Execute shutdown from GUI or CLI did not fully power-down the system.

In Asymmetric Mode, inbound SYN-ACK packets are graphed but inbound SYN packets are also graphed. Change is made to show matching outbound "virtual" SYNs for clarity.

When restoring a configuration, RRDs may not be reset correctly resulting in some graphs showing data.

In some conditions where an SSL server requires verification of the client certificate, SSL/TLS Profile Protocol Anomaly or Version Anomaly would drop the packets, preventing connection.

If the configuration was restored on a system running live traffic, interface states may be set to "down" requiring manual intervention to bring them up.

Monitor > Layer 3/4/7 > Layer 3 > Other > Fragmented Packets graph did not display UDP Fragments.

If a user has more than 10 Service Protection Policies configured (1500F) SNMP MIB Queries become intermittent.

Blocking DTLS Server Hello per Destination may block all traffic to the Destination (protected) IP address.

After creating Private Data Encryption key in System > Admin > Setting, other non-secure parameters on the page cannot be changed without re-entering the key.

Most Active Source graph was updated in both directions when DNS Query traffic was only sent in one direction.

TCP Session graph (Traffic Monitor -> Layer3/4/7, Select SPP, Select Layer 4-> Other tab, TCP session graph) was not displaying 1/2-open sessions.

If an SPP that had traffic/graphs/drops was deleted, some logs may not have been deleted, resulting in logs with no SPP identifiers.

If user attempted to create more than 64 DNS Profiles via CLI, the error message included extraneous information.

When restoring config via GUI, the API was not waiting until restore was complete before allowing a login, with unexpected results.

Possible UDP Reflection Flood event is not included as data shown for Dasboard > Top Attacks > SPP > Top attacked UDP Ports.

SSL/TLS Version Anomaly was only checked for Content Type 22 messages.

When Packet Capture result was an empty file, it could not be opened, giving a format error. The empty file can now be opened, showing no captured packets.

Backup and restore from the GUI could result in missing SPPs.

DTLS UDP service ports are excluded from System Recommendation Port thresholds. Ensure DTLS profile is configured for SPPs with DTLS service ports.

Invalid DNS packets could be dropped even when no DNS Anomalies were enabled with no logging. FortiDDoS will now drop and log as DNS UDP Header Anomaly: Missing Header. This is a fixed anomaly with no disable option.

Invalid DNS packets could be dropped even when no DNS Anomalies were enabled with no logging. DNS Header Anomaly "Incomplete DNS" (default off) is added to control this check.