Fortinet black logo

FortiOS Release Notes

Home FortiGate / FortiOS 7.2.0 FortiOS Release Notes

Changes in default behavior

7.2.0
7.4.3
7.4.2
7.4.1
7.4.0
7.2.8
7.2.7
7.2.6
7.2.5
7.2.4
7.2.3
7.2.2
7.2.1
7.2.0
7.0.15
7.0.14
7.0.13
7.0.12
7.0.11
7.0.10
7.0.9
7.0.8
7.0.7
7.0.6
7.0.5
7.0.4
7.0.3
7.0.2
7.0.1
7.0.0
6.4.15
6.4.14
6.4.13
6.4.12
6.4.11
6.4.10
6.4.9
6.4.8
6.4.7
6.4.6
6.4.5
6.4.4
6.4.3
6.4.2
6.4.1
6.4.0
6.2.16
6.2.15
6.2.14
6.2.13
6.2.12
6.2.11
6.2.10
6.2.9
6.2.8
6.2.7
6.2.6
6.2.5
6.2.4
6.2.3
6.2.2
6.2.1
6.2.0
6.0.18
6.0.17
6.0.16
6.0.15
6.0.14
6.0.13
6.0.12
6.0.11
6.0.10
6.0.9
6.0.8
6.0.7
6.0.6
6.0.5
6.0.4
6.0.3
6.0.2
6.0.1
6.0.0
5.6.14
5.6.13
5.6.12
5.6.11
5.6.10
5.6.9
5.6.8
5.6.7
5.6.6
5.6.5
5.6.4
5.6.3
5.6.2
5.6.1
5.6.0
5.4.13
5.4.12
5.4.11
5.4.10
5.4.9
5.4.8
5.4.7
5.4.6
5.4.5
5.4.4
5.4.3
5.4.2
5.4.1
5.4.0
5.2.15
5.2.14
5.2.13
5.2.12
5.2.11
5.2.10
5.2.9
5.2.8
5.2.7
5.2.6
5.2.5
5.2.4
5.2.3
5.2.2
5.2.1
5.2.0
5.0.14
5.0.13
5.0.12
5.0.11
5.0.10
5.0.9
5.0.8
5.0.7
5.0.6
5.0.5
5.0.4
5.0.3
5.0.2
Copy Link
Copy Doc ID 5967294d-aa31-11ec-9fd1-fa163e15d75b:230510
Download PDF

Changes in default behavior

Bug ID

Description

718290

When using FortiGuard servers for DNS, FortiOS will default to using DNS over TLS (DoT) to secure the DNS traffic. New FortiGuard DNS servers are added as primary and secondary servers.

738438

Split-task VDOM mode is removed. When a VDOM is set to multi-vdom mode, individual VDOMs can be configured as an admin type.

  • When the vdom-type is set to admin, the VDOM is used for local traffic only. Administrative users can log in to the FortiGate using SSH, HTTPS, and so on.
  • When the vdom-type is set to traffic, the VDOM can pass traffic just like regular VDOMs previously.

Upon upgrade, if a FortiGate is in split-vdom mode, then it will be converted to multi-vdom mode. The FG-traffic VDOM will become a traffic type VDOM. The root VDOM will become an admin VDOM.

743583

AV and IPS packages are now signed by the Fortinet CA to ensure authenticity of the packages. The FortiGate will execute the following checks based on the method used to perform updates:

  • During automatic updates, only signed and validated packages are accepted.
  • During manual package updates, signed and validated packages will be accepted. If a package is not signed, the following applies:
    • Level-0: accept the new package even if it is unsigned.
    • Level-1: display a warning and request a user confirmation to accept.
    • Level-2: display an error and reject the image.
    • If no level is configured, apply Level-1.
  • For HA and configuration synchronization, the secondary device will synchronize signature files from the primary in the presence of a saved signed package.

FDN will maintain signed and unsigned packages for 7.2 and pre-7.2 compatibility. FortiManagers used for package distribution will also download signed and unsigned packages for backwards compatibility.
Previous
Next

Changes in default behavior

Bug ID

Description

718290

When using FortiGuard servers for DNS, FortiOS will default to using DNS over TLS (DoT) to secure the DNS traffic. New FortiGuard DNS servers are added as primary and secondary servers.

738438

Split-task VDOM mode is removed. When a VDOM is set to multi-vdom mode, individual VDOMs can be configured as an admin type.

  • When the vdom-type is set to admin, the VDOM is used for local traffic only. Administrative users can log in to the FortiGate using SSH, HTTPS, and so on.
  • When the vdom-type is set to traffic, the VDOM can pass traffic just like regular VDOMs previously.

Upon upgrade, if a FortiGate is in split-vdom mode, then it will be converted to multi-vdom mode. The FG-traffic VDOM will become a traffic type VDOM. The root VDOM will become an admin VDOM.

743583

AV and IPS packages are now signed by the Fortinet CA to ensure authenticity of the packages. The FortiGate will execute the following checks based on the method used to perform updates:

  • During automatic updates, only signed and validated packages are accepted.
  • During manual package updates, signed and validated packages will be accepted. If a package is not signed, the following applies:
    • Level-0: accept the new package even if it is unsigned.
    • Level-1: display a warning and request a user confirmation to accept.
    • Level-2: display an error and reject the image.
    • If no level is configured, apply Level-1.
  • For HA and configuration synchronization, the secondary device will synchronize signature files from the primary in the presence of a saved signed package.

FDN will maintain signed and unsigned packages for 7.2 and pre-7.2 compatibility. FortiManagers used for package distribution will also download signed and unsigned packages for backwards compatibility.
Previous
Next