Special notices

FortiController 5.2.10 supports FortiOS 5.6.6 or later or 6.0.3 or later

Before you upgrade your FortiController firmware to 5.2.10, you must upgrade the FortiOS firmware running on the FortiGates in the SLBC cluster to FortiOS 5.6.6 or later or FortiOS 6.0.3 or later. Running older versions of FortiOS may cause IPsec VPN issues. FortiController 5.2.10 is not compatible with FortiOS 6.0.0, 6.0.1, or 6.0.2.

FortiController 5.2.10 trusted host limitation

FortiController 5.2.10 supports creating a maximum of 140 trusted hosts. Creating more than 140 trusted hosts is allowed by the CLI, but creating more than 140 trusted hosts can block management access over special management ports to the FortiController and FortiGates in the secondary chassis in an FGCP HA configuration.

FortiGates in an SLBC cluster can go out of sync after a FortiGuard update

When operating normally, FortiOS uses a collection of CAs (called a CA bundle) for various certificate-related functions. FortiOS normally gets the latest CA bundle from FortiGuard.

FOS firmware images come with their own CA bundle. Immediately after a firmware upgrade, all of the FortiGates in a Session-aware Load Balancing Cluster (SLBC) will have the CA bundle that comes with the firmware image. When the first automatic or manual FortiGuard update occurs, the primary FortiGate in the SLBC downloads the latest CA bundle from FortiGuard and synchronizes it to the other FortiGates in the cluster. Due to a known issue with FortiOS 5.6.7 and earlier, this synchronization step may fail, resulting in a synchronization problem with the cluster.

You can avoid this issue by using the following steps to upgrade the firmware of the FortiGates in an SLBC cluster, perform a FortiGuard update, and manually re-synchronize the configuration:

1. Log in to the primary FortiGate and enter the following command to disable graceful-upgrade.

   config system elbc

   set graceful-upgrade disable

   end

2. Use the normal firmware upgrade procedure to upgrade the SLBC firmware.
3. After all of the FortiGates have restarted and joined the cluster, log into the primary FortGate and use the diagnose sys confsync status command to verify that the primary FortiGate can communicate with all of the FortiGates in the cluster.
4. Enter diagnose autoupdate versions | grep -A2 'Bundle' to check the version of CA bundle on the primary FortiGate (for example, for FOS v5.6.7, the version should be 1.00012).
5. Start a FortiGuard update on the primary FortiGate. For example, use the execute update-now command.
6. Wait a few minutes, then enter diagnose autoupdate versions | grep -A2 'Bundle' to verify that a new CA bundle has been installed.
7. Backup the configuration of the primary FortiGate.
8. Restore the configuration of the primary FortiGate.
   The primary FortiGate synchronizes its configuration to all of the FortiGates in the cluster. After a few minutes, all of the FortiGates should restart and the cluster configuration should be synchronized.
9. Use the diagnose sys confsync status command to verify that the cluster is synchronized.