default configuration for offloading WiFi traffic."
        next
    end
    
  2. After the global ADOM objects are unset, you can add the FortiGate unit to FortiManager.

Managing FortiAnalyzer Devices

FortiManager 6.2 can only manage and process logs for FortiAnalyzer 6.2 devices.

IOC Support on FortiManager

Please note that FortiManager does not support IOC related features even when FortiAnalyzer mode is enabled.

Hyper-V FortiManager-VM running on an AMD CPU

A Hyper-V FMG-VM running on a PC with an AMD CPU may experience a kernel panic. Fortinet recommends running VMs on an Intel-based PC.

SSLv3 on FortiManager-VM64-AWS

Due to known vulnerabilities in the SSLv3 protocol, FortiManager-VM64-AWS only enables TLSv1 by default. All other models enable both TLSv1 and SSLv3. If you wish to disable SSLv3 support, please run:

config system global

set ssl-protocol t1sv1

end