Unexpected behavior occurs when configuring internet services with custom or ISDB entries, leading to failed negate options and issues with internet-service6 functionality.

In some cases, the explicit proxy policy list can take a long time to load due to a delay in retrieving the proxy statistics. This issue does not impact explicit proxy functionality.

Workaround: restart the WAD process, or temporarily disable the WAD debugging process (when FortiGate reboots, this process will need to be disabled again).

diagnose wad toggle

(use direct connect diagnose)

Post-upgrade, explicit proxy policies may mismatch when an HTTP CONNECT request or TLS SNI of a HTTPS session partially matches to a policy with deep inspection enabled.

For local out DNAT traffic, the best output route may not be found.

Firewall address list may show incorrect error for an unresolved FQDN address. This is purely a GUI display issue; the FQDN address can be resolved by the FortiGate and traffic can be matched.

Workaround: run the following command to check if an FQDN address is being resolved properly.

# diagnose test application dnsproxy 7

The DHCPv6 client does not work with vcluster2.

After a failover, ARP entries are removed from all slots when an ARP query of single slot does not respond.

IPv6 ECMP is not supported for the FG-6000F and FG-7000E platforms. IPv6 ECMP is supported for the FG-7000F platform.

UTM traffic is blocked by an FGSP configuration with asymmetric routing.

The FortiGate 6000 and 7000 platforms do not support IPsec VPN over a loopback interface or an NPU inter-VDOM link interface.

The FortiGate 6000s or 7000s in an FGSP cluster may load balance FTP data sessions to different FPCs or FPMs. This can cause delays while the affected FortiGate 6000 or 7000 re-installs the sessions on the correct FPC or FPM.

FortiGate 7000F chassis with FIM-7941Fs cannot load balance fragmented IPv6 TCP and UDP traffic. Instead, fragmented IPv6 TCP and UDP traffic received by the FIM-7941F interfaces is sent directly to the primary FPM, bypassing the NP7 load balancers. IPv6 ICMP fragmented traffic load balancing works as expected. Load balancing fragmented IPv6 TCP and UDP traffic works as expected in FortiGate 7000F chassis with FIM-7921Fs.

CPU usage data displayed on the FortiGate 6000 GUI is actually CPU usage data for the management board. CPU usage data displayed on the FortiGate 7000 GUI is actually the CPU usage for the primary FIM.

Use the global get system performance status command to display CPU usage and other performance information for all components (on the FortiGate 6000 the management board and all FPCs, or on the FortiGate 7000 the FIMs and FPMs).

This command also displays global performance information including:

 Dataplane CPU states: 1%
 Dataplane memory states: 21%
 Dataplane average sessions: 8720 sessions in 1 minute
 Dataplane average session setup rate: 4632 sessions per second in last 1 minute

On 6K and 7K platforms, the management VDOM GUI should not show the WiFi & Switch Controller menu.

When EMAC VLAN interfaces are removed spontaneously from the configuration, TCP traffic through their underlying VLAN interface fails.

During FIM failover from FIM2 to FIM1, the NP7 PLE sticks on a cache invalidation, stopping traffic.

SLBC special ports will not match local-in policy in the management path.

Graceful upgrade of a FortiGate 6000 or 7000 FGCP HA cluster is not supported when upgrading from FortiOS 7.0.12 to 7.2.6.

Upgrading the firmware of a FortiGate 6000 or 7000 FGCP HA cluster from 7.0.12 to 7.2.6 should be done during a maintenance window, since the firmware upgrade process will disrupt traffic for up to 30 minutes.

Before upgrading the firmware, disable uninterruptible-upgrade, then perform a normal firmware upgrade. During the upgrade process the FortiGates in the cluster will not allow traffic until all components (management board and FPCs or FIMs and FPMs) are upgraded and both FortiGates have restarted. This process can take up to 30 minutes.

SLBC for FortiOS 7.0 and 7.2 uses different FGCP HA heartbeat formats. Because of the different heartbeat formats, you cannot create an FGCP HA cluster of two FortiGate 6000s or 7000s when one chassis is running FortiOS 7.0.x and the other is running FortiOS 7.2.x. Instead, to form an FGCP HA cluster, both chassis must be running FortiOS 7.0.x or 7.2.x.

If two chassis are running different patch releases of FortiOS 7.0 or 7.2 (for example, one chassis is running 7.2.5 and the other 7.2.6), they can form a cluster. When the cluster is formed, FGCP elects one chassis to be the primary chassis. The primary chassis synchronizes its firmware to the secondary chassis. As a result, both chassis will be running the same firmware version.

You can also form a cluster if one chassis is running FortiOS 7.2.x and the other is running 7.4.x.

For best results, both chassis should be running the same firmware version, although as described above, this is not a requirement.

Graceful upgrade from 7.0.12 to 7.2.6 or 7.2.7, or from 7.0.12 to 7.4.2 or 7.4.3 will fail on the FortiGate 6501F/6500F, FortiGate 7060E with slot6 occupied, and FortiGate 7121F with slot12 occupied.

Workaround: Disable uninterruptible-upgrade before performing the firmware upgrade:

config system ha
    set uninterruptible-upgrade disable 
end

Note that traffic will be interrupted for 15 to 45 minutes, depending on the size of the configurations.

Unintended behavior occurs when FortiGate models perform a warm reboot without properly applying virtual domain configurations.

FIM installed NPU session causes the SSE to get stuck.

High CPU usage by the node process occurs when loading 7000 policies due to fetching all statistics in one request.

FortiGate does not honor worker port partition when SNATing connections using a fixed port range IP pool.

Under normal conditions, a FortiGate 6000 or 7000 may generate event log messages due to a known issue with a feature added to FortiOS 7.2 and 7.4. The feature is designed to create event log messages for certain DP channel traffic issues but also generates event log messages when the DP processor detects traffic anomalies that are part of normal traffic processing. This causes the event log messages to detect false positives that don't affect normal operation.

For example, DP channel 15 RX drop detected! messages can be created when a routine problem is detected with a packet that would normally cause the DP processor to drop the packet.

Similar discard message may also appear if the DP buffer is full.

HA remote access does not work as expected when ha-port-dtag-mode is double-tagging.

Read-only administrator may encounter a Maximum number of monitored interfaces reached error when viewing an interface bandwidth widget for an interface that does not have the monitor bandwidth feature enabled.

Workaround: super_admin users can enable the monitor bandwidth feature on the interface first, then the widget can work for read-only administrators.

When viewing entries in the slide-out window of the Policy & Objects > Internet Service Database page, users cannot scroll down to the end if there are over 100000 entries.

When the FortiGate is in conserve mode, node process (GUI management) may not release memory properly causing entry-level devices to stay in conserve mode.

After successfully changing the VLAN ID of an interface from the CLI, an error message similar to cmdb_txn_cache_data(query=log.npu-server,leve=1) failed may appear.

IPv6 traffic fails to load balance across multiple virtual domains when using Equal-cost Multipath (ECMP) in NAT mode on FortiGate devices.

The npu-session list fails to display policy-route information when traffic is routed through a policy route on FortiGate models using NPU acceleration.

Traffic drops occur after Failover in HA A-P setups using hardware-only sessions.

The "diagnose sys npu-session list" command displays incorrect policy IDs when traffic uses intra-zone policies.

NAT46 NPU sessions are lost and traffic drops when a HA failover occurs.

With NAT64 HS policy, ICMP reply packets are dropped by FortiOS.

Traffic not passing across the VDOM link.

Disk logging files are cached in the kernel, causing high memory usage.

If Security Rating is enabled to run on schedule (every four hours), the FortiGate can unintentionally send local-out traffic to fortianalyzer.forticloud.com during the Security Rating run.

Workaround: disable on-schedule Security Rating run.

config system global
    set security-rating-run-on-schedule disable
end

FortiAnalyzer report is not available to view for the secondary unit in the HA cluster on the Log & Report > Reports page.

Workaround: view the report directly in FortiAnalyzer.

An error case occurs in WAD while redirecting the web filter HTTPS sessions.

Unexpected behavior in WAD when there are multiple LDAP servers configured on the FortiGate.

A rare error condition occurred in WAD caused by compounded SMB2 requests.

When there are over 30 downstream FortiGates in the Security Fabric, the root FortiGate's GUI may experience slowness when loading the Fabric Management page, preventing firmware upgrades using the GUI.

Workaround: perform the firmware upgrade in the CLI. To perform the firmware upgrade using the GUI, temporarily disable the Security Fabric on the root FortiGate.

FortiClient Windows cannot be launched with SSL VPN web portal.

Destination address of SSL VPN firewall policy may be lost after upgrading when dstaddr is set to all and at least one authentication rule has a portal with split tunneling enabled.

When configuring an 802.3ad aggregate interface with a 1 Gbps speed, the port's LED is off and traffic cannot pass through. Affected platforms: 110xE, 220xE, 330xE, 340xE, and 360xE.

FortiGate might enter conserve mode if disk logging is enabled and log-traffic all is set in a policy.

Status light is not showing on the FortiGate 60F or 100F after a cold and warm reboot.

On the NP7 platform, setting the interface configuration using set inbandwidth <x> or set outbandwidth <x> commands stops traffic flow.

Workaround: Change the NP7 ""default-qos-type"" setting from shaping to policing. This requires a restart of the device for the configuration to take effect.

config system npu
   set default-qos-type policing
end

In a certain edge case, traffic directed towards a VLAN interface could trigger a kernel interruption.

When the URL filter requests the FortiGuard (FGD) rating server address using DNS, it will try to get both A (IPv4) and AAAA (IPv6) records.

High CPU usage might be observed on entry-level FortiGates if the cache size reaches 10% of the system memory.

SNMP walk of the entire MIB fails when the configuration has split-port and a large number of interfaces.

FortiGate is not able to resolve ARPs of few hosts due to their ARP replies not reaching the primary FPM.

An error message is shown when attempting to create a FortiExtender WAN extension interface.

Egress shaping does not work on NP when applied on the WAN interface.

SolarWinds is unable to negotiate encryption. A Negotiation failed: no matching host key type found error message appears in the log.

The speed 1000auto setting on ports X1 to X4 disappears after upgrading from 7.2.5 to 7.2.6. Affected platforms: FG-40xF and FG-60xF.

DAC cable between FortiGate and FortiSwitch stops working after upgrading from 7.2.6 to 7.2.7.

High CPU on one specific CPU core.

FortiGate 60F and 61F models may experience a memory usage issue during a FortiGuard update due to the ips-helper process. This can cause the FortiGate to go into conserve mode if there is not enough free memory.

Workaround: User can disable CP acceleration to reduce the memory usage.

config ips global
    set cp-accel-mode none
end

When upgrading multiple firmware versions in the GUI, the Follow upgrade path option does not respect the recommended upgrade path.

On the FortiGate 6000F, the ALL TP VDOM cannot synchronize because of switch-controller.auto-config.policy.

When auto-upgrade is disabled, scheduled upgrades on FortiGate are not automatically canceled. To cancel any scheduled upgrades, exec federated-upgrade cancel must be done manually.

If FGTVM was deployed in UEFI boot mode, do not downgrade to any GA version earlier than 7.2.4.

The layer 3 roaming feature may not work when the wireless controller is running multiple cw_acd processes (when the value of acd-process-count is not zero).

In HA cluster of FGT-200F units with 'capwap-offload' enabled, traffic from tunnel SSID cannot pass after HA failover is triggered.

The automatically connect option fails to function when the local radio connection is lost on some FortiGate models.

FortiAP units repeated joining and leaving FortiGate HA cluster when the secondary FortiGate has stored FortiAP images.