Special Notices
This section highlights some of the operational changes that administrators should be aware of in 7.2.7.
Shell access has been removed
As of FortiManager 7.2.6, shell access has been removed.
The following CLI variables have been removed, which were previously used to enable shell access:
config system admin setting
set shell-access {enable | disable}
set shell-password <passwd>
The following CLI command has been removed, which was previously used to access shell when enabled:
execute shell
Enable fcp-cfg-service for Backup Mode ADOMs
When performing a configuration backup from the CLI of FortiGates managed by FortiManager in Backup Mode ADOMs, you must enable the "fcp-cfg-service" using the following command on the FortiManager:
config system global
set fcp-cfg-service enable
end
Custom certificate name verification for FortiGate connection
FortiManager 7.2.5 introduces a new verification of the CN or SAN of a custom certificate uploaded by the FortiGate admin. This custom certificate is used when a FortiGate device connects to a FortiManager unit. The FortiGate and FortiManager administrators may configure the use of a custom certificate with the following CLI commands:
FortiGate-related CLI:
config system central-management
local-cert Certificate to be used by FGFM protocol.
ca-cert CA certificate to be used by FGFM protocol.
FortiManager-related CLI:
config system global
fgfm-ca-cert set the extra fgfm CA certificates.
fgfm-cert-exclusive set if the local or CA certificates should be used exclusively.
fgfm-local-cert set the fgfm local certificate.
Upon upgrading to FortiManager 7.2.5, FortiManager will request that the FortiGate certificate must contain the FortiGate serial number either in the CN or SAN. The tunnel connection may fail if a matching serial number is not found. If the tunnel connection fails, the administrator may need to re-generate the custom certificates to include serial number.
Alternatively, FortiManager 7.2.5 provides a new CLI command to disable this verification. Fortinet recommends to keep the verification enabled.
config system global
fgfm-peercert-withoutsn set if the subject CN or SAN of peer's SSL certificate sent in FGFM should include the serial number of the device.
When the CLI setting fgfm-peercert-withoutsn is disabled (default), the FortiGate device's certificate must include the FortiGate serial number in the subject CN or SAN. When the CLI setting fgfm-peercert-withoutsn is enabled, the FortiManager unit does not perform the verification serial number in subject CN or SAN.
Configuration backup requires a password
As of FortiManager 7.2.5, configuration backup files are automatically encrypted and require you to set a password. The password is required for scheduled backups as well.
In previous versions, the encryption and password were optional.
For more information, see the FortiManager Administration Guide.
Additional configuration required for SSO users
Beginning in 7.2.5, additional configuration is needed for FortiManager Users declared as wildcard SSO users.
When configuring Administrators as wildcard SSO users, the ext-auth-accprofile-override and/or ext-auth-adom-override features, under Advanced Options, should be enabled if the intent is to obtain the ADOMs list and/or permission profile from the SAML IdP.
When using VPN Manager, IPSEC VPN CA certificates must be re-issued to all devices after upgrade
When FortiManager is upgraded to 7.2.5 or later, it creates a new CA <ADOM Name>_CA3 certificate as part of a fix for resolved issue 796858. See Resolved Issues in the FortiManager 7.2.5 Release Notes. These certificates are installed to the FortiGate devices on the next policy push. As a result, the next time any IPSEC VPNs which use certificates rekey, they will fail authentication and be unable to re-establish.
The old CA <ADOM Name>_CA2 cannot be deleted, as existing certificates rely on it for validation. Similarly, the new CA <ADOM Name>_CA3 cannot be deleted as it is required for the fix. Therefore, customers affected by this change must follow the below workaround after upgrading FortiManager to v7.2.5 or later.
A maintenance period is advised to avoid IPSEC VPN service disruption.
Workaround:
Re-issue all certificates again to all devices, and then delete the old CA <ADOM Name>_CA2 from all devices. Next, regenerate the VPN certificates.
To remove CA2 from FortiManager, Policy & Objects > Advanced > CA Certificates must be enabled in feature visibility.
Apache-mode changed from prefork to event
Before version 7.2.3, the default "apache-mode" utilized the "prefork" mode. However, starting from version 7.2.4, the default configuration switches to the "event" mode.
This change is aimed at supporting the HTTP/2.0 protocol. With HTTP/2.0, there is no limit on the maximum concurrency of HTTP requests, potentially leading to slower GUI performance if the client's environment imposes restrictions , whether network or implementation-related. HTTP/2 may face issues such as head-of-line blocking and resource prioritization, leading to slower performance compared to HTTP/1. Additionally, server push and intermediaries struggling with encrypted headers can further complicate matters. Implementing HTTP/2 requires more computational resources, which may affect response times. These complexities highlight scenarios where HTTP/1 might outperform HTTP/2.
If customers experience GUI slowness, they have the option to revert to the "prefork" mode using the following commands:
config system global
(global)# set apache-mode prefork
(global)# end
FortiGuard web filtering category v10 update
Fortinet has updated its web filtering categories to v10, which includes two new URL categories for AI chat and cryptocurrency web sites. In order to use the new categories, customers must upgrade their Fortinet products to one of the versions below.
-
FortiManager - Fixed in 6.0.12, 6.2.9, 6.4.7, 7.0.2, 7.2.0, 7.4.0.
-
FortiOS - Fixed in 7.2.8 and 7.4.1.
-
FortiClient - Fixed in Windows 7.2.3, macOS 7.2.3, Linux 7.2.3.
-
FortiClient EMS - Fixed in 7.2.1.
-
FortiMail - Fixed in 7.0.7, 7.2.5, 7.4.1.
-
FortiProxy - Fixed in 7.4.1.
Please read the following CSB for more information to caveats on the usage in FortiManager and FortiOS.
https://support.fortinet.com/Information/Bulletin.aspx
Install On column for policies
Prior to version 7.2.3, the 'Install-on' column for policies in the policy block had no effect. However, starting from version 7.2.3, the 'Install-on' column is operational and significantly impacts the behavior and installation process of policies. It's important to note that using 'Install-on' on policies in the policy block is not recommended. If required, this setting can only be configured through a script or JSON APIs.
FortiManager 7.2.3 and later firmware on FortiGuard
Starting in FortiManager 7.2.1, a setup wizard executes to prompt the user for various configuration steps and registration with FortiCare. During the execution, the FortiManager unit attempts to communicate with FortiGuard for a list of FortiManager firmware images currently available on FortiGuard – older and newer.
In the case of FortiManager 7.2.2, a bug in the GUI prevents the wizard from completing and prevents the user from accessing the FortiManager unit. The issue has been fixed in 7.2.3 and later and a CLI command has been added to bypass the setup wizard at login time.
config system admin setting
set firmware-upgrade-check disable
end
Fortinet has not uploaded FortiManager 7.2.3 and later firmware to FortiGuard in order to work around the GUI bug, however, the firmware is available for download from the Fortinet Support website.
Option to enable permission check when copying policies
As of 7.2.3, a new command is added in the CLI:
config system global
set no-copy-permission-check {enable | disable}
end
By default, this is set to disable. When set to enable, a check is performed when copying policies to prevent changing global device objects if the user does not have permission.
Management Extensions visibility in the GUI
As of FortiManager 7.2.3, the Management Extensions pane is only visible in the GUI when docker status is enabled and at least one management extension application (MEA) is enabled and downloaded. For more information about enabling and using the MEAs, see the Management Extensions documentation in the FortiManager Documents Library.
FortiManager creates faulty dynamic mapping for VPN manager interface during PP import
If policy changes are made directly on the FortiGates, the subsequent PP import creates faulty dynamic mappings for VPN Manager.
It is strongly recommended to create a fresh backup of the FortiManager's configuration prior to this workaround. Perform the following command to check & repair the FortiManager's configuration database:
diagnose cdb check policy-packages <adom>
After executing this command, FortiManager will remove the invalid mappings of vpnmgr interfaces.
SD-WAN Orchestrator removed in 7.2
Starting in 7.2.0, the SD-WAN Orchestrator is no longer available in FortiManager. Instead, you can use the SD-WAN Overlay Template wizard to configure your SD-WAN overlay network.
For more information, see SD-WAN Overlay Templates in the FortiManager Administration Guide.
Changes to FortiManager meta fields
Beginning in 7.2.0, FortiManager supports policy object metadata variables.
When upgrading from FortiManager 7.0 to 7.2.0 and later, FortiManager will automatically create ADOM-level metadata variable policy objects for meta fields previously configured in System Settings that have per-device mapping configurations detected. Objects using the meta field, for example CLI templates, are automatically updated to use the new metadata variable policy objects.
Meta fields in System Settings can continue to be used as comments/tags for configurations.
For more information, see ADOM-level meta variables for general use in scripts, templates, and model devices.
Setup wizard requires FortiCare registration
Starting in FortiManager 7.2.1, the FortiManager Setup wizard requires you to complete the Register with FortiCare step before you can access the FortiManager appliance or VM. Previously the step was optional.
For FortiManager units operating in a closed environment, contact customer service to receive an entitlement file, and then load the entitlement file to FortiManager by using the CLI.
Access lists as ADOM-level objects
Starting in 7.2.0, FortiManager supports IPv4 and IPv6 access list firewall policies as ADOM-level object configurations from FortiGate. Previously, these access lists were controlled by the device database/FortiGate configuration.
After upgrading to 7.2.0 from an earlier release, the next time you install changes to a FortiGate device with an IPv4 or IPv6 access list firewall policy (config firewall acl/acl6), FortiManager will purge the device database/FortiGate configuration which may have previously contained the access list.
To address this, administrators can re-import the FortiGate policy configuration to an ADOM's policy package or re-create the IPv4/IPv6 access list firewall policy in the original package.
View Mode is disabled in policies when policy blocks are used
When policy blocks are added to a policy package, the View Mode option is no longer available, and policies in the table cannot be arranged by Interface Pair View. This occurs because policy blocks typically contain policies with multiple interfaces, however, View Mode is still disabled even when policy blocks respect the interface pair.
Reconfiguring Virtual Wire Pairs (VWP)
A conflict can occur between the ADOM database and device database when a Virtual Wire Pair (VWP) is installed on a managed FortiGate that already has a configured VWP in the device database. This can happen when an existing VWP has been reconfigured or replaced.
Before installing the VWP, you must first remove the old VWP from the device's database, otherwise a policy and object validation error may occur during installation. You can remove the VWP from the device database by going to Device Manager > Device & Groups, selecting the managed device, and removing the VWP from System > Interface.
Fortinet verified publisher docker image
FortiManager docker images are available for download from Fortinet’s Verified Publisher public repository on dockerhub.
To download the FortiManager image from dockerhub:
- Go to dockerhub at https://hub.docker.com/.
The dockerhub home page is displayed.
- In the banner, click Explore.
- In the search box, type Fortinet, and press Enter.
The fortinet/fortimanager and fortinet/fortianalyzer options are displayed.
- Click fortinet/fortimanager.
The fortinet/fortimanager page is displayed, and two tabs are available: Overview and Tags. The Overview tab is selected by default.
- On the Overview tab, copy the docker pull command, and use it to download the image.
The CLI command from the Overview tab points to the latest available image. Use the Tags tab to access different versions when available.
Scheduling firmware upgrades for managed devices
Starting in FortiManager 7.0.0, firmware templates should be used to schedule firmware upgrades on managed FortiGates. Attempting firmware upgrade from the FortiManager GUI by using legacy methods may ignore the schedule upgrade option and result in FortiGates being upgraded immediately.
Modifying the interface status with the CLI
Starting in version 7.0.1, the CLI to modify the interface status has been changed from up/down to enable/disable.
For example:
config system interface
edit port2
set status <enable/disable>
next
end
SD-WAN with upgrade to 7.0
Due to design change with SD-WAN Template, upgrading to FortiManager 7.0 may be unable to maintain dynamic mappings for all SD-WAN interface members. Please reconfigure all the missing interface mappings after upgrade.
Citrix XenServer default limits and upgrade
Citrix XenServer limits ramdisk to 128M by default. However the FMG-VM64-XEN image is larger than 128M. Before updating to FortiManager 6.4, increase the size of the ramdisk setting on Citrix XenServer.
To increase the size of the ramdisk setting:
- On Citrix XenServer, run the following command:
xenstore-write /mh/limits/pv-ramdisk-max-size 536,870,912
- Confirm the setting is in effect by running
xenstore-ls.-----------------------
limits = ""
pv-kernel-max-size = "33554432"
pv-ramdisk-max-size = "536,870,912"
boot-time = ""
---------------------------
- Remove the pending files left in
/run/xen/pygrub.
|
The ramdisk setting returns to the default value after rebooting. |
Multi-step firmware upgrades
Prior to using the FortiManager to push a multi-step firmware upgrade, confirm the upgrade path matches the path outlined on our support site. To confirm the path, please run:
dia fwmanager show-dev-upgrade-path <device name> <target firmware>
Alternatively, you can push one firmware step at a time.
Hyper-V FortiManager-VM running on an AMD CPU
A Hyper-V FMG-VM running on a PC with an AMD CPU may experience a kernel panic. Fortinet recommends running VMs on an Intel-based PC.
SSLv3 on FortiManager-VM64-AWS
Due to known vulnerabilities in the SSLv3 protocol, FortiManager-VM64-AWS only enables TLSv1 by default. All other models enable both TLSv1 and SSLv3. If you wish to disable SSLv3 support, please run:
config system global
set ssl-protocol t1sv1
end