Cannot access explicit FTP proxy via VIP.

Proxy policy destination address set to none allows all traffic.

Traffic is blocked by NGFW policy when SDN connector firewall address is configured in policy.

Challenge ACK is being dropped.

In NGFW policy mode, sessions are not re-validated when security policies are changed.

Workaround: clear the session after policy change.

IPS user quarantine ban event is marking the sessions as dirty.

Load balancing is not allowed with a flow-based policy, even if the server type is configured as IP or TCP.

When FortiAnalyzer logging is configured using an FQDN domain, the GUI displays a 500 error message on the FortiView Compromised Hosts page.

Antivirus archive logging enabled from the CLI will be disabled by editing the antivirus profile in the GUI, even if no changes are made.

Inconsistent reference count when using ports in HA session-sync-dev.

When creating an antispam block/allowlist entry, Mark as Reject should be grayed out.

The SSID dialog page does not have support for the new MAC address filter.

Log viewer forwarded traffic does not support multiple filters for one field.

OK button missing from many pages when viewed in Chrome on an Android device.

VPN event logs are incorrectly filtered when there are two Action filters and one of them contains "-".

Warning message is not displayed when a user configures an interface with a static IP address that is already in use.

Managed FortiSwitch and FortiSwitch Ports pages are slow to load when there are many managed FortiSwitches. This performance issue needs a fix on both FortiOS and FortiSwitch. A fix was provided in FortiOS 7.0.1 GA and FortiSwitch 7.0.1 GA.

Guest user credentials never expire if a guest user logs in via the WiFi portal while an administrator is actively viewing the user's account via the GUI. If the administrator clicks OK in the user edit dialog after the guest user has logged in, the user's current login session is not subject to the configured expiration time.

Workaround: click Cancel instead of OK to close the dialog.

When creating or editing an IPv4 policy or address group, firewall address searching does not work if there is an empty wildcard address due to a configuration error.

GUI incorrectly displays the warning, Botnet package update unavailable, AntiVirus subscription not found., when the antivirus entitlement is expiring within 30 days. The actual botnet package update still works within the active entitlement duration.

After performing a search on firewall Addresses, the matched count over total count displayed for each address type shows an incorrect total count number. The search functionality still works correctly.

When config ha-mgmt-interfaces is configured, the GUI incorrectly shows an error when setting overlapping IP address.

On Firewall Policy list, the tooltip for IP Pool incorrectly shows Port Block Allocation as being exhausted if there are expiring PBAs available to be reallocated.

The Edit Web Filter Profile page incorrectly shows that a URL filter is configured (even though it is not) if the URL filter entry has the same name as the web filter profile in the CLI.

When there are a lot of historical logs from FortiAnalyzer, the FortiGate GUI Forward Traffic log page can take time to load if there is no specific filter for the time range.

Workaround: provide a specific time range filter, or use the FortiAnalyzer GUI to view the logs.

The event log sometimes contains duplicated lines when downloaded from the GUI.

When sending UDP packets, hasync code uses the wrong buffer size so that it may overwrite beyond the buffer to other corrupted memory.

Sessions timeout after traffic failover goes back and forth on a transparent FGSP cluster.

When there are more than two members in a HA cluster and the HA interface is used for the heartbeat interface, some RX packet drops are observed on the HA interface. However, no apparent impact is observed on the cluster operation.

Workaround: do not use the HA interface as a heartbeat interface.

Secondary device is unable to connect to FortiCloud with secondary IP as the source IP.

Heartbeat interfaces do not get updated under diagnose sys ha dump-by <group |memory> after HA hbdev configuration changes.

Cluster is unstable when running interface configuration scripts. For example, when inserting many VLANs, hatalk will get a lot of intf_vd_changed events and recheck the MAC every time, which blocks hatalk from sending heartbeat packets for a long time and the peer loses it.

When there is a large number of VLAN interfaces (around 600), the FortiGate reports VLAN heartbeat lost on subinterface vlan error for multiple VLANs.

diagnose sys ha reset-uptime on the secondary devices triggers a failover on a cluster with more than two members.

API key (token) on the secondary device is not synchronized to the primary when standalone-config-sync is enabled.

IPS engine 5.00027 has signal 11 crash.

IPS intelligent mode not working when reflect sessions are created on different physical interfaces.

IPS engine 5.00035 has signal 11 crash.

When IPS pcap is enabled, traffic is intermittently disrupted after disk I/O reaches IOPS limit.

Destination interfaces are set to unknown for previous ADVPN shortcuts sessions.

Flow-based AV scanning does not send specific extension files to FortiSandbox.

IPS memory spike on 6.2.7 running version: 5.00229.

IPsec tunnel bandwidth usage is not correct on the GUI widget and SNMP graph when NPU is doing host offloading.

Dynamic IKEv2 IPsec VPN fails to establish after adding new phase 2 with mismatched traffic selector.

FortiGate keeps initiating DHCP SA rekey after lifetime expires.

User observes FGT internal error while trying to log in or activate FortiGate Cloud from the web UI.

Log upload through user proxy is randomly terminated.

Cannot perform disk scan after enabling disk raid.

System might generate garbage administrator log events upon session timeout.

Multiple WAD crashes observed with signal 6. The issue could be reproduced with a slow server that will not respond the connection in 10 seconds, and if the configuration changes during the 10 seconds.

WAD crashes due to RCX having a null value.

WAD SSL crash due to wrong cipher options chosen.

Reusing the buffer region causes frequent WAD crashes.

Application control in Azure fails to detect and block SSH traffic with proxy inspection.

Proxy-based SSL out-band-probe session has local out connection. Since the local out session will not learn the router policy, it makes all outbound connections fail if there is no static router to the destination.

WAD crashes with transparent web proxy when connecting to a forward server.

WAD IPS crashes because task is scheduled after closing.

YouTube server added new URLs (youtubei/v1/player, youtubei/v1/navigator) that caused proxy option to restrict YouTube access to not work.

Flow control failure occurred while transferring large files when stream-scan was running, which sometimes resulted in WAD memory spike.

WAD crash on wad_hash_map_del.

Traffic is stuck if HTTP POST does not have an end of boundary.

Proxy inspection firewall policy with proxy AV blocks POP3 traffic of the Windows 10 built-in Mail app.

REST API unable to change status of interface when VDOMs are enabled.

For API user tokens with CORS enabled and set to wildcard *, direct API requests using this token are not processed properly. This issue impacts FortiOS version 5.6.1 and later.

Workaround: set CORS to an explicit domain.

BFD/BGP dropping when outbandwidth is set on interface.

Make SNMP get BGP peer state timely once BGP neighbor enters or exits established state.

BGP prefix lifetime resets every 60 seconds when scanning BGP RIB.

OSPF is stuck in loading state when there is a large amount of OSPF interfaces.

The OSPF neighborship cannot be established; get MD5 authentication error when the wrong MD5 key is deleted after modifying the key.

hasync daemon was busy in dead loop if FD resource was used up when flushing routes from the kernel.

SD-WAN rules not working for FortiAnalyzer settings because the interface-select-method is implemented on a remote device FortiAnalyzer/FDS but not added to FortiView/log viewing API.

FortiCloud activation does not honor the set interface-select-method command under config system fortiguard.

TCP session drops between virtual wire pair with auto-asic-offload enabled in policy.

Improve the help text for distance to indicate that 255 means unreachable.

Slow GUI performance in large Fabric topology with over 50 downstream devices.

ACI dynamic address cannot be retrieved in HA vcluster2 from SDN connector.

Automation stitch CLI scripts fail with greater than 255 characters; up to 1023 characters should be supported.

When DNS domain is configured, requests with NTLM of hostname only bookmark could not get response from server.

SSL VPN firewall policy creation via CLI does not require setting user identity.

In SSL VPN web mode, options pages are not shown after clicking the option tag on the left side of the webpage on an OWA server.

sslvpnd crashes due to wrong application index referencing the wrong shared memory when daemons are busy. Crash found when RADIUS user uses Framed-IP.

WALLIX personal bookmark issue in SSL VPN portal.

FortiClient iOS 6.4.5. has new feature that allows bypassing of 2FA for SSL VPN 2FA. The FortiGate should allow access when 2FA is skipped on FortiClient.

FortiToken Cloud user not working when in a user group.

SolarWinds Orion NPM platform's web application has issues in SSL VPN web mode.

SSL VPN signal 11 crashes at sslvpn_ppp_associate_fd_to_ipaddr. For RADIUS users with Framed-IP using tunnel mode, the first user logs in successfully, then a second user with the same user name logs in and kicks the first user out. SSL VPN starts a five-second timer to wait for the first user resource to clean up. However, before the timer times out, the PPP tunnel setup fails and the PPP context is released. When the five-second timer times out, SSL VPN still tries to use the PPP context that has already been released and causes the crash.

SSL VPN web portal does not show thumbnails of videos for an internal JS-based web server.

Internal webpage with JavaScript is not loading in SSL VPN web mode.

Customer internal website (ac***.sa***.com) does not load properly when connecting via SSL VPN web mode.

GUI should add support to allow using switch VLAN interface under a tenant VDOM on a managed switch VDOM.

If the firewall is downgraded from 6.2.3 to 6.2.2, the FortiLink interface loses its CAPWAP setting.

EHP drops for units with no NP service module.

FortiManager Cloud cannot be removed once the FortiGate has trouble with contract.

There is duplicate information when checking interface references in global.

SNMP does not provide routing table for non-management VDOM.

Interface emac-vlan feature does not work on SoC4 platform.

TCP traffic disruption when traffic shaper takes effect with NP offloading enabled.

When upgrading FG-100D, several processes randomly go into D state, which generates cluster and service issues.

FTLF8536P4BCV shows This transceiver is not certified by Fortinet, corrupt part number and serial number after HA cluster sync.

FortiDDNS is unable to update the renewed public IP address to FortiGuard server in some error conditions.

FortiManager CLI script for 2FA FortiToken mobile push does not trigger activation code email.

Install preview does not show all changes performed on the FortiGate.

DSL creates a default route to 240.0.0.1 after changing any configuration on a DSL interface.

Bulk changes through the CLI are very slow with 24000 existing policies.

After pushing the interface configuration from FortiManager, the device index is incorrectly set to 0.

WWAN interface on FG-40F- 3G4G eventually goes offline until a reboot or configuration change occurs.

When an <entry name> is on the same line as config <setting> <setting> <entry name>, it is not handled properly to send to FortiManager.

stpforward does not work with LAG interfaces on a transparent VDOM.

Support gtp-enhance-mode (GTP-U) on FG-3815D.

SNMP query of fgFwPolTables (1.3.6.1.4.1.123456.101.5.1.2.1) causes high CPU on a specific configuration.

cmdbsvr memory leak due to unreleased memory allocated by OpenSSL.

FG-1500D reboots suddenly after COMLog reported kernel panic and voipd is tainted.

There was a memory leak in the administrator login debug that caused the getty daemon to be killed.

LLDP transmission fails if there are nested software switches.

Command fail when running execute private-encryption-key <xxx>.

FortiManager shows auto update for down port from FortiGate, but FortiGate event logs do not show any down port events when user shuts down the ha monitor dev.

NTurbo does not work with EMAC VLAN interface.

IPv6 networks are not reachable shortly after FortiGate failover because an unsolicited neighbor advertisement is sent without a router flag.

SA is freed while its timer is still pending, which leads to a kernel crash.

Traffic passing through an EMAC VLAN interface when the parent interface is in another VDOM is blocked if NP7 offloading is enabled. If auto-asic-offload is disabled in the firewall policy, then the traffic flows as expected.

Device identification via LLDP on an aggregate interface does not work.

Two-factor authentication can be bypassed with some configurations.

When a GUI administrator certificate, admin-server-cert, is provisioned via SCEP, the FortiGate does not automatically offer the newly updated certificate to HTTPS clients. FortiOS 7.0.0 and later does not have this issue.

Workaround: manually unset admin-server-cert and set it back to the same certificate.

config system global
    unset admin-server-cert
end

config system global
    set admin-server-cert <scep_certificate>
end

RADIUS accounting port is occasionally missing.

FSSO local poller fails after recent Microsoft Windows update ( KB5003646, KB5003638, ...).

FG-VM image unable to be deployed on AWS with additional HDD (st1) disk type.

Azure SDN connector replicates configuration from primary device to secondary device during configuration restore.

FG-VM-GCP reboots a couple of times due to kernel panic.

IPsec VPN tunnel not staying up after failing over with AWS A-P cross-AZ setup.

FortiGate AWS bootstrapped from configuration does not read SAML settings.

During every FortiGuard UTM update, there is high CPU usage because only one vCPU is available.

Web filter warning message does not contain certification chain.

Running a remote CLI script from FortiManager can create a duplicated FortiGuard web filter category.

RADIUS traffic not matching SD-WAN rule when using wpad daemon for wireless connection.

After the firmware upgrade, the AP cannot register to the central WLC because NPU offload changed the source and destination ports from 4500 to 0.