u/vabello

Has anyone had any issues upgrading from FortiClient EMS 7.4.7 to 7.4.8?

We upgraded FortiClient EMS from 7.4.7 to 7.4.8. This is running on Ubuntu Server 24.04. Immediately after the upgrade, all installer downloads on TCP 10443 returned HTTP 404, including preexisting 7.4.7 packages and newly created 7.4.8 packages.

The physical installer files existed under /opt/forticlientems/data/clients/installers, were valid regular files, and were readable by Apache’s www-data account. Apache correctly rewrote download requests to the EMS Django /installers/nouid and /installers/fctuid handlers. Both handlers immediately returned HTTP 404 despite correct site=default selection.

Reloading systemd and restarting Apache did not resolve the issue. Restoring the complete pre-upgrade EMS 7.4.7 snapshot immediately restored normal port-10443 file downloads using the same hostname, certificate, network path, storage, and packages.

Has anyone seen the same issue or know of a bug ID or workaround? If not, I'll open a case with TAC.

I know lower end units in 7.6 have frequently seen problems with memory consumption and conserve mode (in my experience) due to the node process. I have other units that have far more memory, but it's apparent the node process still consumes quite a bit. Why?

For example, I'm looking at a 120G cluster which the units have ~16GB of RAM total. The node process is currently use 840MB of RAM. This is on 7.6.6 currently.

So, what's the deal? Is it just a memory leak? Is the node process not properly configured? Is this "normal" on a unit with this much RAM? Obviously if the same behavior were on 2GB units, they'd go into conserve mode, which I think is what I have seen and have worked around by using the Fortinet workaround of constantly restarting the node process on them.

fw1_ck # diagnose sys top-mem 
node (2109): 860450kB
ipsengine (1778): 100578kB
ipsengine (1793): 100470kB
ipsengine (1792): 100143kB
ipsengine (1780): 100101kB
Top-5 memory used: 1261742kB

I've got a 60F in my home lab and just upgraded from 7.6.6 to 7.6.7 yesterday. I noticed I couldn't connect to the web management afterward. It turns out the configuration for the management port reverted back to 443 (previously 8443). Additionally, the hostname was reset back to "FortiGate-60F" and the time zone isn't set. The management is also using the stock SSL certificate rather than my custom one. Current system time shows this as well on the settings screen:

https://preview.redd.it/okn48csql96h1.png?width=726&format=png&auto=webp&s=f300b7a2276a12dc1165d1120056b256ab53baba

I also get this when logging in:

https://preview.redd.it/77lz0l75m96h1.png?width=432&format=png&auto=webp&s=d0483dc5d7f4253cedf74aaba8ba0b12ae526df6

It seems I keep getting prompted to go through the wizard on login to set automatic upgrades. I don't think the settings are sticking.

Everything else that I'm aware of is working fine. Just an odd bunch of configuration settings seem to have been lost or reverted to defaults. I'm going to have to compare the diff and see what else might have gotten lost.

Anyone else see this?

I just happened to notice a batch of FortiGate 120G units I received were Rev2. I couldn't find much information about the revision online, so I figured I'd post here just to share in case the community wasn't largely aware. The short of it is ~16GB of RAM vs the Rev1 ~8GB. Compared to my Rev1 100Fs I just swapped out, these have so much RAM.

Model name: FortiGate-120G
ASIC version: SOC5
CPU: ARMv8
Number of CPUs: 8
RAM: 15554 MB
EMMC: 9982 MB(MLC) /dev/mmcblk0
Hard disk: not available
USB Flash: not available
Network Card chipset: Broadcom 570x Tigon3 Ethernet Adapter (rev.0x5720000)
Network Card chipset: FortiASIC NP7LITE Adapter (rev.)
Hardware Revision: Rev2