FortiWLC Using No and Default Forms of Commands

Using No and Default Forms of Commands

Almost every configuration command has a no form. In general, use the no form to:

Disable a feature or function.
Reset a command to its default values.
Reverse the action of a command.
Use the command without the no form to reenable a disabled feature or to reverse the action of a no command.

Configuration commands can also have a default form. The default form of a command returns the command setting to its default. Most commands are disabled by default, so the default form is the same as the no form. However, some commands are enabled by default and have variables set to certain default values. In these cases, the default command enables the command and sets variables to their default values. The reference page for the command describes these conditions.

FortiWLC Abbreviating Commands

Leave a reply

Abbreviating Commands

You only have to enter enough characters for the CLI to recognize the command as unique. This example shows how to enter the show security command, with the command show abbreviated to sh:

Lab‐mc3200# sh security‐profile default

Security Profile Table

Security Profile Name : default

L2 Modes Allowed : clear

Data Encrypt : none

Primary RADIUS Profile Name :

Secondary RADIUS Profile Name :

WEP Key (Alphanumeric/Hexadecimal) : *****

Static WEP Key Index : 1

Re‐Key Period (seconds) : 0

Captive Portal : disabled

802.1X Network Initiation : off Tunnel Termination: PEAP, TTLS

Shared Key Authentication : off

Pre‐shared Key (Alphanumeric/Hexadecimal) : *****

Group Keying Interval (seconds) : 0

Key Rotation : disabled

Reauthentication : off

MAC Filtering : off

Firewall Capability : none

Firewall Filter ID :

Security Logging : off

Allow mentioned IP/Subnet to pass through Captive portal : 0.0.0.0

Subnet Mask for allowed IP/Subnet to pass through Captive portal : 0.0.0.0

FortiWLC Command Line-Only Commands

1 Reply

Command Line-Only Commands

Many CLI commands have an equivalent functionality in the Web Interface, so you can accomplish a task using either interface. The following lists commands that have no Web Interface functionality.

EXEC Mode Commands

configure terminal
no history
no prompt
no terminal length |width
help
cd
copy (including copy running-config startup-config, copy startup-config running-config and all local/remote copy)
delete flash: image
delete filename
dir [dirname]
debug
disable
enable
exit
quit
more (including more running-config, more log-file, more running-script)
prompt
rename

Command Line-Only Commands

terminal history|size|length|width
traceroute
show history
show running-config
show terminal

Config Mode Commands

do
ip username ftp|scp|sftp
ip password ftp|scp|sftp
show context

Commands that Invoke Applications or Scripts

calendar set
timezone set|menu
date
capture-packets
analyze-capture
debug
diagnostics[-controller]
ping
pwd
shutdown controller force
reload controller default
run
setup
upgrade
downgrade
poweroff
show calendar
show timezones
show file systems
show memory
show cpu-utilization
show processes

Command Line-Only Commands

show flash
show qosflows
show scripts
show station details
show syslog-host
show log
autochannel
rogue-ap log clear
telnet
syslog-host

FortiWLC CLI Concepts

3 Replies

CLI Concepts

Getting Started

To start using the Command Line Interface:

Connect to the controller using the serial console or Ethernet port, or remotely with a telnet or SSH2 connection once the controller has been assigned an IP address.
To assign the controller an IP address, refer to the “Initial Setup” chapter of the FortiWLC (SD) Getting Started Guide.
At the login prompt, enter a user ID and password. By default, the guest and admin user IDs are configured.
- If you log in as the user admin, with the admin password, you are automatically placed in privileged EXEC mode.
- If you log in as the user guest, you are placed in user EXEC mode. From there, you must type the enable command and the password for user admin before you can enter privileged EXEC mode.
- Start executing commands.

CLI Command Modes

The CLI is divided into different command modes, each with its own set of commands and in some modes, one or more submodes. Entering a question mark (?) at the system prompt or anywhere in the command provides a list of commands or options available at the current mode for the command.

User EXEC Mode

When you start a session on the controller, you begin in user mode, also called user EXEC mode. Only a subset of the commands are available in user EXEC mode. For example, most of the user EXEC commands are one-time and display-only commands, such as the show commands, which list the current configuration information, and the clear commands, which clear counters or interfaces. The user EXEC commands are not saved when the controller reboots.

Access method: Begin a session with the controller as the user guest.
Prompt: default>
Exit method: Enter either exit or
Summary: Use this mode to change console settings, obtain system information such as showing system settings and verifying network connectivity.

Privileged EXEC Mode

To access all the commands in the CLI, you need to be in privileged EXEC mode. You can either log in as admin, or enter the enable command at the user EXEC mode and provide the admin password to enter privileged EXEC mode. From this mode, you can enter any privileged EXEC command or enter Global Configuration mode.

Access method: Enter enable while in user EXEC mode, or log in as the user admin.
Prompt: default#
Exit method: Enter • Summary: Use this mode to manage system files and perform some troubleshooting. Change the default password (from Global Configuration mode) to protect access to this mode.

Global Configuration Mode

You make changes to the running configuration by using the Global Configuration mode and its many submodes. Once you save the configuration, the settings are stored and restarted when the controller reboots.

From the Global Configuration mode, you can navigate to various submodes (or branches), to perform more specific configuration functions. Some configuration submodes are security, qosrules, vlan, and so forth. • Description: configures parameters that apply to the controller as a whole.

Access method: Enter configure terminal while in privileged EXEC mode.
Prompt: controller(config)#
Exit method: enter exit, end, or press Ctrl-Z to return to privileged EXEC mode (one level back).
Summary: Use this mode to configure some system settings and to enter additional configuration submodes (security, qosrules, vlan).

FortiWLC 8.4.0 Release Notes

1 Reply

Getting Started with Upgrade

The following table describes the approved upgrade path applicable for all controllers except the new virtual controllers.

NOTE:

FortiWLC-1000D and FortiWLC-3000D controllers can be upgraded only from 8.3 releases.

Supported Upgrade Releases

From FortiWLC release…	To FortiWLC Release…
7.0	7.0-10-0
8.0	8.0-5-0, 8.0-6-0
8.1	8.1-3-2
8.2	8.2.4
8.2.4/8.3	8.3.1
7.0.11, 8.2.7, 8.3.0, 8.3.1, and 8.3.2	8.3.3
7.0-11, 8.2.7, 8.3.0, 8.3.1, 8.3.2, 8.3.3	8.4.0

NOTE:

Fortinet recommends that while upgrading 32-bit controllers to version 8.4.0, use the upgrade controller command instead of the upgrade system
Controller upgrade performed via CLI interface will require a serial or SSH2 connection to connect to the controller and use its CLI. FortiWLC-1000D and FortiWLC-3000D controller upgrades can be performed via GUI as well.

Check Available Free Space

Total free space required is the size of the image + 50MB (approximately 230 MB). You can use the show file systems command to verify the current disk usage.

controller# show file systems

Filesystem 1K-blocks Used Available Use% Mounted on /dev/hdc2 428972 227844 178242 57% /

none 4880 56 4824 2% /dev/shm

The first partition in the above example, /hdc2, although the actual name will vary depending on the version of FortiWLC-SD installed on the controller is the one that must have ample free space.

In the example above, the partition shows 178242KB of free space (shown bolded above), which translates to approximately 178MB. If your system does not have at least 230MB (230000KB) free, use the delete flash:<flash> command to free up space by deleting older flash files until there is enough space to perform the upgrade (on some controllers, this may require deleting the flash file for the current running version).

Set up Serial Connection

Set the serial connection for the following options:

NOTE:

Only one terminal session is supported at a time. Making multiple serial connections causes signalling conflicts, resulting in damage or loss of data.

Baud–115200
Data–8 bits
Parity–None
Stop Bit—1
Flow Control—None

Supported Hardware and Software

This table lists the supported hardware and software versions in this release of FortiWLC.

Hardware and Software			Supported		Unsupported
Access Points			AP122 AP822e, AP822i (v1 & v2) AP832e, AP832i, OAP832e AP332e* AP332i* AP433e* AP433i* OAP433e* FAP-U421EV FAP-U423EV FAP-U321EV FAP-U323EV FAP-U422EV	FAP U221EV FAP U223EV FAP U24JEV AP1010e* AP1010i* AP1020e* AP1020i* AP1014i* AP110*	AP201 AP208 AP150 AP300, AP301, AP302, AP302i, AP301i AP310, AP311, AP320, AP310i, AP320i OAP180 OAP380
*Cannot be configured as a relay AP
Controllers			FortiWLC-50D FortiWLC -200D FortiWLC -500D FortiWLC- 1000D^# FortiWLC -3000D^# FWC- VM-50^# FWC –VM-200^# FWC –VM-500^# FWC –VM-1000^# FWC-VM-3000^#	MC3200, MC3200-VE MC1550, MC1550-VE MC6000 MC4200 (with or without 10G Module) MC4200-VE	MC 5000 MC 4100 MC 1500 MC 1500-VE
^#Spectrum Manager NOT supported in these controller models.
FortiWLM			8.3.3/8.4
FortiConnect			16.8.2
Browsers
FortiWLC (SD) WebUI			Internet Explorer 9,10 Mozilla Firefox 25+ Google Chrome 31+
	NOTE:	ation of Firefox 3.0 and 3.5+ prevents the display of the X-axis legend of dashboard .
	A limit graphs
Captive Portal			Internet Explorer 6, 7, 8, 9, 10, IE11 and Edge. Apple Safari Google Chrome Mozilla Firefox 4.x and earlier Mobile devices (such as Apple iPhone and BlackBerry)

Installing and Upgrading

Follow this procedure to upgrade FortiWLC-50D, FortiWLC-200D, FortiWLC-500D, MC1550, MC1550-VE, MC3200, MC3200-VE, MC4200, MC4200-VE and MC6000 controllers. See section Upgrading FortiWLC-1000D and FortiWLC-3000D to upgrade FortiWLC-1000D and FortiWLC-3000D. See Upgrading Virtual Controllers to upgrade virtual controllers.

Download image files from the remote server to the controller using one of the following commands:

# copy ftp://ftpuser:<password@ext-ip-addr>/<image-name-rpm.tar><space>.

[OR]

# copy tftp://<ext-ip-addr>/<image-name-rpm.tar><space>.

Where

image-name for legacy controllers: meru-{release-version}-{hardware-model}rpm.tar. Eg, meru-8.3-3-MC4200-rpm.tar
image-name for FortiWLC: forti-{release-version}-{hardware-model}-rpm.tar. Eg, forti-8.3-3-FWC2HD-rpm.tar

Disable AP auto upgrade and then upgrade the controller (in config mode)

# auto-ap-upgrade disable

# copy running-config startup-config

# upgrade controller <target version> (Example, upgrade controller 8.3)

The show flash command displays the version details.

Upgrade the APs

# upgrade ap same all

After the APs are up, use the show controller and show ap command to ensure that the controller and APs are upgraded to the latest (upgraded) version. Ensure that the system configuration is available in the controller using the show running‐config command (if not, recover from the remote location). See the Backup Running Configuration step.

Upgrading FortiWLC-1000D and FortiWLC-3000D

To upgrade to FortiWLC-1000D and FortiWLC-3000D, use the following instructions.

In version 8.4.0, the image naming systems have been changed for 64 bit controller models from Primary/Secondary to image0/image1. This change applies to the upgrade procedure in the related FortiWLC GUI screens and CLI commands.

Upgrading via CLI

Use the show imagesc ommand to view the available images in the controller. By default, a new controller will boot from the primary partition which contains the running image.

default(15)# show images

Running image: Primary <—- Denotes Primary Partition

——————————————————————————– Running image details.

System version: 0.3.2

System hash: 11af7a3f3a700d3c8335dc254165282a91bd021b

System branch: master

System built: 20170323191620

System memory: 721M/1006M

Apps version: 8.3-1build-15

Apps size: 1204M/1822M

——————————————————————————– Other image details.

System version: 0.3.3

System hash: 4699cb9f517c4a2abbbce458f689bf3558b5d65e

System branch: master

System built: 20170511180827

System memory: 729M/1015M

Apps version: 8.3-1build-21

Apps size: 1119M/1821M

To install the latest release, download the release image using the upgrade-image command:

upgrade-image scp://<username>@<remote-server-ip>:<path-to-image>/<image- name>-rpm.tar both

reboot

The above command will upgrade the secondary partition and the controller will reboot to secondary partition.

NOTE:

After an upgrade the current partition will shift to the second partition. For example, if you started upgrade in primary partition, post upgrade the default partition becomes secondary partition and vice- versa.

default(15)# show images

Running image: Secondary ß— Current partition after upgrade

——————————————————————————-

Running image details.

System version: 0.3.2

System hash: 11af7a3f3a700d3c8335dc254165282a91bd021b

System branch: master

System built: 20170323191620

System memory: 729M/1015M

Apps version: 8.3-1build-20

Apps size: 1116M/1821M

——————————————————————————-

Other image details.

System version: 0.3.2

System hash: 11af7a3f3a700d3c8335dc254165282a91bd021b

System branch: master

System built: 20170323191620

System memory: 721M/1006M

Apps version: 8.3-1build-15

Apps size: 1204M/1822M

Upgrading via GUI

This section describes the upgrade procedure through the FortiWLC GUI.

NOTE:

Standalone controllers running pre-8.3.3 FortiWLC (except version 0-12) are required to upgrade to 8.3.3 GA and then to the current 8.4.0 version.

Fortinet recommends upgrading via CLI to avoid this issue which occurs due to file size limitation.

This issue does not exist on controllers with manufacturing build as 8.3.3 GA.

To upgrade controllers using GUI, navigate to Maintenance > File Management > SD Version.
Click Import button to choose the image file.

NOTE:

FortiWLC release 8.4.0 introduces software upgrades using the .fwlc format. This format will be supported in the forthcoming releases.

Direct upgrade from a pre-8.4.0 to 8.4.0 release using the .fwlc format is not supported.

After the import is complete, a success message is displayed.

Switching Partitions

To switch partitions in FortiWLC-1000D, FortiWLC-3000D and the new virtual controllers, select the partition during the bootup process.

Upgrading 32-bit 8.3.3 Controllers (MC models, FortiWLC50D/200D/500D) with AP832/822 (without KRACK patch)

Upgrading from FortiWLC 8.3.3 to 8.4.0 results in runtime1 image corruption in AP832 and AP822v1. This is due to a resource leak in the 8.3.3 version which is fixed in later releases.

Follow these steps to upgrade from 8.3.3 to 8.4.0.

Reboot the APs before upgrade.
Run the upgrade controller command to upgrade controllers.
Once the controller is online, upgrade the APs in batches. Before initiating upgrade, ensure all APs are rebooted so that the uptime is less than 5 hours.

NOTE:

Fortinet recommends that you upgrade the 8.3.3 32-bit controller before upgrading the access points due to the issue mentioned in this section.

If KRACK patch is installed on the 8.3.3 32-bit controller then this recommendation does not apply. The controller can be directly upgraded to 8.4.

Upgrading a N+1 Site

To upgrade a site running N+1, all controllers must be on the same FortiWLC-SD version and the backup controller must be in the same subnet as the primary controllers.

NOTE:

64-bit controllers running pre-8.3.3 FortiWLC (except version 0-12) are required to upgrade to the 8.3.3 GA version and then to the current 8.4.0 version.
When upgraded to 8.3.3 GA, the N+1 setup needs to be reconfigured to enable N+1, that is, the master controller should be deleted and then added to the slave controller.

This reconfiguration is not required when upgrading from 8.3.3 GA to 8.4.0.

This issue does not exist on controllers with manufacturing build as 8.3.3 GA.

You can choose any of the following options to upgrade:

Option 1 – Just like you would upgrade any controller, you can upgrade a N+1 controller.
1. Upgrade master and then upgrade slave.
2. After the upgrade, enable master on slave using the nplus1 enable

Option 2 – Upgrade slave and then upgrade master.

After the upgrade, enable master service on slave using the nplus1 enable command.

Option 3 – If there are multiple master controllers
1. Upgrade all master controllers followed by slave controllers. After the upgrade, enable all master controllers on slave controllers using the nplus1 enable
2. To enable master controller on slave controller, use the nplus1 enable
3. Connect to all controllers using SSH or a serial cable.
4. Use the show nplus1 command to verify if the slave and master controllers are in the

The output should display the following information:

Admin: Enable

Switch: Yes

Reason: ‐

SW Version: 8.3-1

If the configuration does not display the above settings, use the nplus1 enable <master‐controller‐ip> command to complete the configuration.
To add any missing master controller to the cluster, use the nplus1 add master

Restore Saved Configuration

After upgrading, restore the saved configuration.

Copy the backup configuration back to the controller:

# copy ftp://<user>:<passswd>@<offbox-ip-address>/runningconfig.txt origconfig.txt

Copy the saved configuration file to the running configuration file:

# copy orig-config.txt running-config

Save the running configuration to the start-up configuration:

# copy running-config startup-config

Upgrading Virtual Controllers

Virtual Controllers can be upgraded the same way as the hardware controllers. See sections Upgrading via CLI, Upgrading via GUI, and Upgrading a N+1 Site.

Download the appropriate Virtual Controller image from Fortinet Customer Support website. For more information on managing the virtual controllers, see the Virtual Wireless Controller Deployment Guide.

Upgrading the controller can be done in the following ways:

Using the FTP, TFTP, SCP, and SFTP protocols.
Navigate to Maintenance < File Management in the FortiWLC GUI to import the downloaded package.

The following are sample commands for upgrading the Virtual Controllers using any of these protocols.

upgrade-image tftp://10.xx.xx.xx:forti-x.x-xbuild-x-x86_64-rpm.tar both reboot
upgrade-image sftp://build@10.xx.xxx.xxx:/home/forti-x.x-xGAbuild-88-FWC1KDrpm.tar both reboot
upgrade-image scp://build@10.xx.xxx.xxx:/home /forti-x.x-xGAbuild-88-FWC1KDrpm.tar both reboot
upgrade-image ftp://anonymous@10.xx.xx.xx:forti-x.x-xbuild-x-x86_64-rpm.tar both reboot

The both option upgrades the Fortinet binaries (rpm) as well as the Kernel (iso), the apps option upgrades only the Fortinet binaries (rpm).

After upgrade, the Virtual Controller should maintain the System-id of the system, unless there were some changes in the fields that are used to generate the system-id. See the to the Licensing section for detailed information.

The International Virtual Controller can be installed, configured, licensed and upgraded the same way.

Upgrade Advisories

The following are upgrade advisories to consider before you begin upgrading your network.

NOTE:

Fortinet recommends upgrading a batch of maximum 100 APs.

Upgrading Virtual Controllers

In the upgrade command, select the options Apps or Both based on these requirements:

Apps: This option will only upgrade the Fortinet binaries (rpm).
Both: This option will upgrade Fortinet binaries as well as kernel (iso).

Upgrading FAP-U422EV

If the controller is running on pre-8.4.0 version and FAP-U422EV is deployed, follow these points:

Disable auto‐ap‐upgrade.

It is advised not to plug in FAP-U422EV till the controller gets upgraded to 8.4.0.

Mesh Deployments

When attempting to upgrade a mesh deployment, you must start upgrading the mesh APs individually, starting with the outermost APs and working inwards towards the gateway APs before upgrading the controller.

Feature Groups in Mesh profile

If APs that are part of a mesh profile are to be added to feature group, all APs of that mesh profile should be added to the same feature group. The Override Group Settings option in the Wireless Interface section in the Configuration > Wireless > Radio page must be enabled on the gateway AP.

Voice Scale Recommendations

The following voice scale settings are recommended if your deployment requires more than 3 concurrent calls to be handled per AP. The voice scale settings are enabled for an operating channel (per radio). When enabled, all APs or SSIDs operating in that channel enhances voice call service. To enable:

In the WebUI, go to Configuration > Devices > System Settings > Scale Settings
Enter a channel number in the Voice Scale Channel List field and click OK.

NOTE:

Enable the voice scale settings only if the channel is meant for voice deployment. After enabling voice scale, the voice calls in that channel take priority over data traffic and this result in a noticeable reduction of throughput in data traffic.

New Features

This section describes the new hardware/software features introduced in this release of FortiWLC.

Fortinet Universal Access Points

The new Fortinet Universal Access Points (FAP-Us) are dual radio, dual band 802.11ac access points. These access points are designed to provide superior experience in data, voice, and video applications in enterprise class deployments.

FAP-U221EV and FAP-U223EV

The FAPs support two 2×2 MIMO radios (band locked) with a single core and comply with the IEEE 802.3af and 802.3at PoE specifications. A maximum of 8 ESS profiles and 128 clients are supported.

FAP-U24JEV

The FAPs support two 1×1 MIMO radios (band locked) with a single core and comply with the IEEE 802.3af and 802.3at PoE specifications. A maximum of 8 ESS profiles and 128 clients are supported.

The FAP has one 2×2 radio which will be always configured as two 1×1 interfaces.

NOTE:

FAP-U221EV, FAP-U223EV, and FAP-U24JEV do not support the following features:

MU-MIMO
LACP
0 – Not supported in version 8.4.0 only.
Enterprise Mesh – Not supported on FAP-U24JEV only.
Application Visibility (DPI)

FAP-U422EV

The FAP is a Wave-2 access point and supports two 4×4 MIMO radios (band locked) with a dual core. This device complies with the 802.3at PoE specifications. A maximum of 16 ESS profiles are supported.

The FAP supports all FortiWLC functionalities same as the FAP-U42xEV.

For more information on the FAPs, see the corresponding Quick Start Guides.

Enhancements

These are the enhancements in this release of FortiWLC.

FAP-U422EV and AP832 are Passpoint R2 certified.
In FortiWLC 8.4.0, the DFS is enabled for FAP-U32xEV FCC & Japan, FAP-U22xEV CE & Japan and FAP-U24JEV CE.
The Simple Service Discovery Protocol (SSDP) is supported for Chromecast discovery.  DNS configuration option is supported for FortiGate discovery.

Additional Information

This section describes information related to the usage of FortiWLC.

Chromecast cast option is visible on the Youtube application only when the publisher or subscriber is in the tunneled mode.
The capture-packets command with -R filer captures all packets instead of filtered packets.

Clients and Encryption Keys

These are the maximum supported clients and encryption/decryption keys for FAP models.

FAP Models	Maximum supported clients/radios			Encryption/Decryption
	VCell	Native Cell		VCell		Native Cell
	VCell	ARRP (Off)	ARRP (On)	Hardware	Software	Hardware	Software
FAP-U42x EV	170	170	256	170	0	256	0
FAP-U32x EV	170	170	256	170	0	256	0
FAP-U22x EV	128	128	128	64	64	64	64
FAP-U24J EV	128	128	128	64	64	64	64

VCell Roaming across Access Points

These are the supported VCell roaming details across APs.

Access

Points

AP122

AP822

AP832

FAP-

U22xEV

FAP-

U32xEV

FAP-

U42xEV

FAP-

U24JEV

AP122

Supported

Supported with 2×2

MIMO mode

Supported with 2×2

MIMO mode

Supported with 2×2

MIMO mode

Supported with 2×2

MIMO mode

Supported with 1×1 mode

AP822

Supported

Supported with 2×2

MIMO mode

Supported

Supported with 2×2

MIMO mode

Supported with 2×2

MIMO mode

Supported with 1×1 mode

AP832

Supported with 2×2

MIMO mode

Supported with 2×2

MIMO mode

Supported

Supported with 2×2

MIMO mode

Supported

Supported with 3×3

MIMO mode

Supported with 1×1 mode

FAP-

U22xEV

Supported with 2×2

MIMO mode

Supported

Supported with 2×2

MIMO mode

Supported

Not

Supported

Not

Supported

Supported with 1×1 mode

FAP-

U32xEV

Supported with 2×2

MIMO mode

Supported with 2×2

MIMO mode

Supported

Not

Supported

Supported with 3×3

MIMO mode

Not

Supported

FAP-

U42xEV

Supported with 2×2

MIMO mode

Supported with 2×2

MIMO mode

Supported with 3×3

MIMO mode

Not

Supported

Supported with 3×3

MIMO mode

Supported

Not

Supported

FAP-

U24JEV

Supported with 1×1

MIMO mode

Supported with 1×1

MIMO mode

Supported with 1×1

MIMO mode

Supported with 1×1

MIMO mode

Not

Supported

Not

Supported

Fixed Issues

These are the fixed issues in this release of FortiWLC.

Bug ID	Description
453607	SNMP results were incomplete for neighboring APs count.
462374	In tunnel mode, STA did not communicate with the wired network after controller fail over.
464122	No framed IP attribute in the accounting start packet.
464687	wncagent spikes while running the event view, GUI and CLI failed to expose the event history.
470393	STA did not receive packets from the wired network after controller fail over.
473365	OAP433 crashes with kernel panic.
448391	The Search/Filter option not available for port profiles in the feature group configuration page of the FortiWLC GUI.
446850	The conn ap command co nnected to a different AP.
449185	AP CommNodeId duplicated in multiple APs.
452055	AP reboots with false FATAL Dead lock detected error.
450379	Channel mismatch on some radios, with primary channel displayed as 44 and operating channel as 40.
457195	sys commands failed in the AP CLI.
455522	With Service Control enabled, the services crashed and restarted.
454144	Wncagent crashes after every one hour.
446296	AP sent Deauth to station by incorrect station type and unknown BSSID.
443669	An incorrect number of stations displayed in the pie charts on the system dashboard.
456464	Device connected but unable to pass traffic.
449409	Nplus1 was disabled when firmware was upgraded on FortiWLC-1000D,
452204	Random AP reboots with exception in APP visibility.
452650, 452649	FAP-U421EV did not auto-negotiate 1Gbps full duplex.
453317, 453316	Random AP832 crashes (NIP [c000d50c] e500_idle+0x90/0x94).
453511	Unable to configure DNS and domain name during the initial setup when the controller was on default setting.
457172	Controller based Captive Portal not working in the Bridged mode for AP822i.
457183	With IE9, incorrect page displayed for the Security Profiles Configuration.
460169	Channel mismatch on some radios, with primary channel displayed as 36 (Non- DFS channel) and operating channel as 100 (DFS Channel).
460587	Unable to edit ESS profiles from the web GUI.
461127	APs lost IP configuration after reboot and came up with default configuration.
446772	CP bypass page displayed even though the client is MAC authenticated and bypass enabled.
381008	Coordinator restarted due to memory issues
435490	All Chromecast devices did not show up in Youtube for casting.
423993	FAP-U421EV access points lost beacons in a virtual cell, causing clients to do assoc-2-assoc.
409488	Error in copying from backup configuration to running configuration.
422065	Controller not sending the RADIUS accounting packet.
462414	When the secondary DNS Server was configured, the secondary NetBIOS server gets the same IP address as the secondary DNS server.
448985	When controller fails over, OUI configuration of client_locater is not taken over to the new active controller.
449154	When the client_locator is enabled and the controller fails over, client_locator is disabled on the new active controller.
470643	Nplus1 configuration fails after firmware upgrade from 8.3 on FortiWLC1000D.
470641	IP address on the slave controller is missing after firmware upgrade from 8.3 on FortiWLC-1000D.
466824	FAP-U321 upgrade fails.
469118	wncagent spikes observed.
470822	FAP-U421 reboots while unable to handle kernel null pointer – LR is at wlc_scbfindband+0x5c/0x130 [wl].
437223	The Console page in Chrome indicates that Adobe Flash is not installed even when it is installed in the Spectrum manager.
438782	Spectrum analysis: Overlay interference is misinterpreted as interference detected by the FAP.
436573	When upgrading from any prior release to 8.3.3, in N+1 configuration the passive slave controller Switch and Reason are No and No Config respectively. This issue occurs on 64-bit Controller models/instances.
470640	Radio Tx Freeze on FAP-U421EV & FAP-U423EV.
351641	[OAP-832] Frequent leaf node reboots with the LOST CONTACT with controller error.
475059	The controller IP address is set to 0.0.0.0 in the VPN administration page post upgrade to 8.4.0.
475307	[FAP-U42x] Radios’ operating channel is different than the configured channel.
439721	High Latency and ping loss observed on clients configured in bridged mode with native and Static VLAN.

Known Issues

These are the known issues in this release of FortiWLC.

Bug ID	Description	Impact	Workaround
450682	Random FAP-U421EV crashes with kernel panic.	FAP reboots which impacts the client connectivity for the duration of AP boot up time.
455780	In some MAC client devices authentication fails and the client is not able to connect. This is due to the delay in processing EAPTLS messages.	This issue is specifically seen in MAC clients, due to the delay in EAP-TLS messages being processed by the AP, in some cases authentication fails because of which clients are not able to connect.	Set the authenticatio n timeout to 3 seconds. For more information, contact the Customer Support.
461937	Sometimes, the FAP-U42x does not tag some packets on bridged data plane.	Data loss on wireless devices.	Connect the AP and run sys perf off.
420129	Fujistu smart phones with AP822 rev2 randomly drop calls and then reconnect to the network. This is due to wrong beacon information.	Glitches during voice calls.	Install the 8.2.7 special build. For more information, contact the Customer Support.
463646	Sometimes in the FAP-U units, in high multicast/broadcast traffic, performance issues and high latency are observed in the bridged mode.	Latency in application usage for wireless clients.	Disable Multicast-to- Unicast Conversion option.
442046	[AP832] Sometimes, the APs do not respond to port 5000, client connectivity affected.	The AP reboots when this condition is encountered.	In 8.4.0, the AP auto reboots when this condition is encountered. For root

			cause fix, contact the Customer Support for installing the relevant patch.
474057	[Virtual FortiWLC] In case of a fresh FortiWLC installation, the gateway does not recognize the services in the FortiWLC GUI. In Monitor > Service Control > Service Details, the Service column is blank.	The Services pie chart in the Service Control Dashboard is not visible, unless the setup command is run or the controller is rebooted.	Run the setup command and reboot the controller.
474593	AP description with sh string gets lost post upgrade.	The AP description is set to default (AP ID).	Avoid using sh string in AP description.
453518	Difference in the AP signal strength on the 5Ghz band while operating in the normal mode and in the site survey mode (country code set to UK).	While doing site survey there will be a difference in signal strength if there is change in TX power other than values of 3 and 4.	Contact the Customer Support for installing the relevant patch.
466751	Sometimes, the APs reboot in a loop when trying to add new APs or doing a bulk reboot.	APs cannot discover the controller.
462324	Sometimes, RADIUS requests are sent with the same port number for different IDs.	TLS errors for the clients see at RADIUS end. No impact on connectivity.
463626	Round trip delays are observed randomly at wired side of AP822i after AP reboots.	Latency on wireless clients.	In 8.4.0, reboot the AP. For root cause fix, contact the Customer Support for installing the relevant
			patch.
463851, 448621	[FortiWLC-3000D/1000D] Sometimes in multiple upgrade scenarios spanning over releases, unable to add the master controller in slave controller in an N+1 setup.		Contact the Customer Support.
456513	Sometimes, AP832 connected to Cisco WS-C2960X-48FPD-L comes up as 802.3af and not 802.3at with the BLE dongle.	BLE is disabled.	Contact the Customer Support for installing the relevant patch.
464308	APs Stuck in Disabled/Online state after reboot. This issue is observed under scale deployments, for example, rebooting 100+ APs at the same time.	Client connectivity affected till the AP reboots.	Reboot the AP.
464541	Wired Port profile in Mesh uplink port gets lost after upgrade to FortiWLC 8.4.0.	Wired clients cannot access the network.	Recreate the port interface for the AP.

Known Issues in FAP-U422/FAP-U24J/FAP-U22xEV

Bug ID	Description	Impact	Workaround
451168	FAP-U24JEV/FAP-U22xEV- DTIM functionality is not working. PS-Poll based power-save clients fail to receive multicast traffic when the Multicast-to-Unicast Conversion option is disabled in the ESS profile.	Power-save clients fail to receive the multicast traffic sometimes and the battery life of wireless device is drained.	Enable the Multicastto-Unicast Conversion option [Default setting].
453903	FAP-U24JEV – Client mitigation fails when the Rogue AP detection feature enabled.	Mitigation fails in cases of Rogue AP operating in foreign channel.
474882	[FAP-U22x] Phy tx error with fatal error reinitializing and psm watchdog observed randomly on Radio 0/1 interface.	Data loss is observed when the error is reported till it recovers.

Common Vulnerabilities and Exposures

This release of FortiWLC is no longer vulnerable to the following:

Bug ID	Vulnerability
450012	• CVE-2017-1000251 • CVE-2017-1000250
454662	• CVE-2017-13077 to CVE-2017-13082 • CVE-2017-13084 • CVE-2017-13086 to CVE-2017-13088
461748	CVE –2016 –8491
443753	Broadcom ESDK vulnerability fix.

Visit https://fortiguard.com/psirt for more information.

FortiOS IPS Engine version 3.443

Leave a reply

Introduction

This document provides the following information for FortiOS IPS Engine version 3.443.

Bug ID	Description
443479	Support for FortiSandbox Sniffer user defined file extensions.

l What’s New in IPS Engine 3.443 l Product Integration and Support l Resolved Issues

For additional FortiOS documentation, see the Fortinet Document Library.

What’s New in IPS Engine 3.443

Product Integration and Support

Fortinet Product Support

The following table lists IPS engine product integration and support information:

FortiOS

5.2.0 and later

5.4.0 and later

5.6.0 and later

FortiClient

5.4.0 and later (Windows and Mac)

5.6.0 and later (Windows and Mac)

Resolved Issues

The resolved issues listed below do not list every bug that has been corrected with this release. For inquires about a particular bug, please contact Customer Service & Support.

Bug ID	Description
446858	Fixed a crash caused by a NULL pointer de-reference.
445900 446782	Fixed two SSL deep inspection bugs.
444268	Fix IPS engine high CPU usage caused by TCP RST packets with data.
444811	Fix a crash in the IPS HTTP decoder on some proxy traffic. Fixed IPS_CONTEXT_URI_ DECODED context field_start and field_end value for proxy traffic.
440277	Fixed a random detection miss, and a random crash in SSL packet scanning.
411415	Support session clearing by VDOM.
379449	Updated the Brotli library to match the version used by Chromium 61.
450442	Fixed crashes caused by configuration errors in IPS sensors.
444237	Fixed two bugs in the SMB2 decoder that may cause high memory usage.
403562	Fixed a bug that could cause FortiOS to enter conserve mode because of memory corruption.
451677	Fixed a bug that caused the IPS engine to incorrectly identify Phoenix PACS traffic as BitTorrent traffic.
451763	Fixed a bug that caused the IPS engine to drop STUN packets because they were identified as partial SSL records.
460391	Fix crashes in the update_ftp_scan_ret function.
448646	Fix high CPU usage caused by retransmission bugs.
450693 460635	Fixed a bug that caused the ERR_SSL_DECRYPT_ERROR_ALERT message when SSL deep scanning is enabled.

What’s New in AV Engine 5.355

Leave a reply

What’s New in AV Engine 5.355

New features

Support for opening ACE, ISO, and CRX compression formats. l New Content Disarm and Reconstruction (CDR) feature. l Script checksum support for HTML files.
Support for hidden zlib files in Object Linking and Embedding (OLE) content. l New scan timeout control framework.

Enhancements

Content Pattern Recognition Language (CPRL) signature runtime performance improvements. l Win32 emulator optimization. l APK and ZIP decompression optimization. l Accelerated checksum calculation.
File typing supports more file types including Dotnet, CHM, Mach-O, DMG and XAR, and RTF. l Script file typing improvements.

AV Engine for FortiOS and FortiAP-S Release Notes 5

Fortinet Technologies Inc.

Fortinet Product Support Product Integration and Support

Product Integration and Support

Fortinet Product Support

The following table lists AV engine product integration and support information:

FortiOS

5.4.0 and later

5.6.0 and later

FortiAP-S

5.4.0 and later

5.6.0 and later

6 AV Engine for FortiOS and FortiAP-S Release Notes

Fortinet Technologies Inc.

Resolved Issues AV engine

Resolved Issues

The resolved issues listed below do not list every bug that has been corrected with this release. For inquires about a particular bug, please contact Customer Service & Support.

AV engine

Bug ID	Description
453487	Add support for gzip files with flag’s reserved bits set
453982	Apply more signatures on RTF files.
413069	Fixed a crash in the JS emulator.
421545	Fixed a signature loading failure bug on FortiOS SOC3 platforms.
	Fixed potential memory issues found by fuzzing in GZIP, CAB and HTML parsing.
413625	Fixed Win32Emulator performance down bug.
	Fixed memory leaks and overflows in pyarch, sis, and rar decompression.
	Fixed potential memory bugs in autoit, arj and aspack decompression.
440519	Flag UPX as archive bomb if the decompressed size is 100 times greater than original file size.
	Fixed AV engine X86_64 crash on Windows 10 build 1703.

FortiOS

Bug ID	Description
467820	Fixed missing file names for RAR v5.0.
458192	MSI and KGB file types are now on the list to be sent to FortiSandbox as potentially suspicious files.

FPM-7620E processing module

Leave a reply

FPM-7620E processing module

The FPM-7620E processing module is a high-performance worker module that processes sessions load balanced to it by FortiGate-7000 series interface (FIM) modules over the chassis fabric backplane. The FPM-7620E can be installed in any FortiGate-7000 series chassis in slots 3 and up.

The FPM-7620E includes two 80Gbps connections to the chassis fabric backplane and two 1Gbps connections to the base backplane. The FPM-7620E processes sessions using a dual CPU configuration, accelerates network traffic processing with 4 NP6 processors and accelerates content processing with 8 CP9 processors. The NP6 network processors are connected by the FIM switch fabric so all supported traffic types can be fast path accelerated by the NP6 processors.

The FPM-7620E includes the following hardware features:

Two 80Gbps fabric backplane channels for load balanced sessions from the FIM modules installed in the chassis. l Two 1Gbps base backplane channels for management, heartbeat and session sync communication. l Dual CPUs for high performance operation. l Four NP6 processors to offload network processing from the CPUs. l Eight CP9 processors to offload content processing and SSL and IPsec encryption from the CPUs. FPM-7620E front panel
Power button. l NMI switch (for troubleshooting as recommended by Fortinet Support). l Mounting hardware.
LED status indicators.

FPM-7620E processing module Physical Description

Physical Description

Dimensions	1.2 x 11.34 x 14 in. (3.1 x 28.8 x 35.1 cm) (Height x Width x Depth)
Weight	7.2 lb. (3.23 kg)
Operating Temperature	32 to 104°F (0 to 40°C)
Storage Temperature	-31 to 158°F (-35 to 70°C)
Relative Humidity	10% to 90% non-condensing

Front Panel LEDs

LED State		Description
STATUS	Off	The FPM-7620E is powered off.
	Green	The FPM-7620E is powered on and operating normally.
	Flashing Green	The FPM-7620E is starting up.
ALARM	Red	Major alarm.
	Amber	Minor alarm
	Off	No alarms
POWER	Green	The FPM-7620E is powered on and operating normally.
POWER	Off	The FPM-7620E is powered off.

Turning the module on and off

You can use the front panel power button to turn the module power on or off. If the module is powered on, press the power switch to turn it off. If the module is turned off and installed in a chassis slot, press the power button to turn it on.

NMI switch FPM-7620E processing module

NMI switch

When working with Fortinet Support to troubleshoot problems with the FPM-7620E you can use the front panel non-maskable interrupt (NMI) switch to assist with troubleshooting. Pressing this switch causes the software to dump registers/backtraces to the console. After the data is dumped the board reboots. While the board is rebooting, traffic is temporarily blocked. The board should restart normally and traffic can resume once its up and running.

NP6 network processors – offloading load balancing and network traffic

The four FPM-7620E NP6 network processors combined with the FIM module integrated switch fabric (ISF) provide hardware acceleration by offloading load balancing from the FPM-7620E CPUs. The result is enhanced network performance provided by the NP6 processors plus the network processing load is removed from the CPU. The NP6 processor can also handle some CPU intensive tasks, like IPsec VPN encryption/decryption. Because of the integrated switch fabric, all sessions are fast-pathed and accelerated.

FPM-7620E processing module Accelerated IPS, SSL VPN, and IPsec VPN (CP9 content processors)

Accelerated IPS, SSL VPN, and IPsec VPN (CP9 content processors)

The FPM-7620E includes eight CP9 processors that provide the following performance enhancements:

Flow-based inspection (IPS, application control etc.) pattern matching acceleration with over 10Gbps throughput l IPS pre-scan l IPS signature correlation l Full match processors
High performance VPN bulk data engine l IPsec and SSL/TLS protocol processor l DES/3DES/AES128/192/256 in accordance with FIPS46-3/FIPS81/FIPS197 l MD5/SHA-1/SHA256/384/512-96/128/192/256 with RFC1321 and FIPS180 l HMAC in accordance with RFC2104/2403/2404 and FIPS198 l ESN mode
GCM support for NSA “Suite B” (RFC6379/RFC6460) including GCM-128/256; GMAC-128/256
Key Exchange Processor that supports high performance IKE and RSA computation l Public key exponentiation engine with hardware CRT support l Primary checking for RSA key generation l Handshake accelerator with automatic key material generation l True Random Number generator l Elliptic Curve support for NSA “Suite B” l Sub public key engine (PKCE) to support up to 4096 bit operation directly (4k for DH and 8k for RSA with CRT)
DLP fingerprint support l TTTD (Two-Thresholds-Two-Divisors) content chunking l Two thresholds and two divisors are configurable

FPM-7620E mounting components

Hardware installation

This chapter describes installing a FPM-7620E processing module into a FortiGate-7000 chassis.

FPM-7620E mounting components

To install a FPM-7620E you slide the module into slot 3 or up in the front of an FortiGate-7000 series chassis and then use the mounting components to lock the module into place in the slot. When locked into place and positioned correctly the module front panel is flush with the chassis front panel. The module is also connected to the chassis backplane.

To position the module correctly you must use the mounting components shown below for the right of the FPM7620E front panel. The mounting components on the left of the front panel are the same but reversed. The FPM7620E mounting components align the module in the chassis slot and are used to insert and eject the module from the slot.

Open Closed

(when open the latch slides up about 2 mm)

The FPM-7620E handles align the module in the chassis slot and are used to insert and eject the module from the slot. The latches activate micro switches that turn on or turn off power to the module. When both latches are raised the module cannot receive power. When the latches are fully closed if the module is fully inserted into a chassis slot the module can receive power.

Inserting a FPM-7620E module into a chassis

This section describes how to install a FPM-7620E module into a FortiGate-7000 series chassis slot 3 or up.

You must carefully slide the module all the way into the chassis slot, close the handles to seat the module into the slot, and tighten the retention screws to make sure the module is fully engaged with the backplane and secured. You must also make sure that the sliding latches are fully closed by gently pushing them down. The handles must be closed, the retention screws tightened and the latches fully closed for the module to get power and start up. If the module is not receiving power all LEDs remain off.

FPM-7620Es are hot swappable. The procedure for inserting a FPM-7620E into a chassis slot is the same whether or not the chassis is powered on.

To insert a FPM-7620E into a chassis slot

Do not carry the FPM-7620E by holding the handles or retention screws. When inserting or removing the FPM-7620E from a chassis slot, handle the module by the front panel. The handles are not designed for carrying the board. If the handles become bent or damaged the FPM-7620E may not align correctly in the chassis slot.

To complete this procedure, you need: l A FPM-7620E

A FortiGate-7000 chassis with an empty hub/switch slot
An electrostatic discharge (ESD) preventive wrist strap with connection cord

FPM-7620Es must be protected from static discharge and physical shock. Only handle or work with FPM-7620Es at a static-free workstation. Always wear a grounded electrostatic discharge (ESD) preventive wrist strap when handling FPM-7620Es. Attach the ESD wrist strap to your wrist and to an ESD socket or to a bare metal surface on the chassis or frame. (An ESD wrist strap is not visible in the photographs below because they were taken in an ESD safe lab environment.)

Inserting a FPM-7620E module into a chassis

Remove the FPM-7620E module from its packaging. Align the module with the chassis slot and slide the module part way into the slot.

In the photograph the FPM-7620E is being installed into chassis slot 4 of a FortiGate-7040E chassis.

Unlock the left and right handles by pushing the handle latches up about 2 mm until the handles pop open.

Fully open both handles before sliding the module into the chassis to avoid damaging the handle mechanism.

Damaging the handles may prevent the module from connecting to power.

Carefully slide the module into the slot until the handles engage with the sides of the chassis slot, partially closing the them.

Insert the module by applying moderate force to the front faceplate (not the handles) to slide the module into the slot. The module should glide smoothly into the chassis slot. If you encounter any resistance while sliding the module in, the module could be aligned incorrectly. Pull the module back out and try inserting it again.

Inserting a FPM-7620E module into a chassis

Push both handles closed and close the latches.

Closing the handles draws the module into place in the chassis slot and into full contact with the chassis backplane. The module front panel should be in contact with the chassis front panel and the latches should drop down and lock into place. You should gently push the latches down to make sure they lock. The module will not receive power until the latches are fully locked.

Tighten both retention screws to secure the module in the chassis.

You can tighten the retention screws by hand with a Phillips screwdriver. If you use a power screwdriver the tightening torque needs to be adjusted between 3 In-lb to 4 In-lb (0.4 N-m to 0.48 N-m).

As the latches are locked, power is supplied to the module. If the chassis is powered on during insertion the status LED flashes green as the module starts up. Once the board has started up and is operating correctly, the front panel LEDs are lit for normal operation.

Normal LED operation

LED		State
Status		Green
Alarm		Off
Power		Green

Shutting down and removing a FPM-7620E board from a chassis

To avoid potential hardware problems, always shut down the FPM-7620E operating system properly before removing the FPM-7620E from a chassis slot or before powering down the chassis.

Disconnect all cables from the FPM-7620E module, including all network cables and USB cables or keys.

FPM-7620Es are hot swappable. The procedure for removing a FPM-7620E from a chassis slot is the same whether or not the chassis is powered on.

To remove a FPM-7620E board from a chassis slot

Do not carry the FPM-7620E by holding the handles or retention screws. When inserting or removing the FPM-7620E from a chassis slot, handle the module by the front panel. The handles are not designed for carrying the board. If the handles become bent or damaged theFPM-7620E may not align correctly in the chassis slot.

To complete this procedure, you need:

l A FortiGate-7000 chassis with a FPM-7620E module installed l An electrostatic discharge (ESD) preventive wrist strap with connection cord

ESD safe lab environment.)

Shutting down and removing board from

Fully loosen the retention screws.

You must fully loosen the screws or the handles may be damaged when used to eject the board from the chassis slot.

Unlock the left and right handles by pushing the latches up about 2 mm until the handles pop open.

Shutting down and removing a FPM-7620E board from a chassis

Fully open the handles to eject the module from the chassis.

You need to open the handles with moderate force to eject the module from the chassis.

Hold the module front panel sides and slide it part way out of the slot. Then grasp the module by the sides and carefully slide it out of the slot.

Troubleshooting

This section describes some common troubleshooting topics:

FPM-7620E does not startup

Positioning of FPM-7620E handles and a few other causes may prevent a FPM-7620E from starting up correctly.

Latches and handles not fully closed

If the latches or handles are damaged or positioned incorrectly the FPM-7620E may not start up. Make sure the latches are fully closed and the handles are correctly aligned, fully inserted and locked and the retention screws are tightened.

Firmware problem

If the FPM-7620E is receiving power and the latches are handles are fully closed, and you have restarted the chassis and the FPM-7620E still does not start up, the problem could be with FortiOS. Connect to the FPM7620E console and try cycling the power to the board. If the BIOS starts up, interrupt the BIOS startup and install a new firmware image.

If this does not solve the problem, contact Fortinet Technical Support.

FPM-7620E status LED is flashing during system operation

Normally, the FPM-7620E Status LED is off when the FPM-7620E is operating normally. If this LED starts flashing while the module is operating, a fault condition may exist. At the same time the FPM-7620E may stop processing traffic.

To resolve the problem you can try removing and reinserting the FPM-7620E in the chassis slot. Reloading the firmware may also help.

If this does not solve the problem there may have been a hardware failure or other problem. Contact Fortinet Technical Support for assistance.