Fortinet Document Library

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

Known issues

The following issues have been identified in version 6.2.8. For inquires about a particular bug or to report a bug, please contact Customer Service & Support.

DNS Filter

Bug ID

Description

582374

License shows expiry date of 0000-00-00.

Explicit Proxy

Bug ID

Description

540091

Cannot access explicit FTP proxy via VIP.

Firewall

Bug ID

Description

654356

In NGFW policy mode, sessions are not re-validated when security policies are changed.

Workaround: clear the session after policy change.

FortiView

Bug ID

Description

635309

When FortiAnalyzer logging is configured using an FQDN domain, the GUI displays a 500 error message on the FortiView Compromised Hosts page.

673225

FortiView Top Traffic Shaping widget does not show data for outbound traffic if the source interface's role is WAN. Data is displayed if the source interface's role is LAN, DMZ, or undefined.

GUI

Bug ID

Description

354464

Antivirus archive logging enabled from the CLI will be disabled by editing the antivirus profile in the GUI, even if no changes are made.

514632

Inconsistent reference count when using ports in HA session-sync-dev.

529094

When creating an antispam block/allowlist entry, Mark as Reject should be grayed out.

535099

The SSID dialog page does not have support for the new MAC address filter.

541042

Log viewer forwarded traffic does not support multiple filters for one field.

584915

OK button missing from many pages when viewed in Chrome on an Android device.

584939

VPN event logs are incorrectly filtered when there are two Action filters and one of them contains "-".

602102

Warning message is not displayed when a user configures an interface with a static IP address that is already in use.

602397

Managed FortiSwitch and FortiSwitch Ports pages are slow to load when there are many managed FortiSwitches.

621254

When creating or editing an IPv4 policy or address group, firewall address searching does not work if there is an empty wildcard address due to a configuration error.

664007

GUI incorrectly displays the warning, Botnet package update unavailable, AntiVirus subscription not found., when the antivirus entitlement is expiring within 30 days. The actual botnet package update still works within the active entitlement duration.

672599

After performing a search on firewall Addresses, the matched count over total count displayed for each address type shows an incorrect total count number. The search functionality still works correctly.

682440

On Firewall Policy list, the tooltip for IP Pool incorrectly shows Port Block Allocation as being exhausted if there are expiring PBAs available to be reallocated.

688994

The Edit Web Filter Profile page incorrectly shows that a URL filter is configured (even though it is not) if the URL filter entry has the same name as the web filter profile in the CLI.

Intrusion Prevention

Bug ID

Description

565747

IPS engine 5.00027 has signal 11 crash.

590087

When IPS pcap is enabled, traffic is intermittently disrupted after disk I/O reaches IOPS limit.

IPsec VPN

Bug ID

Description

720024

Signature authentication IKE negotiation gets stuck and tunnel is not set up. This issue appears after a reboot, and can become unstuck by running get vpn ike gateway.

Log & Report

Bug ID

Description

606533

User observes FGT internal error while trying to log in or activate FortiGate Cloud from the web UI.

713014

Cannot perform disk scan after enabling disk raid.

Proxy

Bug ID

Description

717157

When using certificate inspection in a firewall policy, the WAD daemon might crash when clients try to connect to a web proxy server through the FortiGate in transparent mode or through a web proxy forward server.

Workaround: use deep inspection or disable the web proxy forward server for the specific policy.

REST API

Bug ID

Description

584631 REST API admin with token unable to configure HA setting (via login session works).

713445

For API user tokens with CORS enabled and set to wildcard *, direct API requests using this token are not processed properly. This issue impacts FortiOS version 5.6.1 and later.

Workaround: set CORS to an explicit domain.

714075

When CORS is enabled for REST API administrators, POST and PUT requests with body data do not work with CORS due to the pre-flight requests being handled incorrectly. This only impacts newer browser versions that use pre-flight requests.

Routing

Bug ID

Description

537354

BFD/BGP dropping when outbandwidth is set on interface.

Security Fabric

Bug ID

Description

614691

Slow GUI performance in large Fabric topology with over 50 downstream devices.

SSL VPN

Bug ID

Description

505986 On IE 11, SSL VPN web portal displays blank page title {{::data.portal.heading}} after authentication.

714604

SSL VPN daemon may crash when connection releases.

Switch Controller

Bug ID

Description

588584

GUI should add support to allow using switch VLAN interface under a tenant VDOM on a managed switch VDOM.

605864

If the firewall is downgraded from 6.2.3 to 6.2.2, the FortiLink interface loses its CAPWAP setting.

System

Bug ID

Description

464340

EHP drops for units with no NP service module.

578031

FortiManager Cloud cannot be removed once the FortiGate has trouble with contract.

600032

SNMP does not provide routing table for non-management VDOM.

607565

Interface emac-vlan feature does not work on SoC4 platform.

694202

stpforward does not work with LAG interfaces on a transparent VDOM.

695803

Unable to reorder firewall DoS policy in GUI or CLI.

Upgrade

Bug ID

Description

658664

FortiExtender status becomes discovered after upgrading from 6.0.10 (build 0365).

Workaround: change the admin from discovered to enable after upgrading.

config extender-controller extender
    edit <id>
        set admin enable
    next
end

716912

SSH access may be lost in some cases after upgrading to 6.2.8, 6.4.6, or 7.0.0.

User & Device

Bug ID

Description

595583

Device identification via LLDP on an aggregate interface does not work.

701356

When a GUI administrator certificate, admin-server-cert, is provisioned via SCEP, the FortiGate does not automatically offer the newly updated certificate to HTTPS clients. FortiOS 7.0.0 and later does not have this issue.

Workaround: manually unset admin-server-cert and set it back to the same certificate.

config system global
    unset admin-server-cert
end
config system global
    set admin-server-cert <scep_certificate>
end

VM

Bug ID

Description

587757

FG-VM image unable to be deployed on AWS with additional HDD (st1) disk type.

596742

Azure SDN connector replicates configuration from primary device to secondary device during configuration restore.

605511

FG-VM-GCP reboots a couple of times due to kernel panic.

608881

IPsec VPN tunnel not staying up after failing over with AWS A-P cross-AZ setup.

640436

FortiGate AWS bootstrapped from configuration does not read SAML settings.

668625

During every FortiGuard UTM update, there is high CPU usage because only one vCPU is available.

685782

HTTPS administrative interface responds over heartbeat port on Azure FortiGate despite allowaccess settings.

WiFi Controller

Bug ID

Description

709871

After the firmware upgrade, the AP cannot register to the central WLC because NPU offload changed the source and destination ports from 4500 to 0.

Known issues

The following issues have been identified in version 6.2.8. For inquires about a particular bug or to report a bug, please contact Customer Service & Support.

DNS Filter

Bug ID

Description

582374

License shows expiry date of 0000-00-00.

Explicit Proxy

Bug ID

Description

540091

Cannot access explicit FTP proxy via VIP.

Firewall

Bug ID

Description

654356

In NGFW policy mode, sessions are not re-validated when security policies are changed.

Workaround: clear the session after policy change.

FortiView

Bug ID

Description

635309

When FortiAnalyzer logging is configured using an FQDN domain, the GUI displays a 500 error message on the FortiView Compromised Hosts page.

673225

FortiView Top Traffic Shaping widget does not show data for outbound traffic if the source interface's role is WAN. Data is displayed if the source interface's role is LAN, DMZ, or undefined.

GUI

Bug ID

Description

354464

Antivirus archive logging enabled from the CLI will be disabled by editing the antivirus profile in the GUI, even if no changes are made.

514632

Inconsistent reference count when using ports in HA session-sync-dev.

529094

When creating an antispam block/allowlist entry, Mark as Reject should be grayed out.

535099

The SSID dialog page does not have support for the new MAC address filter.

541042

Log viewer forwarded traffic does not support multiple filters for one field.

584915

OK button missing from many pages when viewed in Chrome on an Android device.

584939

VPN event logs are incorrectly filtered when there are two Action filters and one of them contains "-".

602102

Warning message is not displayed when a user configures an interface with a static IP address that is already in use.

602397

Managed FortiSwitch and FortiSwitch Ports pages are slow to load when there are many managed FortiSwitches.

621254

When creating or editing an IPv4 policy or address group, firewall address searching does not work if there is an empty wildcard address due to a configuration error.

664007

GUI incorrectly displays the warning, Botnet package update unavailable, AntiVirus subscription not found., when the antivirus entitlement is expiring within 30 days. The actual botnet package update still works within the active entitlement duration.

672599

After performing a search on firewall Addresses, the matched count over total count displayed for each address type shows an incorrect total count number. The search functionality still works correctly.

682440

On Firewall Policy list, the tooltip for IP Pool incorrectly shows Port Block Allocation as being exhausted if there are expiring PBAs available to be reallocated.

688994

The Edit Web Filter Profile page incorrectly shows that a URL filter is configured (even though it is not) if the URL filter entry has the same name as the web filter profile in the CLI.

Intrusion Prevention

Bug ID

Description

565747

IPS engine 5.00027 has signal 11 crash.

590087

When IPS pcap is enabled, traffic is intermittently disrupted after disk I/O reaches IOPS limit.

IPsec VPN

Bug ID

Description

720024

Signature authentication IKE negotiation gets stuck and tunnel is not set up. This issue appears after a reboot, and can become unstuck by running get vpn ike gateway.

Log & Report

Bug ID

Description

606533

User observes FGT internal error while trying to log in or activate FortiGate Cloud from the web UI.

713014

Cannot perform disk scan after enabling disk raid.

Proxy

Bug ID

Description

717157

When using certificate inspection in a firewall policy, the WAD daemon might crash when clients try to connect to a web proxy server through the FortiGate in transparent mode or through a web proxy forward server.

Workaround: use deep inspection or disable the web proxy forward server for the specific policy.

REST API

Bug ID

Description

584631 REST API admin with token unable to configure HA setting (via login session works).

713445

For API user tokens with CORS enabled and set to wildcard *, direct API requests using this token are not processed properly. This issue impacts FortiOS version 5.6.1 and later.

Workaround: set CORS to an explicit domain.

714075

When CORS is enabled for REST API administrators, POST and PUT requests with body data do not work with CORS due to the pre-flight requests being handled incorrectly. This only impacts newer browser versions that use pre-flight requests.

Routing

Bug ID

Description

537354

BFD/BGP dropping when outbandwidth is set on interface.

Security Fabric

Bug ID

Description

614691

Slow GUI performance in large Fabric topology with over 50 downstream devices.

SSL VPN

Bug ID

Description

505986 On IE 11, SSL VPN web portal displays blank page title {{::data.portal.heading}} after authentication.

714604

SSL VPN daemon may crash when connection releases.

Switch Controller

Bug ID

Description

588584

GUI should add support to allow using switch VLAN interface under a tenant VDOM on a managed switch VDOM.

605864

If the firewall is downgraded from 6.2.3 to 6.2.2, the FortiLink interface loses its CAPWAP setting.

System

Bug ID

Description

464340

EHP drops for units with no NP service module.

578031

FortiManager Cloud cannot be removed once the FortiGate has trouble with contract.

600032

SNMP does not provide routing table for non-management VDOM.

607565

Interface emac-vlan feature does not work on SoC4 platform.

694202

stpforward does not work with LAG interfaces on a transparent VDOM.

695803

Unable to reorder firewall DoS policy in GUI or CLI.

Upgrade

Bug ID

Description

658664

FortiExtender status becomes discovered after upgrading from 6.0.10 (build 0365).

Workaround: change the admin from discovered to enable after upgrading.

config extender-controller extender
    edit <id>
        set admin enable
    next
end

716912

SSH access may be lost in some cases after upgrading to 6.2.8, 6.4.6, or 7.0.0.

User & Device

Bug ID

Description

595583

Device identification via LLDP on an aggregate interface does not work.

701356

When a GUI administrator certificate, admin-server-cert, is provisioned via SCEP, the FortiGate does not automatically offer the newly updated certificate to HTTPS clients. FortiOS 7.0.0 and later does not have this issue.

Workaround: manually unset admin-server-cert and set it back to the same certificate.

config system global
    unset admin-server-cert
end
config system global
    set admin-server-cert <scep_certificate>
end

VM

Bug ID

Description

587757

FG-VM image unable to be deployed on AWS with additional HDD (st1) disk type.

596742

Azure SDN connector replicates configuration from primary device to secondary device during configuration restore.

605511

FG-VM-GCP reboots a couple of times due to kernel panic.

608881

IPsec VPN tunnel not staying up after failing over with AWS A-P cross-AZ setup.

640436

FortiGate AWS bootstrapped from configuration does not read SAML settings.

668625

During every FortiGuard UTM update, there is high CPU usage because only one vCPU is available.

685782

HTTPS administrative interface responds over heartbeat port on Azure FortiGate despite allowaccess settings.

WiFi Controller

Bug ID

Description

709871

After the firmware upgrade, the AP cannot register to the central WLC because NPU offload changed the source and destination ports from 4500 to 0.