Some GUI pages may randomly take longer to load than expected or not load at all.

Policy statistics data that appear on the GUI firewall policy pages and in FortiView may be incorrect.

After successfully resetting a managed FortiSwitich from the FortiGate-6000 or 7000 GUI, a Failed to factory reset FortiSwitich message may appear.

In some cases, the GUI will not display the Configuration Sync Monitor GUI page. You can work around this issue by stopping the node.js process. Once the node.js process is stopped, you will loose access to the GUI for a few seconds. Once node.js restarts you can access the GUI and the Configuration Sync Monitor GUI page should be available.

You can use the following command to find the node.js process number:

diagnose sys process pidof node

The output of this command will be the node.js process number. Enter the following command to stop the node.js process.

diagnose sys kill 9 <node.js-process-number>

In some IPsec configurations that include dynamic routing , the IP address of an IPsec interface can be set to 0.0.0.0. This happens if the IP address for the interface is received before the interface is up, so the interface address is not configured.

You can work around this problem by flushing the tunnel using the IPsec interface that is not set up correctly.

Some processes on the secondary FortiGate 6000 or 7000 in an FGCP cluster may incorrectly generate arp requests. Since the secondary FortiGate 6000 or 7000 data interfaces are blocked, these arp requests do not reach any networks, but they can be seen from the CLI using diagnose commands.

Some FortiGate 6000 or 7000 GUI pages may randomly take longer that expected to load.

After upgrading from FortiOS 7.0.10 to 7.0.12, the FPCs or the secondary FIM and the FPMs will appear to be running un-certified firmware. This also applies to the FPCs or the secondary FIM and the FPMs in the secondary chassis in an HA configuration.

This problem occurs because of the way FortiOS 7.0.10 synchronized signatures from the management board to the FPCs or from the primary FIM to the secondary FIM and the FPMs during the firmware upgrade process.

FortiOS 7.0.12 fixes signature handling, so you can resolve this problem by installing FortiOS 7.0.12 firmware a second time, using a normal firmware upgrade procedure.

During a FortiGate-7000F firmware upgrade FPM CLI consoles may display messages similar to the following:

[ha_shm_mutex_enter:2781] fgtAttachShm() failed.

[update_ha_mac:3497] ha_shm_mutex_enter() failed.

These messages are caused by timing issues as the FPMs are starting up. Once the FPMs have started they should operate normally.

From the FortiGate-6000 management board GUI, the Security Rating page may incorrectly flag firewall policies as Unused Policies, even though these policies have been processing traffic.This is happening because the management board Security Rating system is not receiving policy usage information from the FPCs. If you log into an FPC GUI, you can verify that the Security Rating page has not flagged the same policies as as unused policies.

Graceful upgrade of a FortiGate 6000 or 7000 FGCP HA cluster is not supported when upgrading from FortiOS 7.0.13 to 7.2.5 or 7.2.6.

Upgrading the firmware of a FortiGate-6000 or 7000 FGCP HA cluster from 7.0.13 to 7.2.5 or 7.2.6 should be done during a maintenance window, since the firmware upgrade process will disrupt traffic for a few minutes.

Before upgrading the firmware, disable uninterruptible-upgrade. Then perform a normal firmware upgrade. During the upgrade process the FortiGates in the cluster will not allow traffic until all components (management board and FPCs or FIMs and FPMs) are upgraded and both FortiGates have restarted. This process can take a few minutes.