Professional Documents
Culture Documents
Fortiweb v6.3.6 Release Notes
Fortiweb v6.3.6 Release Notes
VERSION 6.3.6
FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com
FORTINET VIDEO GUIDE
https://video.fortinet.com
FORTINET BLOG
https://blog.fortinet.com
CUSTOMER SERVICE & SUPPORT
https://support.fortinet.com
FORTINET COOKBOOK
https://cookbook.fortinet.com
FORTINET TRAINING & CERTIFICATION PROGRAM
https://www.fortinet.com/support-and-training/training.html
NSE INSTITUTE
https://training.fortinet.com
FORTIGUARD CENTER
https://fortiguard.com/
END USER LICENSE AGREEMENT
https://www.fortinet.com/doc/legal/EULA.pdf
FEEDBACK
Email: [email protected]
TABLE OF CONTENTS
Change log 4
Introduction 5
What's new 6
New features 6
Enhancements 8
Upgrade instructions 10
Hardware , VM, cloud platforms, and browsers support 10
Image checksums 11
Upgrading from previous releases 11
Repartitioning the hard disk 14
To use the special firmware image to repartition the operating system's disk 15
To repartition the operating system's disk without the special firmware image 15
Upgrading an HA cluster 17
Downgrading to a previous release 17
FortiWeb-VM license validation after upgrade from pre-5.4 version 17
Resolved issues 19
Known issues 20
Change log
Introduction
This document provides information about new and enhanced features, installation instructions, resolved issues, and
known issues for FortiWeb 6.3.6, build 1075.
FortiWeb is a web application firewall (WAF) that protects hosted web applications from attacks that target known and
unknown exploits. Using multi-layered and correlated detection methods, FortiWeb defends applications from known
vulnerabilities and zero-day threats. The Web Application Security Service from FortiGuard Labs uses information
based on the latest application vulnerabilities, bots, suspicious URL and data patterns, and specialized heuristic
detection engines to keep your applications safe.
FortiWeb also offers a machine-learning function that enables it to automatically detect malicious web traffic. In
addition to detecting known attacks, the feature can detect potential unknown zero-day attacks to provide real-time
protection for web servers.
FortiWeb allows you to configure these features:
l Vulnerability scanning and patching
l IP reputation, web application attack signatures, credential stuffing defense, anti-virus, and FortiSandbox Cloud
powered by FortiGuard
l Real-time attack insights and reporting with advanced visual analytics tools
l Integration with FortiGate and FortiSandbox for ATP detection
l Behavioral attack detection
l Advanced false positive and negative detection avoidance
FortiWeb hardware and virtual machine platforms are available for medium and large enterprises, as well as for service
providers.
For additional documentation, please visit the FortiWeb documentation:
http://docs.fortinet.com/fortiweb/
What's new
New features
You can now back up system configuration and web protection profiles to FortiWeb disk.
For more information, see Backup & restore.
Machine learning data backup
You can set ml-flag to back up machine learning data when executing full-config backup.
FortiWeb 100E is introduced to replace 100D. It has better performance than 100D.
New RESTful API
New RESTful API is introduced in FortiWeb in this release.
For more information ,see FortiWeb RESTful API reference.
Enhancements
Optimization on Certificates
l Certificates tab is moved from System to Server Objects.
l Local and Multi-certificate tabs are integrated into Local in Server Objects > Certificates.
l Certificate Verify and Server Certificate Verify tabs are integrated into Certificate Verify in Server Objects >
Certificates.
WCCP Client configurable only in WCCP mode
When in non-WCCP modes, WCCP Client tab is invisible and non-configurable from GUI.
For more information, see Configuring FortiWeb to receive traffic via WCCP.
Multiple features integrated in feature visibility
You can customize more features shown on GUI by setting them in System > Config > Feature Visibility.
For more information, see Feature visibility.
Signature scan enhancement
The response body of content types including binary, media, and picture are no longer scanned against signature rules.
Support HEX decoding for HTTP arguments
FortiWeb's HTTP parser now supports decoding the parameter values containing HEX characters.
Enhancements on the trust items
FortiWeb no longer executes subsequent scans for the items listed in IP List, Global White List, and Known Bots. This
reduces false positives and improves performance.
Add exceptions of SQL/XSS Syntax Based Detection from attack log
FortiWeb now supports adding SQL/XSS Syntax Based Detection exceptions from attack logs.
Add exceptions of Known Bots from attack log
FortiWeb now supports adding Known Bots exceptions from attack logs.
XML Entities check enhancement
FortiWeb will not download external entity references when it checks the XML format, and it will not treat the XML as
"XML Format error" if it can't find the external definition.
Client Management debug
The client Management debug information can be printed using the command diagnose debug application
client-management.
Changes of supported SSL ciphers
The following changes are implemented for the Customized SSL ciphers list.
New added:
l ECDHE-ARIA128-GCM-SHA256
l DHE-RSA-ARIA128-GCM-SHA256
l DHE-RSA-ARIA256-GCM-SHA384
l ECDHE-ARIA256-GCM-SHA384
No longer supported:
l DHE-RSA-CAMELLIA128-SHA
l DHE-DSS-CAMELLIA128-SHA
l CAMELLIA256-SHA
l CAMELLIA128-SHA
For a complete SSL ciphers list supported by FortiWeb, see Supported cipher suites & protocol versions.
Brute Force Login removed from predefined custom policy
To avoid false positives, Brute Force Login is removed from the predefined custom policies.
Bot confirmation disabled in predefined Brute Force Login Alert Only custom rule
Bot confirmation is disabled as the alert only custom rule is not supposed to block requests.
GEO DB package upload moved to FortiGuard
The GEO DB setting is moved from System > Config > Maintenance to System > Config > FortiGuard.
FortiSandbox connectivity status moved
The FortiSandbox connectivity status is displayed on the FortiSandbox page instead of the landing page widget.
Page Access and Start Pages modules completely removed
Page Access and Start Pages modules were removed from GUI in 630. Now the CLI commands of these two modules
are also removed.
Upgrade instructions
Supported Hardware:
l FortiWeb 100D
l FortiWeb 400C
l FortiWeb 400D
l FortiWeb 400E
l FortiWeb 600D
l FortiWeb 600E
l FortiWeb 1000D
l FortiWeb 1000E
l FortiWeb 2000E
l FortiWeb 3000D/3000DFsx
l FortiWeb 3000E
l FortiWeb 3010E
l FortiWeb 4000D
l FortiWeb 4000E
l FortiWeb 100E
Supported hypervisor versions:
l VMware vSphere Hypervisor ESX/ESXi 4.0/4.1/5.0/5.1/5.5/6.0/6.5/6.7
l Citrix XenServer 6.2/6.5/7.1
l Open source Xen Project (Hypervisor) 4.9 and higher versions.
l Microsoft Hyper-V (version 6.2 or higher, running on Windows 8 or higher, or Windows Server 2012/2016/2019)
l KVM (Linux kernel 2.6, 3.0, or 3.1)
l OpenStack Queens 17.0.5
l Docker Engine CE 18.09.1 or higher versions, and the equivalent Docker Engine EE versions; Ubuntu18.04.1 LTS
or higher versions.
l Nutanix AHV
FortiWeb is tested and proved to function well on the hypervisor versions listed above. Later hypervisor releases may
work but have not been tested yet.
Supported cloud platforms:
l AWS (Amazon Web Services)
l Microsoft Azure
l Google Cloud
l OCI (Oracle Cloud Infrastructure)
l Alibaba Cloud
Supported web browsers:
l Microsoft Edge 41
l Mozilla Firefox version 59
l Google Chrome version 65
Other web browsers may function correctly, but are not supported by Fortinet.
Image checksums
To verify the integrity of the firmware file, use a checksum tool to compute the firmware file’s MD5 checksum. Compare
it with the checksum indicated by Fortinet. If the checksums match, the file is intact.
MD5 checksums for software releases are available from Fortinet Customer Service & Support:
https://support.fortinet.com
After logging in to the website, in the menus at the top of the page, click Download, and then click Firmware Image
Checksums.
Alternatively, near the bottom of the page, click the Firmware Image Checksums button. This button appears only if
one or more of your devices has a current support contract. In the File Name field, enter the firmware image file name
including its extension, then click Get Checksum Code.
For FortiWeb-VM with a license purchased earlier than February 2019, you must upgrade to
6.3.4 or higher. Do not use a lower patch.
Upgrade directly.
Upgrade directly.
The machine learning data will be lost after the upgrade as the database format is enhanced in 6.3.0. Machine Learning
will automatically start collecting data again after the upgrade.
For FortiWeb-VM on docker platform, it's not supported to upgrade to 6.3.6 from versions
earlier than 6.3.0. You need to install FortiWeb-VM 6.3.6 instead of upgrading to 6.3.6. For
how to install, see FortiWeb-VM on docker.
The machine learning data will be lost after the upgrade as the database format
is enhanced in 6.3.0. Machine Learning will automatically start collecting data
again after the upgrade.
For FortiWeb-VM on docker platform, it's not supported to upgrade to 6.3.6 from versions
earlier than 6.3.0. You need to install FortiWeb-VM 6.3.6 instead of upgrading to 6.3.6. For
how to install, see FortiWeb-VM on docker.
If you upgrade from a version of FortiWeb previous to 5.5.4, the upgrade process deletes any
HTTP content routing policies that match X509 certificate content. You can re-create these
policies using the new, enhanced X509 certificate settings.
l Resize your FortiWeb hard disk partitions. See Repartitioning the hard disk.
After the upgrade:
l There might be database compatibility issue after the upgrade, because the MarisDB database version is upgraded
to 10.3.8 since FortiWeb 6.0.2.
l Run get system status to check the Database Status.
l If it shows Available, it means the database works well. If it shows Not Available, you need to run
execute db rebuild to solve the database compatibility issue. Please note in HA mode, running
execute db rebuild on master appliance will take effect on all slaves simultaneously.
The upgrade process deletes any HTTP content routing policies that match X509 certificate
content. You can re-create these policies using the new, enhanced X509 certificate settings.
l If you are upgrading FortiWeb-VM on a hypervisor other than VMware vSphere, see
FortiWeb-VM license validation after upgrade from pre-5.4 version.
l The upgrade process deletes any HTTP content routing policies that match X509 certificate
content. You can re-create these policies using the new, enhanced X509 certificate settings.
l If you upgrade from a version of FortiWeb previous to 5.3.4 and your server policy
configuration includes settings that customize an attack blocking or server unavailable error
page, the upgrade deletes these server-based settings. The functionality is replaced by the
global, default FortiWeb pages.
l If you upgrade from a version of FortiWeb previous to 5.3.6, the upgrade process deletes
any V-zone IP addresses, which are no longer required. This operation has no impact on
routing or connectivity after the upgrade.
FWB5.3.exe is a Microsoft Windows executable script that automatically migrates your FortiWeb 5.2.x configuration
settings to a 5.3.x configuration.
1. If your version is 5.0.x or 5.1.x, upgrade to FortiWeb 5.2.x.
2. Use System > Maintenance > Backup & Restore to back up your FortiWeb configuration. Fortinet
recommends that you use the Backup entire configuration option.
Note: If you forget to back up the configuration before you upgrade to FortiWeb 5.3, you can use the Boot into
alternate firmware option to downgrade to the previous version, and then backup its configuration. For details,
see the FortiWeb Administration Guide:
http://docs.fortinet.com/fortiweb/admin-guides
3. To obtain the upgrade script, log in to the Fortinet Customer Service & Support website:
https://support.fortinet.com
In the menus at the top of the page, click Download, and then click Firmware Images.
4. For product, select FortiWeb. Then, on the Download tab, navigate to the following folder:
/FortiWeb/v5.00/5.3/Upgrade_script/
5. Download the .zip compressed archive (for example, FWB5.3Upgrade_v1.9.zip) to a location you can access
from your Windows PC.
6. In Windows, extract the .zip archive's contents, and then use a command line interface to execute the upgrade
script.
For example, in the directory where the file FWB5.3Upgrade.exe and your backup configuration file are
located, execute the following command:
FWB5.3Upgrade.exe -i YOUR_CONFIG_NAME.conf –o 5.3_new.conf
The script removes the Domain Server, Physical Server, Server Farm, Content Routing policy configurations and
generates a new configuration file named 5.3_new.conf.
7. Resize your FortiWeb hard disk partitions. See Repartitioning the hard disk.
8. Upgrade to FortiWeb 6.1.1.
9. Use System > Maintenance > Backup & Restore to restore the configuration file you created using the script
(for example, 5.3_new.conf).
10. There might be database compatibility issue after the upgrade, because the MarisDB database version is upgraded
to 10.3.8 since FortiWeb 6.0.2:
l Run get system status to check the Database Status.
l If it shows Available, it means the database works well. If it shows Not Available, you need to run
execute db rebuild to solve the database compatibility issue. Please note in HA mode, running execute
db rebuild on master appliance will take effect on all slaves simultaneously.
l If you are upgrading FortiWeb-VM on a hypervisor other than VMware vSphere, see
FortiWeb-VM license validation after upgrade from pre-5.4 version.
l The upgrade process deletes any HTTP content routing policies that match X509 certificate
content. You can re-create these policies using the new, enhanced X509 certificate settings.
l If your server policy configuration includes settings that customize an attack blocking or
server unavailable error page, the upgrade deletes these server-based settings. The
functionality is replaced by the global, default FortiWeb pages.
l The upgrade process deletes any V-zone IP addresses, which are no longer required. This
operation has no impact on routing or connectivity after the upgrade.
Note: To upgrade from 4.0 MR4, Patch x or earlier, please contact Fortinet Technical Support.
To upgrade from a version of FortiWeb previous to 5.5, you must first resize your FortiWeb operating system's disk.
In most cases, you'll have to install a special firmware image to repartition the disk. For details, see To use the special
firmware image to repartition the operating system's disk on page 15.
For the following FortiWeb-VM tools, you cannot install the special firmware image to repartition the hard disk:
l Citrix XenServer
l Open-source Xen Project
l Microsoft Hyper-V
l KVM
For these platforms, to repartition the disk you must deploy a new virtual machine and restore the configuration and log
data you backed up earlier. See To repartition the operating system's disk without the special firmware image on page
15.
Repartitioning affects the operating system’s disk (USB/flash disk), not the hard
disk. Existing data such as reports and event, traffic, and attack logs, which are on
the hard disk, are not affected.
You can use this image to upgrade an HA cluster by following the same procedure
you use for a regular firmware upgrade. For details, see "Updating firmware on an
HA pair" in the FortiWeb Administration Guide:
http://docs.fortinet.com/fortiweb/admin-guides
To use the special firmware image to repartition the operating system's disk
FortiWeb backs up the current configuration, resizes the hard drive partitions, and boots the system.
Continue with the instructions in Upgrading from previous releases on page 11.
To repartition the operating system's disk without the special firmware image
1. Perform a complete backup of your FortiWeb configuration. For details, see the FortiWeb Administration Guide:
http://docs.fortinet.com/fortiweb/admin-guides
2. Use the instructions for your hypervisor platform to detach the log disk from the VM:
1. In the Hyper-V Manager, select the FortiWeb-VM in the list of machines, and then, under Actions, click Settings.
2. Select Hard Drive (data.vhd), and then click Remove.
3. Click Apply.
1. In the Hyper-V Manager, select the new, FortiWeb 5.5 or later virtual machine in the list of machines, and then,
under Actions, click Settings.
2. Select Hard Drive (log.vhd), and then click Browse.
3. Browse to the hard drive you detached from the old virtual machine to select it.
4. Click Apply.
5. Start the new virtual machine.
For KVM deployments, you remove an existing virtual disk from the new VM before you attach the disk detached from
the original VM.
1. In Virtual Machine Manager, double-click the new, FortiWeb 5.5 or later VM in the list of machines.
2. Click Show virtual hardware details (the "i" button).
3. Click VirtIO Disk 2, and then click Remove.
4. Click Add Hardware.
5. Click Storage, select Select managed or other existing storage, and then click Browse.
6. Click Browse Local.
7. Navigate to the log disk file for the original machine to select it, and then click Open.
8. For Device type, select Virtio disk, for Storage format, select qcow2, and then click Finish.
9. Start the new virtual machine.
Upgrading an HA cluster
If the HA cluster is running FortiWeb 4.0 MR4 or later, the HA cluster upgrade is streamlined. When you upgrade the
active appliance, it automatically upgrades any standby appliance(s), too; no manual intervention is required to upgrade
the other appliance(s). This includes upgrading using the special hard disk repartitioning firmware image for upgrading
to 5.5 or later from earlier releases.
If the HA cluster is running FortiWeb 4.0 MR3 Patch x or earlier, contact Fortinet Technical Support for assistance.
When you downgrade to version 5.1 or 5.0, the basic configuration for your appliance's connections to the network (e.g.,
IP address and route configuration) is preserved.
Please note that the machine learning data will be lost if you downgrade to versions lower than 6.2.0. It cannot be
recovered because the database architecture is changed since 6.2.0.
On some virtual machine deployments, upgrading FortiWeb-VM from a version previous to 5.4 changes the virtual
machine's universal unique identifier (UUID). Because of this change, the first time you upload your existing FortiWeb-
VM license, the FortiGuard Distribution Network (FDN) server reports that it is invalid.
To solve this problem, after you have uploaded the license, wait 90 minutes, and then upload the license again.
This issue does not affect FortiWeb-VM deployed on a VMware vSphere hypervisor.
Resolved issues
This section lists issues that have been fixed in version 6.3.6. For inquires about a particular bug, please contact
Fortinet Customer Service & Support:
https://support.fortinet.com
Bug ID Description
0655993 Policy-id and certificate can't be synchronized. Error messages will be printed when performing
configuration synchronization.
0653734 When an SQL/XSS Syntax Based Detection is offended, the request was still blocked even if the IP
address is in the IP List as an "Allowed" IP.
0653073 When a client accesses two servers through two V-zones, the package MAC may be wrong.
0645337 Error occurs when adding/removing Attach HTTP Header when creating an API gateway rule.
0643812 Rate Limit in an API gateway rule was lower than the threshold, which causes the traffic fails to be
blocked.
0642583 .php3 and .phtml files are supported for file security.
0602759 Selecting NO-NAT or Pool in SNAT policy and leaving the Egress Interface blank may cause display
problems on GUI.
0602712 Not configuring external and mapped addresses in DNAT policy may cause the port forwarding
configurations to be lost.
Known issues
This section lists known issues in version 6.3.6, but may not be a complete list. For inquires about a particular bug,
please contact Fortinet Customer Service & Support:
https://support.fortinet.com
Bug ID Description
0656632 The TCP-buffer configuration has some reload issue. The default configuration doesn't take effect
unless manually configured.
0656630 Network > Packet Capture: the selected packet capture page automatically flushes and the capture
item fails to be deleted.
0656002 The diagnose debug flow filter client-ip/server-ip function fails to work well
for http-detail/session-detail.
0604053 FortiWeb 100D devices reboot for unknown reasons in rare cases.
0597351 In machine learning, for certain domain types with multiple patterns, it costs very long time to finish
the sample collection.
0596000 Users with privileges to a certain ADOM can access contents restricted to other ADOMs through
CLI.
0578585 In active-active high volume HA mode, if the physical port IP address and the VIP address are in the
same network segment, the physical port's mac address instead of the VIP's mac address will be
learned by the switch.
0556301 FortiWeb responds with different TCP ports when running sudo nmap towards a physical
interface.