Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:

Version:


Table of Contents

FortiOS Release Notes

Known issues

The following issues have been identified in version 6.4.10. To inquire about a particular bug or report a bug, please contact Customer Service & Support.

Anti Virus

Bug ID

Description

752420

If a .TAR.BZ2 or .TAR.GZ archive contains an archive bomb inside its compressed stream, the AV engine will time out.

Explicit Proxy

Bug ID

Description

803228

When converting an explicit proxy session to SSL redirect and if this session already has connected to an HTTP server, the WAD crashes continuously with signal 11.

FortiView

Bug ID

Description

683654

FortiView pages with FortiAnalyzer source incorrectly display a Failed to retrieve data error on all VDOM views when there is a newly created VDOM that is not yet registered to FortiAnalyzer. The error should only show on the new VDOM view.

GUI

Bug ID

Description

440197

On the System > FortiGuard page, the override FortiGuard server for AntiVirus & IPS Updates shows an Unknown status, even if the server is working correctly. This is a display issue only; the override feature is working properly.

602397

Managed FortiSwitch and FortiSwitch Ports pages are slow to load when there are many managed FortiSwitches.

653952

The web page cannot be found is displayed when a dashboard ID no longer exists.

Workaround: load another page in the navigation pane. Once loaded, load the original dashboard page (that displayed the error) again.

688016

GUI interface bandwidth widget does not show correct data for tunnel interface when ASIC offload is enabled on the firewall policy.

695163

When there are a lot of historical logs from FortiAnalyzer, the FortiGate GUI Forward Traffic log page can take time to load if there is no specific filter for the time range.

Workaround: provide a specific time range filter, or use the FortiAnalyzer GUI to view the logs.

743477

On the Log & Report > Forward Traffic page, filtering by the Source or Destination column with negation on the IP range does not work.

HA

Bug ID

Description

664929

The hatalk process crashed when creating a disabled VLAN interface in an A-P cluster.

722703

ISDB is not updating; last update attempt is stuck at an older date.

771999

Sessions not synchronized to HA secondary on an FGSP and FGCP combined setup.

779180

FGSP does not synchronize the helper-pmap expectation session.

838541

HA is out-of-sync due to certificate local in FGSP standalone cluster.

Hyperscale

Bug ID

Description

734305

In the GUI, an FQDN or ISDB can be selected for a DoS policy, which is not supported (an error message appears). The CLI shows the correct options.

760560

The timestamp on the hyperscale SPU of a deny policy (policy id 0) is incorrect.

782674

A few tasks are hung on issuing stat verbose on the secondary device.

795853

VDOM ID and IP addresses in the IPL table are incorrect after disabling EIF/EIM.

796368

Traffic shaping profile does not seem to have an effect on TCP/UDP traffic in hyperscale.

802369

Large client IP range makes fixed allocation usage relatively limited.

807476

After packets go through host interface TX/RX queues, some packet buffers can still hold references to a VDOM when the host queues are idle. This causes a VDOM delete error with unregister_vf. If more packets go through the same host queues for other VDOMs, the issue should resolve by itself because those buffers holding the VDOM reference can be pushed and get freed and recycled.

Intrusion Prevention

Bug ID

Description

654307

Wrong direction and banned location by quarantine action for ICMP.Oversized.Packet in NGFW policy mode.

763736

IPS custom signature logging shows (even after being disabled) after upgrading to FortiOS 6.4.7.

IPsec VPN

Bug ID

Description

757696

Implementing the route-overlap setting on phase 2 configurations brings tunnels down until a reboot is not performed on the FGSP cluster.

763205

IKE crashes after HA failover when the enforce-unique-id option is enabled.

830252

IPsec VPN statistics are not increasing on the device.

Proxy

Bug ID

Description

604681

WAD process with SoC SSL acceleration enabled consumes more memory usage over time, which may lead to conserve mode.

Workaround: disable SoC SSL acceleration under the firewall SSL settings.

796910

Application wad crash (Segmentation fault) , which is the first crash in a series.

822271

Unable to access a website when deep inspection is enabled in a proxy policy.

REST API

Bug ID

Description

759675

Connection failed error occurs on FortiGate when an interface is created and updated using the API in quick succession.

Routing

Bug ID

Description

822659

Secure SD-WAN Monitor in FortiAnalyzer does not show graphs when the SLA target is not configured in SD-WAN performance SLA.

830254

When changing interfaces from dense mode to sparse mode, and then back to dense mode, the interfaces did not show up under dense mode.

Security Fabric

Bug ID

Description

614691

Slow GUI performance in large Fabric topology with over 50 downstream devices.

SSL VPN

Bug ID

Description

730416

Forward traffic log does not generate logs for HTTP and HTTPS services with SSL VPN web mode.

830824

Veeam Backup Enterprise website has SSL VPN access problem in web mode.

System

Bug ID

Description

555616

When NTurbo is enabled, it is unexpectedly provided with the wrong traffic direction information (from server or from client) to decide the destination for the data. This causes the traffic to be sent back to the port where it came from.

602141

The extender daemon crashes on Low Encryption (LENC) FortiGates.

622803

L2TP tunnel is not removed after Android client VPN disconnects.

648085

Link status on peer device is not down when the admin port is down on the FortiGate.

664856

A VWP named .. can be created in the GUI, but it cannot be edited or deleted.

669645

VXLAN VNI interface cannot be used with a hardware switch.

675558

SFP port with 1G copper SFP always is up.

685674

FortiGate did not restart after restoring the backup configuration via FortiManager after the following process: disable NPU offloading, change NGFW mode from profile-based to policy-based, retrieve configuration from FortiGate via FortiManager, and install the policy package via FortiManager.

705878

Local certificates could not be saved properly, which caused issues such as not being able to properly restore them with configuration files and causing certificates and keys to be mismatched.

724085

Traffic passing through an EMAC VLAN interface when the parent interface is in another VDOM is blocked if NP7 offloading is enabled. If auto-asic-offload is disabled in the firewall policy, then the traffic flows as expected.

751715

Random LTE modem disconnections due to certain carriers getting unstable due to WWAN modem USB speed under super-speed.

764954

FortiAnalyzer serial number automatically learned from miglogd does not send it to FortiManager through the automatic update.

800333

DoS offload does not work in 6.4.9 and the npd daemon keeps crashing if the policy-offload-level is set to dos-offload under config system npu. Affected platforms: NP6XLite.

809030

Traffic loss occurs when running SNAT PBA pool in a hyperscale VDOM. The NP7 hardware module PRP got stuck, which caused the NP7 to hang.

810583

Running diagnose hardware deviceinfo psu shows the incorrect PSU slot.

826440

Null pointer causing kernel crash on FWF-61F.

847077

Can't find xitem. Drop the response. error appears for DHCPOFFER packets in the DHCP relay debug.

850688

FG-20xF system halts if setting cfg-save to revert under config system global and after the cfg-revert-timeout occurs.

Upgrade

Bug ID

Description

767808

The asicdos option for enabling/disabling NP6XLite DoS offloading is missing after upgrading to 6.4.9. Affected platforms: NP6XLite.

User & Authentication

Bug ID

Description

778521

SCEP fails to renew if the local certificate name length is between 31 and 35 characters.

822684

When multiple FSSO CA connections are configured at the same time, only the last configured FSSO connection comes up.

VM

Bug ID

Description

596742

Azure SDN connector replicates configuration from primary device to secondary device during configuration restore.

617046

FG-VMX manager not showing all the nodes deployed.

639258

Autoscale GCP health check is not successful (port 8443 HTTPS).

668625

During every FortiGuard UTM update, there is high CPU usage because only one vCPU is available.

761736

FG-AWS failover does not trigger the elastic IP or route move during an upgrade if the HA connection between the active and passive node breaks for a few seconds and reconnects.

WiFi Controller

Bug ID

Description

662714

The security-redirect-url setting is missing when the portal-type is auth-mac.

Known issues

The following issues have been identified in version 6.4.10. To inquire about a particular bug or report a bug, please contact Customer Service & Support.

Anti Virus

Bug ID

Description

752420

If a .TAR.BZ2 or .TAR.GZ archive contains an archive bomb inside its compressed stream, the AV engine will time out.

Explicit Proxy

Bug ID

Description

803228

When converting an explicit proxy session to SSL redirect and if this session already has connected to an HTTP server, the WAD crashes continuously with signal 11.

FortiView

Bug ID

Description

683654

FortiView pages with FortiAnalyzer source incorrectly display a Failed to retrieve data error on all VDOM views when there is a newly created VDOM that is not yet registered to FortiAnalyzer. The error should only show on the new VDOM view.

GUI

Bug ID

Description

440197

On the System > FortiGuard page, the override FortiGuard server for AntiVirus & IPS Updates shows an Unknown status, even if the server is working correctly. This is a display issue only; the override feature is working properly.

602397

Managed FortiSwitch and FortiSwitch Ports pages are slow to load when there are many managed FortiSwitches.

653952

The web page cannot be found is displayed when a dashboard ID no longer exists.

Workaround: load another page in the navigation pane. Once loaded, load the original dashboard page (that displayed the error) again.

688016

GUI interface bandwidth widget does not show correct data for tunnel interface when ASIC offload is enabled on the firewall policy.

695163

When there are a lot of historical logs from FortiAnalyzer, the FortiGate GUI Forward Traffic log page can take time to load if there is no specific filter for the time range.

Workaround: provide a specific time range filter, or use the FortiAnalyzer GUI to view the logs.

743477

On the Log & Report > Forward Traffic page, filtering by the Source or Destination column with negation on the IP range does not work.

HA

Bug ID

Description

664929

The hatalk process crashed when creating a disabled VLAN interface in an A-P cluster.

722703

ISDB is not updating; last update attempt is stuck at an older date.

771999

Sessions not synchronized to HA secondary on an FGSP and FGCP combined setup.

779180

FGSP does not synchronize the helper-pmap expectation session.

838541

HA is out-of-sync due to certificate local in FGSP standalone cluster.

Hyperscale

Bug ID

Description

734305

In the GUI, an FQDN or ISDB can be selected for a DoS policy, which is not supported (an error message appears). The CLI shows the correct options.

760560

The timestamp on the hyperscale SPU of a deny policy (policy id 0) is incorrect.

782674

A few tasks are hung on issuing stat verbose on the secondary device.

795853

VDOM ID and IP addresses in the IPL table are incorrect after disabling EIF/EIM.

796368

Traffic shaping profile does not seem to have an effect on TCP/UDP traffic in hyperscale.

802369

Large client IP range makes fixed allocation usage relatively limited.

807476

After packets go through host interface TX/RX queues, some packet buffers can still hold references to a VDOM when the host queues are idle. This causes a VDOM delete error with unregister_vf. If more packets go through the same host queues for other VDOMs, the issue should resolve by itself because those buffers holding the VDOM reference can be pushed and get freed and recycled.

Intrusion Prevention

Bug ID

Description

654307

Wrong direction and banned location by quarantine action for ICMP.Oversized.Packet in NGFW policy mode.

763736

IPS custom signature logging shows (even after being disabled) after upgrading to FortiOS 6.4.7.

IPsec VPN

Bug ID

Description

757696

Implementing the route-overlap setting on phase 2 configurations brings tunnels down until a reboot is not performed on the FGSP cluster.

763205

IKE crashes after HA failover when the enforce-unique-id option is enabled.

830252

IPsec VPN statistics are not increasing on the device.

Proxy

Bug ID

Description

604681

WAD process with SoC SSL acceleration enabled consumes more memory usage over time, which may lead to conserve mode.

Workaround: disable SoC SSL acceleration under the firewall SSL settings.

796910

Application wad crash (Segmentation fault) , which is the first crash in a series.

822271

Unable to access a website when deep inspection is enabled in a proxy policy.

REST API

Bug ID

Description

759675

Connection failed error occurs on FortiGate when an interface is created and updated using the API in quick succession.

Routing

Bug ID

Description

822659

Secure SD-WAN Monitor in FortiAnalyzer does not show graphs when the SLA target is not configured in SD-WAN performance SLA.

830254

When changing interfaces from dense mode to sparse mode, and then back to dense mode, the interfaces did not show up under dense mode.

Security Fabric

Bug ID

Description

614691

Slow GUI performance in large Fabric topology with over 50 downstream devices.

SSL VPN

Bug ID

Description

730416

Forward traffic log does not generate logs for HTTP and HTTPS services with SSL VPN web mode.

830824

Veeam Backup Enterprise website has SSL VPN access problem in web mode.

System

Bug ID

Description

555616

When NTurbo is enabled, it is unexpectedly provided with the wrong traffic direction information (from server or from client) to decide the destination for the data. This causes the traffic to be sent back to the port where it came from.

602141

The extender daemon crashes on Low Encryption (LENC) FortiGates.

622803

L2TP tunnel is not removed after Android client VPN disconnects.

648085

Link status on peer device is not down when the admin port is down on the FortiGate.

664856

A VWP named .. can be created in the GUI, but it cannot be edited or deleted.

669645

VXLAN VNI interface cannot be used with a hardware switch.

675558

SFP port with 1G copper SFP always is up.

685674

FortiGate did not restart after restoring the backup configuration via FortiManager after the following process: disable NPU offloading, change NGFW mode from profile-based to policy-based, retrieve configuration from FortiGate via FortiManager, and install the policy package via FortiManager.

705878

Local certificates could not be saved properly, which caused issues such as not being able to properly restore them with configuration files and causing certificates and keys to be mismatched.

724085

Traffic passing through an EMAC VLAN interface when the parent interface is in another VDOM is blocked if NP7 offloading is enabled. If auto-asic-offload is disabled in the firewall policy, then the traffic flows as expected.

751715

Random LTE modem disconnections due to certain carriers getting unstable due to WWAN modem USB speed under super-speed.

764954

FortiAnalyzer serial number automatically learned from miglogd does not send it to FortiManager through the automatic update.

800333

DoS offload does not work in 6.4.9 and the npd daemon keeps crashing if the policy-offload-level is set to dos-offload under config system npu. Affected platforms: NP6XLite.

809030

Traffic loss occurs when running SNAT PBA pool in a hyperscale VDOM. The NP7 hardware module PRP got stuck, which caused the NP7 to hang.

810583

Running diagnose hardware deviceinfo psu shows the incorrect PSU slot.

826440

Null pointer causing kernel crash on FWF-61F.

847077

Can't find xitem. Drop the response. error appears for DHCPOFFER packets in the DHCP relay debug.

850688

FG-20xF system halts if setting cfg-save to revert under config system global and after the cfg-revert-timeout occurs.

Upgrade

Bug ID

Description

767808

The asicdos option for enabling/disabling NP6XLite DoS offloading is missing after upgrading to 6.4.9. Affected platforms: NP6XLite.

User & Authentication

Bug ID

Description

778521

SCEP fails to renew if the local certificate name length is between 31 and 35 characters.

822684

When multiple FSSO CA connections are configured at the same time, only the last configured FSSO connection comes up.

VM

Bug ID

Description

596742

Azure SDN connector replicates configuration from primary device to secondary device during configuration restore.

617046

FG-VMX manager not showing all the nodes deployed.

639258

Autoscale GCP health check is not successful (port 8443 HTTPS).

668625

During every FortiGuard UTM update, there is high CPU usage because only one vCPU is available.

761736

FG-AWS failover does not trigger the elastic IP or route move during an upgrade if the HA connection between the active and passive node breaks for a few seconds and reconnects.

WiFi Controller

Bug ID

Description

662714

The security-redirect-url setting is missing when the portal-type is auth-mac.