FortiGate should fix the interface between FortiGate and FortiAnalyzer for the CDR file.

If FortiGate Cloud is selected as sandbox server under Security Fabric > Fabric Connectors, an anti virus profile with settings to Send files to FortiSandbox for inspection does not get saved in the GUI.

Flow AV sends HTML files to the FortiGate Cloud Sandbox every time when HTML is not configured in file list.

CDR archived files are deleted at random times and not retained.

When a FortiGate with DLP patterns configured is connected to FortiSandbox, scanunit crashes when the FortiSandbox extension reloads or worker shuts down.

Flow mode opens port 8008 over the AV profile that does not have HTTP scan enabled.

When configuring an application group with Google Drive_File.Sharing or a category in a security policy, there is no drop or warning message.

DLP is not blocking files larger than the threshold value defined in set file-size.

Device is constantly unauthorized in EMS when using set interface-select-method sdwan.

Expand web proxy header content string size from 256 to 512, then to 1024.

When converting an explicit proxy session to SSL redirect, traffic may be interrupted inadvertently in some situations.

FortiGate does not load balance requests evenly when the ldb-method is set to least-session.

Authentication hard timeout is not respected for firewall users synchronized from WAD user.

Static route configuration should not be shown on address dialog page if the address type is an IP range.

The VIP group hit count in the table (Policy & Objects > Virtual IPs) is not reflecting the correct sum of VIP members.

When a FortiGate virtual server for Exchange incorrectly indicates to the Exchange server that it does not support secure renegotiation when it should, the Exchange server terminates the connection and returns an ERR_EMPTY_RESPONSE.

When using NGFW policy-based mode, modifying a security policy causes all sessions to be reset.

Stress test shows packet loss when testing with flow inspection mode and application control.

Local-in policy does not deny IKE UDP 500/4500.

Unable to connect to the reserved management interface allowed by the local-in policy.

Packet loss occurs due to a high amount of fragment reassembly failures.

Promethean Screen Share (multicast) is not working on the member interfaces of a software switch.

When matching traffic result and no internet service is configured, lower singularity object result may overwrite higher ones.

ISDB source matching is inconsistent between transparent and NAT modes.

Geolocation block on VIP object failed with seemly correct configuration.

Kernel panic occurs while collecting the debug flow.

Traffic is dropped intermittently by the implicit deny policy, even though there is a valid policy on the FortiGate.

The Clone Reverse option is missing when right-clicking on an entry on some policy pages.

Traffic is hitting the implicit deny policy when changes are made to a policy.

Need ability to add external resource as source address in a local-in policy.

Session dropped with timeout action after policy changes.

Inaccurate sFlow interface data reported to PRTG after upgrading to 7.0.

Virtual server aborts connection when ssl-max-version is set to tls-1.3.

Source interface filter (srcintf-filter) is not working with virtual servers.

Unable to add additional MAC address objects in an address group that already has 152 MAC address objects.

NPD failed to parse zone in the source interface of a DoS/ACL policy and failed to offload.

Making a full HTTP session is sometimes bypassed if ssl-hsts is enabled for a server-load-balance VIP.

NGFW VDOM incorrectly includes all interfaces belonging to the root VDOM on interface and policy related GUI pages.

Change the sandbox PDF report query to be on-demand.

On the System > FortiGuard page, the override FortiGuard server for AntiVirus & IPS Updates shows an Unknown status, even if the server is working correctly. This is a display issue only; the override feature is working properly.

On the System > Fabric Management page, the registration status for FortiSwitches and FortiAPs have a Failed to fetch status error.

FortiLink NAC matched device is displayed in the CLI but not in the GUI under WiFi & Switch Controller > NAC Policies > View Matched Devices.

When a FortiGate local administrator is assigned to more than two VDOMs and tries logging in to the GUI console, they get a command parse error when entering VDOM configuration mode.

New IPsec design tunnel-id still displays the gateway as an IP address, when it should be a tunnel ID.

Bandwidth widget does not display traffic information for VLAN interfaces when a large number of VLAN interfaces are configured.

WiFi & Switch Controller > Managed FortiAPs list does not load if there is an invalid or unsupported FortiAP configured.

After rebooting, the Licenses widget shows an Unable to connect to FortiGuard servers message for ten minutes.

Inbound traffic on the interface bandwidth widget shows 0 bps on the VLAN interface.

On the policy dialog page, the Select Entries box for the Service field does not list all service objects if an IPv6 address is in the policy.

High iowait CPU usage and memory consumption issues caused by report runner.

When a VLAN belongs to a zone, and the zone is used in a policy, editing the VLAN ID changes the policy's position in the table.

On the Policy & Objects > Schedules page, when the end date of a one-time schedule is set to the 31st of a month, it gets reset to the 1st of the same month.

Workaround: use CLI to set schedules with an end date of 31st.

Security Fabric root FortiGate is unable to resolve firewall object conflicts in the GUI.

Log & Report > Forward Traffic logs do not show the Policy ID if there is no Policy Name.

On the Log & Report > Forward Traffic page, using the filter Result : Deny(all) does not work as expected.

Managed FortiSwitches page, policy pages, and some FortiView widgets are slow to load.

Security rating test for FortiCare Support fails when connected to FortiManager Cloud or FortiAnalyzer Cloud.

The dropdown field for the IdP Certificate is empty when editing an SSO user configuration (User & Authentication > Single Sign-On), even though the summary shows an IdP certificate.

Incorrect information is being displayed for the HA role on the System > HA page.

Unable to load the Network > SD-WAN > SD-WAN Rules table sometimes due to a JavaScript error.

On the WiFi & Switch Controller > SSIDs page, multiple DHCP servers for the same range can be configured on an interface if the interface name contains a comma (,) character.

Unable to access GUI via HA management interface of secondary unit.

Intermittent error, Failed to retrieve FortiView data, appears on real-time FortiView Sources and FortiView Destination monitor pages.

GUI needs to allow the members of the software switch interface to be used in IPv4/IPv6 multicast policy.

Unable to move SD-WAN rule ordering in the GUI (FortiOS 7.2.1).

Unable to delete the LAN interface's addresses without switching it back to a none-LAN role.

The Network > Interfaces faceplate shows two SFP interfaces, which do not exist on that FortiGate model.

When upgrading the FortiGate firmware upgrade from FortiGuard, update the API description text for the file name.

On the System > HA page, a Failed to retrieve info caution message appears when hovering over the secondary unit's Hostname. The same issue is observed on the Dashboard > Status > Security Fabric widget.

On G-model profiles, changing the platform mode change from single 5G (dedicated scan enabled) to dual 5G is not taking effect.

The secondary unit tries to contact the forward server for sending the health check packets when the healthcheck under web-proxy forward-server is enabled.

Long-lasting sessions expire on the HA secondary in large session synchronization scenarios.

IPsec phase 2 is down because the connection expired due to RFC 6311 HA recovery failure.

Due to an HA port (Intel i40e) driver issue, not all SW sessions are synchronized to the secondary, so there is a difference.

Virtual MAC address is sent inside GARP by the secondary unit after a reboot.

HA split brain scenario occurs after upgrading from 6.4.6 to 7.0.6, and HA heartbeats are lost followed by a kernel panic. Affected platforms: NP7 models.

A cluster is repeatedly out-of sync due to external files (SSLVPN_AUTH_GROUPS) when there are frequent user logins and logouts.

HA is out-of-sync due to SD-WAN default configuration for a newly created VDOM.

Certificate upload causes HA checksum mismatch.

Secondary FortiGate FQDN is stuck in the queue, even if the primary FortiGate FQDN has already been resolved.

When the internet service name management checksum is changed, it is out-of-sync when the auto-update is disabled on FortiManager.

After shutting down the HA primary unit and then restarting it, the uptime for both nodes is zero, and it fails back to the former primary unit.

Running execute ha manage 0 <remote_admin> fails and displays a Permission denied, please try again. error if the 169.254.0.0/16 local subnet is not in the trusted host list.

HA A-P clusters keeps getting out-of-sync due to local VPN certificate.

HA failovers occur due to the kernel hanging on FG-100F.

Communication is disrupted when HA switching is performed in an environment where the VDOM is split to accommodate two IPoE lines.

CLI deployment of a configuration to the secondary unit results in an unresponsive aggregate interface.

After an HA split-brain event, the PPPoE interfaces are not recovered.

Secondary FortiGate unit in an HA cluster enters conserve mode due to high memory consumption by node scripts.

Static ARP entry is removed after reboot or HA failover.

The HA pair primary keeps sending fgFmTrapIfChange and fnTrapIpChange after upgrading.

HA A-P virtual cluster information is not correctly presented in the GUI and CLI.

Session load balancing is not working in HA A-A configuration for traffic flowing via the VLAN interface when the port1 link is down on platforms with a 4.19 kernel.

The first ICMP redirected from the FGSP secondary is dropped on the FGSP primary when UTM is enabled.

New factory reset box failed to synchronize with primary, which was upgraded from 7.0.

When adding or removing an HA monitor interface, the link failure value is not updated.

Telnet connection running ping fails during FGSP failover for virtual wire pair with VLAN traffic.

Firewall virtual IP (VIP) features that are not supported by hyperscale firewall policies are no longer visible from the CLI or GUI when configuring firewall VIPs in a hyperscale firewall VDOM.

After changing hyperscale firewall policies, it may take longer than expected for the policy changes to be applied to traffic. The delay occurs because the hyperscale firewall policy engine enhancements added to FortiOS may cause the FortiGate to take extra time to compile firewall policy changes and generate a new policy set that can be applied to traffic by NP7 processors. The delay is affected by hyperscale policy set complexity, the total number of established sessions to be re-evaluated, and the rate of receiving new sessions.

After packets go through host interface TX/RX queues, some packet buffers can still hold references to a VDOM when the host queues are idle. This causes a VDOM delete error with unregister_vf. If more packets go through the same host queues for other VDOMs, the issue should resolve by itself because those buffers holding the VDOM reference can be pushed and get freed and recycled.

Unrelated background traffic gets impacted when changing a policy where a hyperscale license is used.

IPv6 traffic continues to pass through a multi-VDOM setup, even when the static route is deleted.

Interface routes under DHCP mode remain in LPMD after moving the interface to another VDOM.

Changes in the zone configuration are not updated by the NPD on hyperscale.

Allowing intra-zone traffic is now supported in hyperscale firewall VDOMs. Options to block or allow intra-zone traffic are available in the GUI and CLI.

Bad gateway occurs using ICAP with explicit proxy under traffic load.

High IPS engine CPU usage due to recursive function call.

The IPS sessions count is higher than system sessions, which causes the FortiGate to enter conserve mode.

High CPU in all cores with device running with one interface set as a one-arm sniffer.

High CPU usage on IPS engine when certain flow-based policies are active.

Improvements to IPS engine monitor to resolve an error condition during periods of heavy traffic loads.

High IPS engine memory usage after device upgrade.

Implementing the route-overlap setting on phase 2 configurations brings tunnels down until a reboot is not performed on the FGSP cluster.

IKE crashes after HA failover when the enforce-unique-id option is enabled.

Certain packets are causing IPsec tunnel drops on NP6XLite platforms after HA failover because the packet is not checked properly.

The packets did not pass through QTM, and SYN packets bypass the IPsec tunnel once traffic is offloaded. Affected platforms: NP7 models.

FortiGate is unable to install SA (failed to add SA, error 22) when there is an overlap in configured selectors.

The vpn-id-ipip encapsulated IPsec tunnel with NPU offloading cannot be reached by IPv6.

Enabling NPU offloading in the phase 1 settings causes a complete traffic outage after a couple of ping packets pass through.

ADVPN hub randomly initiates secondary tunnel to spoke, causing spoke to drop tunnel traffic for RPF check fail.

IPsec static router gateway IP is set to the gateway of the tunnel interface when it is not specified.

NP7 offloaded egress ESP traffic that was not sent out of the FortiGate.

After changing the password policy to enable it, all non-conforming IPsec tunnels were wiped out after rebooting/upgrading.

NP dropping packet in the incoming direction for SoC4 models.

IPsec learned route disappears from the routing table.

NP7 drops outbound ESP after IPsec VPN is established for some time.

Dialup selector routes are not deleted after iked crash.

IKE repeatedly crashes with the combination of DDNS and dialup gateways.

IPsec DPD packets keep getting sent while IPsec traffic passes through the tunnel (DPD mode is on-idle).

iked signal 11 crash occurs once when running a VPN test script.

The iked daemon experiences a signal 11 crash when a static IPsec gateway is configured, the FortiGates are in HA, and an HA state change occurs.

Unable to send traffic in VXLAN over IPSec when the VTEP is configured in a VDOM.

IPsec VPN statistics are not increasing on the device.

Entering set domain <string> returns a not a valid dns domain error.

Unable to edit the parent interface from the IPsec configuration if it was configured on an IPIP tunnel.

The IPsec aggregate interface does not appear in the Interface dropdown when configuring the Interface Bandwidth widget.

A new VPN interface with vpn-id-ipip encapsulation has MAC address ff:ff:ff:ff:ff and cannot set remote the IP until the FortiGate reboots.

Unexpected dynamic selectors block traffic when set mesh-selector-type subnet is configured.

Unable to reestablish a new IPsec L2TP connection for 10 minutes after the previous one disconnected. The issue conditions are local in traffic and a policy-based IPsec tunnel.

Improper IKEv1 quick mode fragmentation from third-party client can cause an IKE crash.

OCVPN fails to create a policy when the interface belongs to a zone.

FortiGate IPsec tunnel role could be incorrect after rebooting or upgrading, and causes negotiation to be stuck when it comes up.

Unable to select FortiAnalyzer as a data source on the Summary tab for the System Events and Security Events pages.

Get an intermittent error when running execute log fortianalyzer-cloud test-connectivity.

On the Log Settings page, a VDOM administrator can force a FortiCloud log out of for all VDOMs.

FortiGate appears to have a limitation in the syslogd filter configuration.

Forward traffic logs intermittently fail to show the destination hostname.

Archived Data tab is missing from intrusion prevention and application control log Details pane once log-packet is enabled.

FortiGate Cloud log viewer shows no results for the 5 minutes and 1 hour time period due to an incorrect timestamp (24 hours is OK).

The dstname log field cannot store more than 66 characters.

Policy ID filter is not working as expected.

On the Log & Report > ZTNA Traffic page, the client's Device ID is shown as [object Object]. The Log Details pane show the correct ID information.

GTP/PFCP msg-type log field shows the name of GTP type. This breaks the workflow and DT processes in the FortiAnalyzer event handlers, FortiAnalyzer datasets, and scripts.

Packet captured by firewall policy cannot be downloaded.

FortiCloud log statistics chart on the Log Settings page shows incorrect data.

FortiAnalyzer log statistics chart on the Log Settings page shows incorrect data.

When log pages are scrolled down, no logs are displayed after 500 lines of logs.

Unable to mouse over an IP address in FortiGate logs.

Log & Report > Forward Traffic logs do not return matching results when filtered with !<application name>.

Older Forward Traffic logs are not visible on the FortiGate with 1 hour, 24 hours, and 7 days time period after upgrading.

When FortiGate Cloud logging is enabled, the option to display 7 days of logs is not visible on the Dashboard > FortiView pages.

An issue occurs with TLS 1.3 and the 0RTT process where Firefox cannot access https.google.com using proxy-based UTM with certification inspection.

WAD crash occurred when forwarding the release bytes from the IPS engine to the server and the connection to the server is closed.

An expired certificate can be chosen when creating an SSL/SSH profile for deep inspection.

Apple push notification service fails with proxy-based inspection.

When a server sends a connection close response too early, traffic from the client may be interrupted inadvertently before the request is completed.

HTTPS sites blocked due to cert-probe-failed triggered by SSL exemption in deep inspection.

WAD crash occurs when TLS/SSL renegotiation encounters an error.

WAD crash occurs when TLS 1.2 receives the client certificate and that server-facing SSL port has been closed due to the SSL bypass.

Inspecting all ports in deep inspection is dependent on previous protocol port mapping settings.

In proxy inspection mode with AV enabled, TCP traffic is dropped after a while.

Upgrading broke IM controls and caused Zalo chat file transfer issues.

WAD crashes when the following conditions are met: the FortiGate is an HA secondary, it is configured with a web proxy forward server in a proxy policy, and the forward server has health check enabled.

When an LDAP user is authenticated in a firewall policy, the WAD user-info process has a memory leak causing the FortiGate to enter conserve mode.

Stress test shows cryptographic errors in proxy mode.

An error condition occurs in WAD while parsing certain URIs.

WAD crash occurs on FG-61E, FG-101F, FG-61F, FG-200E, and FG-401E during stress testing.

When ZTNA access proxy is configured with set empty-cert-action accept-unmanageable, users may receive an error loading the page when the client certificate is not properly processed.

Image should be embedded directly into the replacement message page.

Explicit proxy traffic is terminated when IPS is enabled. The exact failure happened upon certificate inspection.

One WAD daemon is consistently using 99% CPU.

When WAN optimization is disabled and the dispatcher sends the tunnel manager listener to the workers, the workers cannot handle it properly and a WAD crash segmentation fault occurs.

Changing the virtual server configuration during traffic caused the old configuration to flush, which resulted in a WAD crash.

WAD crash occurs when configuring a proxy policy with no member in an address group.

ICAP client timeout issue causes WAD segmentation fault crash after upgrading to 7.0.6 from 6.4.

TLS 1.3 handshake fails in proxy mode when the FortiGate tries to obtain certificate information from a specific server.

There is no replacement message for an IPS custom signature block in a proxy inspection mode firewall policy or proxy policy.

Console randomly displays a read_tagbuf - 152: Failed to open device: /dev/sdb errno:2(No such file or directory) error.

Access proxy does not use the selected profile-protocol-options.

Improvementsto WAD to resolve a memory usage issue when user-info updates the FortiAP information.

The WAD process memory usage gradually increases over a few days, causing the FortiGate to enter into conserve mode.

An encoded HTTP header may be improperly handled, causing inadvertent disruption to traffic.

The start parameter has no effect with the /api/v2/monitor/user/device/query API call.

Able to add incomplete policies with empty mandatory fields using the REST API.

Traffic does not fail over to alternate path upon interface being down (FGR-60F in transparent mode).

Static routing using ISDB is randomly not working because the SD-WAN configuration is not flushed from the kernel routing table when SD-WAN is disabled.

Default routes are deleted after adding a new default route with a CIDR IP as a gateway.

Virtual server active-standby failover is not working with a UDP server type.

Secure SD-WAN Monitor in FortiAnalyzer does not show graphs when the SLA target is not configured in SD-WAN performance SLA.

Disabling BFD causes an OSPF flap/bounce.

BGP confederation and AS prepend the route advertisement format.

In a BGP neighbor, the allowas-in 0 value is confusing and not accepted by the GUI for validation (1-10 required).

Wrong MAC address is in the ARP response for VRRP IP instead of the VRRP virtual MAC.

Router prefix list matching is not work properly for VPNv4 routes.

When changing interfaces from dense mode to sparse mode, and then back to dense mode, the interfaces did not show up under dense mode.

Unable to configure IPsec static route.

Static routes are incorrectly added to the routing table, even if the IPsec tunnel type is static.

The speed-test-server list cannot be loaded due to limited buffer size.

Traffic behaves differently for connected routes and IGP routes in an ADVPN or SD-WAN environment.

IPv6 SD-WAN health check is not working after a disconnection.

Static routes from DHCP option 121 are not installed on the FortiGate acting as the DHCP client.

IPv6 link local address is added into the routing table.

Static route through an IPsec interface is not removed after the BFD neighbor goes down.

FortiGate as an NTP server is not using SD-WAN rules.

OSPF packets are unevenly distributed with the LAG hash algorithm.

When the policy route has a gateway set, the FortiGate is not following the policy route to forward traffic and sends unreasonable ARP requests.

Reply traffic from the DNS proxy (DNS database) is choosing the wrong interface.

When creating a new rule on the Network > Routing Objects page, the user cannot create a route map with a rule that has multiple similar or different AS paths in the GUI.

IoT device vulnerabilities should be included in security ratings.

Security Fabric widget and Fabric Connectors page do not identify FortiGates properly in HA.

The threat level threshold in the compromised host trigger does not work.

After adding a Fabric device widget, the device widget does not appear in the dashboard.

Unable to resolve dynamic address from ACI SDN connector on explicit web proxy.

After authorizing a downstream FortiGate, an empty name and offline status appear in the device registration wizard.

Automation stitch trigger is not working when the threshold based email alert is enabled in the configuration.

Upgrading from 6.4.8 to 7.0.5 causes SDN firewall address configurations to be lost.

Unable to add another FortiGate to the Security Fabric after updating to the latest patch.

Only the first ACI SDN connector can be kept after upgrading from 6.4.8 if multiple ACI SDN connectors are configured.

When a custom LLDP profile has auto-isl disabled, the security rating test, Lockdown LLDP Profile, fails.

The FortiAP Firmware Versions and FortiSwitch Firmware Versions security rating tests fail because the firmware version on the FortiAPs and FortiSwitches is not recognized correctly.

Various places in the GUI do not show the secondary HA device.

External resource full certificate check does not validate certificate when the URI is an IP address.

Updated empty group with SAML user does not trigger an SSL VPN firewall policy refresh, which causes the SAML user detection to not be successful in later usage.

SSL VPN web mode cannot display certain websites that are internal bookmarks.

SSL VPN web proxy issue with Qlik web appliaction.

Unable to select vip64 in nat64 firewall policy in the CLI if the srcintf is an SSL VPN interface.

Unable to load GitLab through SSL VPN web portal.

SSL VPN web mode has problems accessing ComCenter websites.

VNC using SSL VPN web mode disconnects after 10 minutes.

SSL VPN bookmark is not working in https://vpn.li***.lt.

FortiGate is not sending Accounting-Request packet that contains the Interim-Update AVP when two-factor authentication is assigned to a user (defined on the FortiGate) while connecting using SSL VPN.

SSL VPN bookmark does not work when usergroup name has an ampersand character (&).

EICAR file cannot be blocked through the SSL VPN policy when NTurbo is enabled.

The PROD-MDN-WS1 SSL VPN portal is not loading properly, and cannot navigate within the page.

SSL VPN web mode fails to load some modules in customer's internal website (***.sri4.***).

SSL VPN web proxy could not render web application that uses a URL to pass a JSESSIONID

SSL VPN does not work properly after reconnecting without authentication and a TX drop is found.

GUI should not use <server_ip> as a sender to send the SSL VPN configuration (it should use value set in reply-to).

Multiple DNS suffixes cannot be set for the SSL VPN portal.

Unable to open internal website with JavaScript code in SSL VPN web mode.

SSL VPN web mode bookmark incorrectly applies a URL redirect.

SSL VPN crashes after copying a string to the remote server using the clipboard in RDP web mode when using RDP security.

Internal resource pages and menus are not showing correctly in SSL VPN web mode.

Internal website with JavaScript lacks some menus in SSL VPN web mode.

Some back-end server images (*.co***.com) could not be displayed in SSL VPN web mode.

Camera application is not loading in SSL VPN web mode.

VMware vCenter bookmark in not working after logging in to SSL VPN web mode.

SSL VPN web mode is unable to access EMS server.

Unresponsive portal bookmark in SSL VPN web mode for server that does not support OpenSSL 3.0.2.

Faulty web view for JavaScript web applications in SSL VPN web portal.

A log in page display error occurs when using an SSL VPN web proxy.

When using SSL VPN to do auto-reconnect without authentication, it always fails the second time it tries to reconnect.

Unable to access internal device in SSL VPN web mode.

Veeam Backup Enterprise website has SSL VPN access problem in web mode.

A blank page displayed after logging in to the back-end server in SSL VPN web mode.

Unable to access customer's internal website in SSL VPN web mode.

Getting re-authentication pop-up window for VNC quick connection over SSL VPN web proxy.

Internal website cannot be displayed correctly in SSL VPN web mode.

On the VPN > SSL-VPN Settings page, when the source-address-negate option is enabled for an address in the CLI, the GUI does not display an exclamation mark against that address entry in the Hosts field.

This is cosmetic and does not affect on the FortiGate functionality or operation. The source-address-negate option being enabled can be confirmed in the CLI.

Opening an SSL VPN web portal bookmark results in a blank page.

SSL VPN web mode failed to load some modules for internal website.

Internal website http://oc***.di***.com dropdown menu on an SSL VPN web mode bookmark in always stays on and does not close.

RDP over VPN SSL web mode stops work after upgrading.

Unable to open a PDF in SSL VPN web mode.

The sslvpn process crashes if a POST request with a body greater than 2 GB is received.

Bookmark in SSL VPN web portal does not work as expected.

The http://www.op***.org website does not work in SSL VPN web mode.

Browser displays an Error, Feature is not available message if a file larger than 1 MB is uploaded from FTP or SMB using a web bookmark, even though the file is uploaded successfully. There are no issues with downloading files.

Add link status to managed FortiSwitch switch ports.

The 40000cr4 port speed is not available under the switch-controller managed-switch port speed settings.

Managed FortiSwitch only shows one port of the FortiLink aggregate interface.

Layer 3 FortiLink does not come up after upgrading.

FortiLink daemon keeps pushing the configuration to FortiSwitch for a long time when the FortiSwitch is deleted and re-discovered.

The interface used by a sniffer policy cannot be used in a zone.

The dnp process goes to 100% CPU usage as soon as the configuration is downloaded via SCP. Affected platforms: FGR-60F and FGR-60F-3G4G.

Client traffic from VLAN to VXLAN encapsulation traffic is failing after upgrading.

Random LTE modem disconnections due to certain carriers getting unstable due to WWAN modem USB speed under super-speed.

When fastpath is disabled, counters in the dashboard are showing 0 bytes TX/RX for a VLAN interface configured on an LACP interface.

Traffic shaping statistics do not work with NP7 offloading.

Poor CPS performance with VLAN interfaces in firewall only mode (NP7 and NP6 platforms).

PSU alarm log and SNMP trap are added for FG-10xF and FG-8xF models.

When a virtual switch member port is set to be an alternate by STP, it should not reply with ARP; otherwise, the connected device will learn the MAC address from the alternate port and send subsequent packets to the alternate port.

Deleting a VDOM that contains EMAC interfaces might affect the interface bandwidth widget of the parent VLAN.

A member of an LAG interface is not coming up due to a different actor key.

After upgrading from 6.4.9 to 7.0.5, the FG-110xE's 1000M SFP interface may fail to auto-negotiate and cannot be up due to the missed auto-negotiation.

The threshold for conserve mode is lowered.

Get newcli crash when running the diagnose hardware test memory command.

After a device reboot, the modem interface sometimes does not have a stable route with the local carrier.

Session anomaly was incorrectly triggered though concurrent sessions on the FortiGate that were below the configured threshold.

IPv6 DHCP relay packets traversing an npu_vlink are incorrectly sourced with the address of the npu_vlink interface.

In FIPS-CC mode, if cfg-save is set to revert, the system will halt a configuration change or certificate purge.

In some cases, the HA SNMP OID responds very slowly or does work correctly.

Traffic loss occurs when running SNAT PBA pool in a hyperscale VDOM. The NP7 hardware module PRP got stuck, which caused the NP7 to hang.

DoS policy ID cannot be moved in GUI and CLI when enabling multiple DoS policies.

Kernel panic occurs after traffic goes through IPsec VPN tunnel and EMAC VLAN interface.

Get root.firewall.service.custom... configuration error after upgrading or changing LAN extension to traffic VDOM.

NP7 platforms may encounter a kernel panic when deleting more than two hardware switches at the same time.

Slow upload speeds when connected to FIOS connection. Affected platforms: NP6Lite and NP6xLite.

When creating an inner VLAN CAPWAP interface or sending inner VLAN traffic when the FortiGate is rebooting/upgrading from capwap-offload disable status, these actions trigger a freeze. Affected platforms: NP7 models.

Running get system performance status does not update the data.

The ifLastChange SNMP OID only shows zeros.

There is no 1000auto option under the ports. Affected platforms: FG-110xE.

1G copper SFP port is always up on FG-260xF.

LTE fails to connect after the firewall reboots. Multiple reboots are required to bring back connectivity.

PPPoE is not working on FG-60E wan2 interface.

Polling fgfwpolid returns disabled policies.

When pushing a script from FortiManager to FortiGate, FortiOS will sometimes send the CLI change to FortiManager with the FGFM API. If the tunnel is not up, the session will not exist and it causes a code crash.

CMDB checksum is not updated when a certificate is renewed over CMP, causing a FortiManager failure to synchronize with the certificate.

The cid process is consuming high memory, and the FortiGate enters conserve mode.

The reply-to option in the email server settings is no longer visible in a default server configuration on FortiOS 7.2.0.

DoS policy with custom service does not work as expected on a PPPoE interface.

Get disk error message after changing disk usage to wanopt.

Null pointer causing kernel crash on FWF-61F.

FortiGate in HA may freeze and reboot. Before the reboot, softIRQ may be seen as high. This leads to a kernel panic.

Unable to resolve sp***.saas.ap***.com on a specific VDOM.

As the size of the internet service database expands, ffdb_err_msg_print: ret=-4, Error: kernel error is observed frequently on 32-bit CPU platforms, such as the FG-100E.

Constant increase (3%-4%) in memory occurs everyday.

HQIP memory test failed and triggered a log out with a newcli process crash.

The cmdbsvr process may crash when there are many addresses and address groups that include each other recursively.

Random kernel panic may occur due to an incorrect address calculation for the internet service entry's IP range.

Signature updating from FortiManager does not work after cloud communication is disabled.

High fcnacd usage occurs and unable to retrieve EMS information from the FortiGate CLI.

FortiGate becomes unresponsive, and there are many WAD and forticron crashes.

Kernel panic occurs due to VXLAN.

When the uplink modem is restarted, the FortiGate interface configured as PPPoE is unable to obtain an IP address.

Unable to remove DDNS entry frequently, even if the DDNS setting is disabled.

Kernel panics occurs on secondary HA node on NP7 models (7.0.6).

FG-4400F setting speed of 40000full on QSFP port is not applied at the NIC level.

Unexpected device reboots with the kernel panic error on NP7 models.

When deleting a non-existing entry, the error code returned is not appropriate.

Burst in multicast packets is causing high CPU usage on multiple CPU cores.

Trusted hosts are not working correctly in FortiOS 7.2.1.

DoS anomaly has incorrect threshold after loading a modified configuration file.

Running get system auto-update versions causes newcli to crash and the prints quit at the MAC address database.

Random kernel panic occurs and causes the device to reboot.

The GUI and API stopped working after loading many interfaces due to httpsd stuck in a D state (kernel I/O socket).

IPS and application control is causing the FortiGate (VWP) to change either the source MAC address or the destination MAC address based on the flow.

FG-3700D unexpectedly reboots after the COMLog reported a kernel panic due to an IPv6 failure to set up the master session for the expectation session under some conditions.

Kernel panic and regular reboots occur on NP7 platforms, which are caused by FortiOS trying to offload a receiving ESP packet from the EMAC VLAN interface and convert to an IPv6 destination address with NAT46 NPU offloaded sessions.

Can't find xitem. Drop the response. error appears for DHCPOFFER packets in the DHCP relay debug.

Unexpected console error appears: unregister_netdevice: waiting for pim6reg1 to become free. Usage count = 3.

DHCP relay does not work properly with two DHCP relay servers configured.

Remote access management from a FortiManager login fails if trusted hosts are configured for the administrator account.

Huge configuration files cause delays during the booting process.

Network device kernel null pointer is causing a kernel crash.

Issue with the server_host_key_algorithm compatibility when using SSH on SolarWinds.

There may be a race condition between the CMDB initializing and the customer language file loading, which causes the customer language file to be removed after upgrading.

Random reboots and kernel panic on NP7 cluster when the FortiGate sends a TCP RST packet and IP options are missing in the header.

The FortiGate is only offering the ssh-ed25519 algorithm for an SSH connection.

The 40G/100G port goes down on FG-260xF when upgrading to 7.2.

GUI displays a blank page if vdom-admin user has partial permissions.

Link lights on the FG-1100E fail to come up and are inoperative after upgrading.

Observed Node exiting due to unhandled rejection error messages in crash log after upgrading to 7.2.1.

Upgrading from 7.0.5 (split-VDOM mode) to 7.2.0 converts to multi-VDOM). Certificates are not exported in the backup configuration.

Traffic counters in diagnose sys modem history become empty after upgrading from 6.4.

The FortiGate will not send a MAC-based authentication RADIUS authentication request for one of the devices on the network.

The samld process is killed if the SP certificate set has an ECC 384-bit public key.

Remote RADIUS user password change does not work if password encoding is ISO-8859-1 on the FortiGate.

Unable to create a new guest user if its ID is the ASCII code of a character that is the name of a local user.

The srchwvendor, devtype, srcfamily, osname, and srchwversion log fields are not populated properly if the devices are behind a router or proxy.

When multiple FSSO CA connections are configured at the same time, only the last configured FSSO connection comes up.

When a device is detected as vulnerable, its source is not set and the inventory query quits.

FortiGate is adding the same LDAP server in the list of LDAP servers to try twice in fnbamd.

Subject Alternative Name (SAN) is missing from the certificate upon automatic certificate renewal made by the FortiGate.

After a few days, some devices are not displayed in the Users & Devices > Device Inventory widget and WiFi & Switch Controller > FortiSwitch Ports page's Device Information column due to a mismatch in the device count between the following commands.

• diagnose user device list
• diagnose user device stats
• diagnose user-device-store device memory list

The Device detection option is missing in the GUI for redundant interfaces (CLI is OK).

A User device store query error (error code: -1) warning appears on the Asset Identity Center page.

RADIUS Access Request message needs to be sent when the client reconnects during firewall authentication session expiration.

Unknown CA issue can be bypassed when connecting Fortinet hosted servers.

The device identification scanner crashes due to delayed fragments.

RADIUS re-authentication is not following RFC 2865 standards.

Incorrect source MAC address is used in LLDP TX packet when the interface has https in allowaccess.

LLDP packets are not being received if mgmt is used as an HA management reservation interface.

FortiToken purge in a VDOM clears all FortiToken statuses in the system.

The cid process crashes when cloning of 60000 security policies.

Adding a local user to a group containing many users causes a delay in GUI and CLI due to cmdbsvr (high CPU).

RADIUS MAC authentication using ClearPass is intermittently using old credentials.

FortiToken activation emails should include HTTPS links to documentation instead of HTTP.

Some embedded SSL certificates entered the Error state after enabling FIPS-CC.

The EAP proxy worker application crashes frequently.

IPv6 traffic triggers <interface>: hw csum failure message on CLI console.

Traffic/session logging incorrectly refers to SR-IOV secondary interfaces when the Rx is from fast path.

Dynamic address objects are removed after Azure API call failed and caused legitimate traffic drop.

Every time the FortiGate reboots, the certificate setting reverts to self-sign under config system ftm-push.

SFTP backup not working with Azure storage account.

Unable to enable FIPS cipher mode on FG-VM-ARM64-AWS.

Problem accessing some web servers when WAF and AV are enabled in same policy (proxy inspection mode).

System events logs randomly contain a msg=UrlBwl-black gzopen fail message.

FGSP cluster with UTM blocks websites when NTurbo or offloading is enabled.

Support matching IPv4 mapped IPv6 hostnames in the URL filter.

Web filter is not logging all URLs properly.

Unrated is displayed, even if the system language is set to Japanese when the policy inspection mode is set to flow.

FortiOS exhibits segmentation fault on hostapd on the secondary controller configured in HA.

FortiGate is not sending RADIUS accounting message consistently to RADIUS server for wireless SSO.

CAPWAP traffic is dropped when capwap-offload is enabled.

Configuration installation from FortiManager breaks the quarantine setting, and the VAP becomes undeletable.

FG-1800F drops wireless client traffic in L2 tunneled VLAN with capwap-offload enabled.

Wireless multicast traffic causes the cw_acd process to have high CPU usage and triggers a hostapd crash.

Suggest replacing the IP Address column with MAC Address in the Collected Email widget.

CAPWAP data traffic over redundant IPsec tunnels failing when the primary IPsec tunnel is down (failover to backup tunnel).

Connectivity loss occurs due to switch and FortiAPs (hostapd crash).

Application hostapd crash found on FG-101F.

The cw_acd process crashes several times after the system enters conserve mode.

A hostapd process crash is shown in device crash logs.

Wireless client shows portal related webpage while doing MAC authentication with MAB mode.

CAPWAP daemon (cw_acd) experiences a signal 11 crash when reconnecting a FortiAP to the FortiGate, and the FortiGate does not populate SA scan data on radio0 and radio1 of 231G when starting the SA from the FortiGate GUI.

The cw_acd process is deleting dynamic IPsec tunnels on the secondary device, which causes the FortiAPs to disconnect on the primary device.

Dynamic VLAN assignment is disabled in the GUI when editing an SSID with radius mac-auth and dynamic-vlan enabled.

FortiAP goes through DTLS_SETUP for standby session when the ACD count is set to multicore.

The voice-enterprise value changed after upgrading.

HA FortiGate encounters multiple hostapd crashes.

Hostapd segmentation fault signal 6 occurs upon HA failover.

Hostapd segmentation fault signal 11 occurs upon RF chamber setup.

The cw_acd process appears to be stuck, and is sending several access requests for MAC authentication.

Invalid wireless MAC OUI detected for a valid client on the network.

Proxy policy disclaimer is not working, even when there is no url-map="/" configured on the access proxy.

WAD re-challenges user authentication upon HA failover.

Support the browser version in the firewall proxy-address settings for the user agent.

FortiAuthenticator Cloud zero trust tunnel (ZTNA connection) fails when EMS Fabric connector is configured.

The EMS tag name (defined in the EMS server's Zero Trust Tagging Rules) format changed in 7.2.1 from FCTEMS<serial_number>_<tag_name> to EMS<id>_ZTNA_<tag_name>.

After upgrading from 7.2.0 to 7.2.1, the EMS tag format was converted properly in the CLI configuration, but the WAD daemon is unable to recognize this new format, so the ZTNA traffic will not match any ZTNA policies with EMS tag name checking enabled.

An offline FortiClient should be immediately rejected by ZTNA.

ZTNA TCP forwarding is not working when a real server is configured with an FQDN address type.

An FQDN address type that can resolve public IPs is not recommended for ZTNA TCP forwarding on real servers because the defined internal DNS database zone is trying to override it at the same time. By doing so, the internal private address may not take effect after rebooting, and causes a ZTNA TCP forwarding failure due to the real server not being found.

ZTNA server (access proxy VIP) is causing all interfaces that receive ARP request to reply with their MAC address.

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2022-42469

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2022-41330

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2022-41328

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2022-41329

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2022-41327

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2022-42474

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2022-42476

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2023-33308

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2022-43947

FortiOS 7.2.4 is no longer vulnerable to the following CVE Reference:

• CVE-2023-28002