Unexpected behavior occurs when configuring internet services with custom or ISDB entries, leading to failed negate options and issues with internet-service6 functionality.

The GUI-explicit-proxy setting on the System > Feature Visibility page is not retained after a FortiGate reboot or upgrade.

In some cases, the explicit proxy policy list can take a long time to load due to a delay in retrieving the proxy statistics. This issue does not impact explicit proxy functionality.

Workaround: restart the WAD process, or temporarily disable the WAD debugging process (when FortiGate reboots, this process will need to be disabled again).

diagnose wad toggle

(use direct connect diagnose)

The clock skew tolerance is not reflected.

For local out DNAT traffic, the best output route may not be found.

When allow-traffic-redirect is enabled (default setting), redirect traffic that ingresses and egresses from the same interface may incorrectly get dropped if the source address of the incoming packet is different from the FortiGate's interface subnet and there is no firewall policy to allow the matched traffic.

Workaround: disable allow-traffic-redirect and create a firewall policy to allow traffic to ingress and egress for the same interface.

config system global
    set allow-traffic-redirect disable
end

On the Policy & Objects > Firewall Policy page, firewall policies with FQDN show as unresolved in the table.

The DHCPv6 client does not work with vcluster2.

After a failover, ARP entries are removed from all slots when an ARP query of a single slot does not respond.

IPv6 ECMP is not supported for the FG-6000F and FG-7000E platforms. IPv6 ECMP is supported for the FG-7000F platform.

A permanent MAC address is used instead of an HA virtual MAC address during automation.

Graceful upgrade of a FortiGate 6000 or 7000 FGCP HA cluster is not supported when upgrading from FortiOS 7.0.12 to 7.2.6.

Upgrading the firmware of a FortiGate 6000 or 7000 FGCP HA cluster from 7.0.12 to 7.2.6 should be done during a maintenance window, since the firmware upgrade process will disrupt traffic for up to 30 minutes.

Before upgrading the firmware, disable uninterruptible-upgrade, then perform a normal firmware upgrade. During the upgrade process the FortiGates in the cluster will not allow traffic until all components (management board and FPCs or FIMs and FPMs) are upgraded and both FortiGates have restarted. This process can take up to 30 minutes.

SLBC for FortiOS 7.0 and 7.2 uses different FGCP HA heartbeat formats. Because of the different heartbeat formats, you cannot create an FGCP HA cluster of two FortiGate 6000s or 7000s when one chassis is running FortiOS 7.0.x and the other is running FortiOS 7.2.x. Instead, to form an FGCP HA cluster, both chassis must be running FortiOS 7.0.x or 7.2.x.

If two chassis are running different patch releases of FortiOS 7.0 or 7.2 (for example, one chassis is running 7.2.5 and the other 7.2.6), they can form a cluster. When the cluster is formed, FGCP elects one chassis to be the primary chassis. The primary chassis synchronizes its firmware to the secondary chassis. As a result, both chassis will be running the same firmware version.

You can also form a cluster if one chassis is running FortiOS 7.2.x and the other is running 7.4.x.

For best results, both chassis should be running the same firmware version, although as described above, this is not a requirement.

Unintended behavior occurs when FortiGate models perform a warm reboot without properly applying virtual domain configurations.

High CPU usage by the node process occurs when loading 7000 policies due to fetching all statistics in one request.

Under normal conditions, a FortiGate 6000 or 7000 may generate event log messages due to a known issue with a feature added to FortiOS 7.2 and 7.4. The feature is designed to create event log messages for certain DP channel traffic issues but also generates event log messages when the DP processor detects traffic anomalies that are part of normal traffic processing. This causes the event log messages to detect false positives that don't affect normal operation.

For example, DP channel 15 RX drop detected! messages can be created when a routine problem is detected with a packet that would normally cause the DP processor to drop the packet.

Similar discard message may also appear if the DP buffer is full.

On FortiGate 7000F using FGSP and FGCP, when TCP traffic takes an asymmetric path, the TCP ACK and data packets might be dropped in NP7.

On FortiGate 6000 FPCs and FortiGate 7000 FPMs the node process may consume large amounts of CPU resources, possibly affecting FPC or FPM performance. (You can run the diagnose sys top command from an FPC or FPM CLI to view CPU usage.) This problem may be caused by security rating result submission.

Workaround: use the following commands to disable automatic security rating results submission and to disable running scheduled security ratings checks:

config system global
    set security-rating-result-submission disable
    set security-rating-run-on-schedule disable
end

Once you have entered these commands, use the following command to restart the node process:

diagnose nodejs process restart

Incorrect SLBC traffic-related statistics may be displayed on the FortiGate 6000 or FortiGate 7000 GUI (for example, in a dashboard widgets). This can occur if an FPC or FPM is not correctly registered for statistic collection during startup. This is purely a GUI display issue and does not impact system operation.

To work around this display issue, enter the command diagnose nodejs process restart to reset the aggregator. You may need to wait for a few minutes after the system has started up before entering this command to make sure that all systems have fully initialized.

On the FortiGate 7000E platform, after upgrading firmware from 7.2.8 to 7.4.x, the CLI of the secondary FIM and the FPMs in the secondary chassis of an FGCP cluster may display This firmware failed signature validation. This error message is displayed because of a known issue. The firmware is valid and the FortiGate 7000E cluster will operate normally.

HA remote access does not work as expected when ha-port-dtag-mode is double-tagging.

On the FortiGate 6000 platform, IPv6 VRF routing tables appear under the new and old FPC primary units when the primary FPC slot is changed.

FGCP HA session synchronization may stop working as expected on a FortiGate 7000F cluster managed by FortiManager. This happens if the HA configuration uses management interfaces as session synchronization interfaces by configuring the session-sync-dev option, for example:

config system ha
    set session-sync-dev 1-M1 1-M2
end

The problem occurs when FortiManager updates the configuration of the FortiGate 7000F devices in the cluster it incorrectly changes to the VDOM of the management interfaces added to the session-sync-dev command from mgmt-vdom to vsys_ha and the interfaces stop working as session sync interfaces.

You can work around the problem by re-configuring the session-sync-dev option on the FortiGate 7000F cluster (this resets the VDOM of the session sync interfaces to vsys_ha) and then retrieving the FortiGate configuration from FortiManager. This synchronizes the correct configuration to FortiManager.

When viewing entries in the slide-out window of the Policy & Objects > Internet Service Database page, users cannot scroll down to the end if there are over 100000 entries.

FortiGate GUI should not display a license expired notification due to an expired FortiManager Cloud license if it still has a valid account level FortiManager Cloud license (function is not affected).

Edits that are made to IP Exemptions in IPS Signatures and Filters more than once on the Security Profiles > Intrusion Prevention page are not saved.

The category action change is not saved if the category number is the same as the existing entry ID.

When workspace configuration save mode is set to manual in the System > Settings, configuration changes made on the primary unit and then saved do not synchronize with the secondary unit when one of the cluster units are rebooted or shutdown after the change.

Workaround: set the workspace configuration mode to automatic.

FortiGate in A-P HA mode with admin-restrict-local enabled allows the local administrator to log in to the passive host, even if LDAP is available.

When Configuration save mode is set to Manual, any firewall policy change will make the cluster out-of-sync.

SCTP traffic is not forwarded back to the session owner (FGSP asymmetric traffic with IPS , NAT mode, and SCTP).

In an HA configuration, FortiGate may experience intermittent heartbeat loss causing unexpected failover to the secondary unit.

The Fabric Management page displays inconsistent information when accessed through secondary HA units on some FortiGate models.

When the HA management interface is set a LAG, it is not synchronized to newly joining secondary HA devices.

A secondary HA unit may go into conserve mode when joining an HA cluster if the FortiGate's configuration is large.

Upgrading from 7.0.14 or 7.2.8 on the HA secondary device will fail with BIOS security level 2. The image is marked un-certified and the upgrade process is aborted. The HA cluster is not affected.

After successfully changing the VLAN ID of an interface from the CLI, an error message similar to cmdb_txn_cache_data(query=log.npu-server,leve=1) failed may appear.

IPv6 traffic fails to load balance across multiple virtual domains when using Equal-cost Multipath (ECMP) in NAT mode on FortiGate devices.

The npu-session list fails to display policy-route information when traffic is routed through a policy route on FortiGate models using NPU acceleration.

Traffic drops occur after Failover in HA A-P setups using hardware-only sessions.

The "diagnose sys npu-session list" command displays incorrect policy IDs when traffic uses intra-zone policies.

NAT46 NPU sessions are lost and traffic drops when a HA failover occurs.

Connections per second (CPS) performance of SIP sessions accepted by hyperscale firewall policies with EIM and EIF disabled that include overload with port block allocation (PBA) GCN IP pools is lower than expected.

Workaround: enter the following command for each NP7 processor to resolve the performance issue.

# diagnose npu np7 setreg <npu_#> nss.nss_thrd_ctrl.thrd_ctrl 0xF

Where <npu_#> is the NP7 processor number. NP7 processors are numbered 0, 1, 2, and so on.

The configuration changes from entering these diagnose commands are reset if the FortiGate restarts. After a system restart, just re-enter the diagnose commands.

CPU usage issues occurred when IPsec VPN traffic was received on the VLAN interface of an NP7 vlink.

IPsec phase 2 negotiation fails with failed to create dialup instance, error 22 error message.

Disk logging files are cached in the kernel, causing high memory usage.

The following intrusion was observed: in the alert mail refers to another field in the anomaly log.

On the Log & Report > Forward Traffic page, the GUI experiences a performance issue and reverts the last input when multiple ports are added to a filter for destination ports.

When uploading the log file to the FTP server, some parts of the log files are not included in the upload.

CPU usage issue in WAD caused by source port exhaustion when using WAN optimization.

In an HA setup with vCluster, a CMDB API request to the primary cluster does not synchronize the configuration to the secondary cluster.

SD-WAN interfaces should be denoted in the interface statistics API.

SD-WAN Performance SLA health checks fail when FortiGuard is configured as the server due to lack of HTTP support on FortiGuard servers.

The diagnose ip rtcache list command is no longer supported in the FortiOS 4.19 kernel.

Router information in the BGP summary still shows removed BGP neighbor/peer configuration.

On the Network > SD-WAN > SD-WAN Rules page, member interfaces that are down are incorrectly shown as up. The tooltip on the interface shows the correct status.

When creating a rule on the Network > Routing Objects page, the Prefix-list is set to 0.0.0.0 0.0.0.0 when an incorrect format is entered in the Prefix field.

Security Fabric physical and logical topology is slow to load when there are a lot of downstream devices, including FortiGates, FortiSwitches, FortiAPs, and endpoint device traffic. This is a GUI only display issue and does not impact operations of downstream devices.

On the Security Fabric > Automation page, the webhook request header does not contain Content-type: application/json when using the JSON format. This causes Microsoft Teams to reject the request.

FortiGate experiences a CPU usage issue in the node process when there multiple administrator sessions running simultaneously on the GUI in a Security Fabric with multiple downstream devices. This may result in slow loading times for multiple GUI pages.

Workaround: Disconnect the other concurrent administrator sessions to avoid overloading node process.

The csfd and node daemons cause a CPU usage issue on large network topologies with many FortiAPs and/or FortiSwitches configured.

FortiClient Windows cannot be launched with SSL VPN web portal.

Intermittent behavior in samld due to an absent crucial parameter in the SP login response may lead to SSL VPN users experiencing disconnections.

Incorrect character entered when using Shift+2 on Japanese keyboard during RDP session in SSL-VPN web mode.

The FortiSwitch topology fails to load correctly and triggers Java errors in HTTPS logs when switches are connected via SFPs.

An interface in FortiLink is flapping with MCLAG with DAC on an OPSFPP-T-05-PAB transceiver.

VLAN-over-VXLAN traffic was not being offloaded to NP7, causing performance issues due to increased CPU load.

On a redundant interface, traffic may drop with some NPU-offload enabled policies when the interface is not initialized properly.

execute ping-option interface cannot specific an interface name of a.

On FortiGate 400F, 600F, 900G, 3200F, and 3700F models, LAG interface members are not shutting down when the remote end interface (one member in the LAG) is admin down.

On FortiGate, support is only provided for a single host-key ssh-ed25519 when ssh-rsa is disabled.

Status light is not showing on the FortiGate 60F or 100F after a cold and warm reboot.

On the NP7 platform, setting the interface configuration using set inbandwidth <x> or set outbandwidth <x> commands stops traffic flow.

Workaround: Change the NP7 ""default-qos-type"" setting from shaping to policing. This requires a restart of the device for the configuration to take effect.

config system npu
   set default-qos-type policing
end

In a certain edge case, traffic directed towards a VLAN interface could cause a kernel interruption.

On the FortiGate 601F, the ports (x7) have no cables attached but the link LEDs are green.

On the Network > Interfaces page, hardware and software switches show VLAN interfaces as down instead of up. The actual status of the VLAN interface can be verified using the command line.

SNMP walk of the entire MIB fails when the configuration has split-port and a large number of interfaces.

DAC cable between FortiGate and FortiSwitch stops working after upgrading from 7.2.6 to 7.2.7.

FortiGate 60F and 61F models may experience a memory usage issue during a FortiGuard update due to the ips-helper process. This can cause the FortiGate to go into conserve mode if there is not enough free memory.

Workaround: User can disable CP acceleration to reduce the memory usage.

config ips global
    set cp-accel-mode none
end

Administrator accounts using an admin profile with only FortiGuard Updates read-write permissions cannot open the FortiGuard page.

Fgfmsd does not function as expected when the type is set as fortimanager in system-central management but has no route to FortiManager.

Some FortiGate models on NP6/NP6Lite/NP6xLite platforms experience unexpected behavior due to certain traffic conditions after upgrading to 7.2.8. Traffic may be interrupted momentarily.

Workaround: Users impacted by this issue can contact Fortinet Support to request a special build with a fix for this issue. Alternatively, users can disable the processing of traffic by the IPS engine’s nTurbo using the following command:

config ips global
    set np-accel-mode none
end

On the FortiGate 1800F, the 40G interface's status is DOWN after upgrading to 7.2.8.

When configuring an SNMP trusted host that matches the management Admin trusted host subnet, the GUI may give an incorrect warning that the current SNMP trusted host does not match. This is purely a GUI display issue and does not impact the actual SNMP traffic.

Workaround: If the trusted host is enabled on all administrative access, make sure the SNMP host IP is included in at least one of these trusted IP/subnets.

The kernel 4.19 cannot concurrently reassemble IPv4 fragments for a source IP with more than 64 destination IP addresses.

The node daemon causes a CPU usage and memory usage issue when many interfaces are being edited or created at once.

When auto-upgrade is disabled, scheduled upgrades on FortiGate are not automatically canceled. To cancel any scheduled upgrades, exec federated-upgrade cancel must be done manually.

When upgrading multiple firmware versions in the GUI, the Follow upgrade path option does not respect the recommended upgrade path.

2FA push feature for FAC token and FTC won't start the push notification process until user press "Continue" in the browser.

The FortiGate does not send the user's IP address to the TACACS+ server during an authorization request.

When there are over 5000 firewall users, the minimized Firewall Users widget on the dashboard does not display the donut chart or number of users. Expanding the widget to full screen displays all users.

Client IP addresses are sent in an invalid format which some servers cannot accept.

If FGTVM was deployed in UEFI boot mode, do not downgrade to any GA version earlier than 7.2.4.

IPsec tunnels on AWS have TX errors incremented every 30 seconds.

HTTP sessions are logged as HTTPS in web filter logs when using an HTTP VIP server, causing incorrect protocol identification.

The layer 3 roaming feature may not work when the wireless controller is running multiple cw_acd processes (when the value of acd-process-count is not zero).

In HA cluster of FGT-200F units with 'capwap-offload' enabled, traffic from tunnel SSID cannot pass after HA failover is triggered.

The automatically connect option fails to function when the local radio connection is lost on some FortiGate models.

Physical and logical topology is slow to load when there are a lot of managed FortiAP devices (over 50). This issue does not impact FortiAP management and operation.

Excessive MEM POOLuse_up_cnt observed on secondary unit in an HA environment.

Managed FortiSwitch detects multiple MACs using the same IP address.

Intermittent traffic disruption observed in cw_acd caused by a rare error condition.

FortiAP units repeated joining and leaving FortiGate HA cluster when the secondary FortiGate has stored FortiAP images.

WiFi clients are disconnected from SSIDs due to an error condition in the daemon hostapd process.