FortiAuthenticator v2.0 MR1 Release Notes

Transcription

1 FortiAuthenticator v2.0 MR1 Release Notes

2 FortiAuthenticator v2.0 MR1 Release Notes February 28, Copyright 2013 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, and FortiGuard, are registered trademarks of Fortinet, Inc., and other Fortinet names herein may also be trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance metrics contained herein were attained in internal lab tests under ideal conditions, and performance may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to the performance metrics herein. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. Fortinet disclaims in full any guarantees. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable. Technical Documentation Knowledge Base Customer Service & Support Training Services FortiGuard Document Feedback docs.fortinet.com kb.fortinet.com support.fortinet.com training.fortinet.com fortiguard.com techdocs@fortinet.com

3 Table of Contents Change Log... 4 Introduction... 5 Supported models... 5 FortiAuthenticator... 5 FortiAuthenticator VM... 5 Summary of enhancements... 5 Special Notices... 7 General... 7 Important... 7 Monitor settings for Web-based Manager access... 7 Before any upgrade... 7 After any upgrade... 7 Upgrade Information... 8 Upgrading from FortiAuthenticator v Upgrade procedure... 8 Product Integration and Support... 9 Supported web browsers... 9 Resolved Issues Known Issues Image Checksum Appendix A: FortiAuthenticator VM FortiAuthenticator VM system requirements Page 3

4 Change Log Date Change Description Initial Release. Page 4

5 Introduction This document provides a summary of enhancements, support information, installation instructions, integration, resolved and known issues in FortiAuthenticator v2.0 MR1 build Supported models The following models are supported on FortiAuthenticator v2.0 MR1: FortiAuthenticator FAC-200D, FAC-400C, FAC-1000C, and FAC-3000B. FortiAuthenticator VM FAC-VM. See for additional documents on FortiAuthenticator v2.0. Summary of enhancements The following is a list of enhancements in FortiAuthenticator v2.0 MR1: Syslog support Support has been added for logging to a third party system using the syslog protocol. Logs are sent on UDP 514 by default and can be sent with a customizable level (verbosity) and facility (log type). SNMP support Support has been added for SNMP v1/v2c and v3 polling and traps. The supported SNMP MIBs are available from Customer Service & Support on request. FortiCloud SMS Direct support is provided for the FortiCloud SMS service. SMS entitlements can be purchased and uploaded to the FortiAuthenticator and used for SMS token based two-factor authentication. Trial FortiToken Mobile license Previously, trial FortiToken Mobile licenses were only available to licensed FortiAuthenticator units. This feature can now be tested on all FortiAuthenticator devices including unlicensed virtual machines. Two evaluation licenses will be automatically provisioned on device initiation. Ability to configure local server certificate A configuration option has been added to allow the local server certificate to be specified rather than the default self-signed root CA certificate. RADIUS attribute mapping for FSSO Added the ability to receive RADIUS accounting packets and map attributes to local FSSO equivalents. Introduction Page 5 FortiAuthenticator v2.0 MR1 Release Notes

6 Accept RADIUS interim updates as FSSO source In addition to RADIUS start records, interim updates can also be accepted as a source of user authentication information. General FSSO improvements Several improvements have been made to the performance and configuration of FSSO in this release. Please consult the FortiAuthenticator v2.0 Administration Guide for details. Merge support for FAC-200D This release brings the FAC-200D into the regular code stream. Added support for VMWare ESXi 5.1 Introduction Page 6 FortiAuthenticator v2.0 MR1 Release Notes

7 Special Notices General The TFTP boot process erases all current FortiAuthenticator configuration and replaces it with the factory default settings. Important Monitor settings for Web-based Manager access Fortinet recommends setting your monitor to a screen resolution of 1280x1024. This allows for all the objects in the Web-based Manager to be viewed properly. Before any upgrade Save a copy of your FortiAuthenticator unit configuration prior to upgrading. Go to System > Maintenance > Config and select Download Backup File to backup the configuration. After any upgrade If you are using the Web-based Manager, clear your browser cache prior to login on the FortiAuthenticator to ensure the Web-based Manager screens are displayed properly. Special Notices Page 7 FortiAuthenticator v2.0 MR1 Release Notes

8 Upgrade Information Upgrading from FortiAuthenticator v2.0.0 FortiAuthenticator v2.0 MR1 build 0065 officially supports upgrade from FortiAuthenticator v2.0.0 build 0006 or later. Upgrade procedure Fortinet provides FortiAuthenticator software in two formats:.out: Use this image for new and upgrades to physical appliance installations. Upgrades to existing virtual appliance (VM) installations are also distributed in this format. ovf.zip: Use this image for new VM installations. It contains a deployable Open Virtualization Format (OVF) virtual machine package suitable for VMWare ESXi and vsphere installations. Before you can install FortiAuthenticator firmware, you must download the firmware package from the Customer Service & Support web site, then upload it from your computer to the FortiAuthenticator unit. 1. Log in to the Customer Service & Support web site at 2. In the Download section of the page, click the Firmware Images link to download the firmware. 3. To verify the integrity of the download, go back to the Download section of the login page, then click the Firmware Image Checksums link. 4. Log in to the FortiAuthenticator unit s Web-based Manager using the admin administrator account. 5. Go to System > Dashboard > Status. 6. In the System Information widget, in the Firmware Version row, click Upgrade. The Firmware Upgrade or Downgrade dialog box opens. 7. In the Firmware section, click Choose File, and locate the upgrade package that you downloaded. 8. Click OK to upload the file to the appliance. Your browser uploads the firmware file. The time required varies by the size of the file and the speed of your network connection. When the file transfer is complete, the following message is shown: Wait until the unpacking, upgrade and reboot process completes (usually 3-5 minutes), then refresh the page. Upgrade Information Page 8 FortiAuthenticator v2.0 MR1 Release Notes

9 Product Integration and Support Supported web browsers The following web browsers are supported by FortiAuthenticator v2.0 MR1: Microsoft Internet Explorer versions 8 and 9 Mozilla Firefox versions 15 and 16 Google Chrome versions 22 to 24 Other web browsers may function correctly, but are not supported by Fortinet. Product Integration and Support Page 9 FortiAuthenticator v2.0 MR1 Release Notes

10 Resolved Issues The resolved issues table below does not list every bug that has been corrected with FortiAuthenticator v2.0 MR1 build For inquires about a particular bug, please contact Customer Service & Support. Table 1: Resolved issues Bug ID Description The SMS test uses localhost instead of the configured SMTP server Token only authentication fails in the API Web-based Manager crash The LDAP secure connection breaks The web service access confirmation uses an incorrect SMTP port An FSAE daemon crash triggers an internal server error in the SSO monitor FortiToken assignment priority is not observed in rule synchronization Deadlock during HA failover Specify the POST or GET method for SMS gateways EAP authentication does not check for revoked certificates The CA certificate extension should be.crt when exported The simple CA / certificate name should be used in the RADIUS EAP configuration DC does not show in the monitor if no activity is seen The documents URL in the FTM activation code is incorrect LDAP fails when the username used for binding contains uppercase characters User enumeration issue The local user group is not saved in the RADIUS client. Resolved Issues Page 10 FortiAuthenticator v2.0 MR1 Release Notes

11 Known Issues The known issues table below does not list every bug that has been reported with FortiAuthenticator v2.0 MR1 build For inquires about a particular bug, please contact Customer Service & Support. Table 2: Known issues Bug ID Description Unable to authenticate remote PEAP users with a selected LDAP server Authentication users in AD via DN breaks on a OU change. Known Issues Page 11 FortiAuthenticator v2.0 MR1 Release Notes

12 Image Checksum The MD5 checksums for all Fortinet software and firmware releases are available at the Customer Service & Support website located at After logging in, click on Download > Firmware Image Checksum, enter the image file including the extension, and select Get Checksum Code. Figure 1: Firmware image checksum tool Image Checksum Page 12 FortiAuthenticator v2.0 MR1 Release Notes

13 Appendix A: FortiAuthenticator VM FortiAuthenticator VM system requirements The following table provides a detailed summary on FortiAuthenticator VM system requirements. Installing FortiAuthenticator VM requires that you have already installed a supported virtual machine (VM) environment. For details, see the Install Guide for FortiAuthenticator VM available at Table 3: FortiAuthenticator VM system requirements Virtual Machine Requirement Hypervisor Support VMware ESXi / ESX 4.0, 4.1, 5.0 and 5.1 Virtual Machine Form Factor Open Virtualization Format (OVF) Virtual CPUs Supported (Minimum / Maximum) 1 / Unlimited Virtual NICs Supported (Minimum / Maximum) 1 / 4 Storage Support (Minimum / Maximum) 60GB / 2TB Memory Support (Minimum / Maximum) 512 MB / 4GB High Availability Support Yes Page 13

14