The GUI-explicit-proxy setting on the System > Feature Visibility page is not retained after a FortiGate reboot or upgrade.

On the FortiGate 120G and 121G, HA did not synchronize and the GUI HA page stuck loading when ha or mgmt interfaces used as the heartbeat interface.

Workaround: do not use ha or mgmt interfaces as the heartbeat interface.

Special branch supported models of FortiGate in an HA cluster with an empty HA password, upgrading from a special build GA version (version 7.0.x) to version 7.2.9 and version 7.2.10 GA can cause one of the members to not upgrade.

Impacted models: Please see a full list of Special branch supported models for FortiOS version 7.0.15.

Workaround: configure a valid HA password for the cluster before the upgrade, or manually upgrade the member that was impacted.

config system ha
    set password <new-password>
end

The internet-service6-custom and internet-service6-custom-group options do not work with custom IPv6 addresses.

When allow-traffic-redirect is enabled, redirect traffic that ingresses and egresses from the same interface may incorrectly get dropped if the source address of the incoming packet is different from the FortiGate's interface subnet and there is no firewall policy to allow the matched traffic.

Workaround: disable allow-traffic-redirect and create a firewall policy to allow traffic to ingress and egress for the same interface.

config system global
    set allow-traffic-redirect disable
end

After a failover, ARP entries are removed from all slots when an ARP query of single slot does not respond.

Graceful upgrade of a FortiGate 6000 or 7000 FGCP HA cluster is not supported when upgrading from FortiOS 7.0.12 to 7.2.6.

Upgrading the firmware of a FortiGate 6000 or 7000 FGCP HA cluster from 7.0.12 to 7.2.6 should be done during a maintenance window, since the firmware upgrade process will disrupt traffic for up to 30 minutes.

Before upgrading the firmware, disable uninterruptible-upgrade, then perform a normal firmware upgrade. During the upgrade process the FortiGates in the cluster will not allow traffic until all components (management board and FPCs or FIMs and FPMs) are upgraded and both FortiGates have restarted. This process can take up to 30 minutes.

SLBC for FortiOS 7.0 and 7.2 uses different FGCP HA heartbeat formats. Because of the different heartbeat formats, you cannot create an FGCP HA cluster of two FortiGate 6000s or 7000s when one chassis is running FortiOS 7.0.x and the other is running FortiOS 7.2.x. Instead, to form an FGCP HA cluster, both chassis must be running FortiOS 7.0.x or 7.2.x.

If two chassis are running different patch releases of FortiOS 7.0 or 7.2 (for example, one chassis is running 7.2.5 and the other 7.2.6), they can form a cluster. When the cluster is formed, FGCP elects one chassis to be the primary chassis. The primary chassis synchronizes its firmware to the secondary chassis. As a result, both chassis will be running the same firmware version.

You can also form a cluster if one chassis is running FortiOS 7.2.x and the other is running 7.4.x.

For best results, both chassis should be running the same firmware version, although as described above, this is not a requirement.

Image synchronization failure happened after a factory reset on FortiGate 7000E/F .

On FortiGate 6000 models, a CPU usage issue occurs in the node process when navigating a policy list with a large number (+7000) of policies in a VDOM.

On FortiGate 7000F using FGSP and FGCP, when TCP traffic takes an asymmetric path, the TCP ACK and data packets might be dropped in NP7.

On FortiGate, IPv6 VRF routing tables appear under the new and old FPC primary units when the primary FPC slot is changed.

On the View/Edit Entries slide-out pane (Policy & Objects > Internet Service Database dialog), users cannot scroll down to the end if there are over 100000 entries.

FortiGate GUI should not display a license expired notification due to an expired FortiManager Cloud license if it still has a valid account level FortiManager Cloud license (function is not affected).

When the number of users in the Firewall User monitor exceeds 2000, the search bar, column filters, and graphs are no longer displayed due to results being lazily loaded.

The Node.JS daemon restarts with a kill ESRCH error on FortiGate after an upgrade.

On the Fabric Management page, the HA Secondary lists both primary and secondary FortiGate units.

When the HA management interface is set a LAG, it is not synchronized to newly joining secondary HA devices.

After successfully changing the VLAN ID of an interface from the CLI, an error message similar to cmdb_txn_cache_data(query=log.npu-server,leve=1) failed may appear.

NPD/LPMD cannot differentiate the different VRF's, considers as VRF 0 for all.

ECMP does not load balance IPv6 traffic between two routes in a multi-VDOM setup.

Output of diagnose sys npu-session list/list-full does not mention policy route information.

Packets drop, and different behavior occurs between devices in an HA pair with ECMP next hop.

The diagnose sys npu-session list command shows an incorrect policy ID when traffic is using an intra-zone policy.

SD-WAN members can be out-of-sla after some retrieve times.

The diagnose ip rtcache list command is no longer supported in the FortiOS 4.19 kernel.

FortiGate experiences a CPU usage issue in the node process when there multiple administrator sessions running simultaneously on the GUI in a Security Fabric with multiple downstream devices. This may result in slow loading times for multiple GUI pages.

Workaround: Disconnect the other concurrent administrator sessions to avoid overloading node process.

FortiClient Windows cannot be launched with SSL VPN web portal.

The FortiSwitch topology is not loading correctly on the GUI.

Traffic going through a VLAN over VXLAN is not offloaded to NP7.

On a redundant interface, traffic may drop with some NPU-offload enabled policies when the interface is not initialized properly.

On FortiGate 400F, 600F, 900G, 3200F, and 3700F models, LAG interface members are not shutting down when the remote end interface (one member in the LAG) is admin down.

On the NP7 platform, setting the interface configuration using set inbandwidth <x> or set outbandwidth <x> commands stops traffic flow.

Workaround: unset the inbandwidth and outbandwidth in the CLI:

config system interface
    edit <port>
        unset inbandwidth
        unset outbandwidth
    next
end

On the FortiGate 601F, the ports (x7) have no cables attached but the link LEDs are green.

FortiGate 60F and 61F models may experience a memory usage issue during a FortiGuard update due to the ips-helper process. This can cause the FortiGate to go into conserve mode if there is not enough free memory.

Workaround: User can disable CP acceleration to reduce the memory usage.

config ips global
    set cp-accel-mode none
end

When a remote LDAP user with Two-factor Authentication enabled and Authentication type 'FortiToken' tries to access the internet through firewall authentication, the web page does not receive the FortiToken notification or proceed to authenticate the user.

Workaround: click the Continue button on the authentication page after approving the FortiToken on the mobile device.

If FGTVM was deployed in UEFI boot mode, do not downgrade to any GA version earlier than 7.2.4.

The OCI SDN connector cannot call the API to the Oracle service when an IAM role is enabled.

The layer 3 roaming feature may not work when the wireless controller is running multiple cw_acd processes (when the value of acd-process-count is not zero).

CAPWAP tunnel traffic over tunnel SSID is dropped when offloading is enabled.

The Automatically connect to nearest saved network option does not work as expected when FWF-60E client-mode local radio loses connection.

Physical and logical topology is slow to load when there are a lot of managed FortiAP devices (over 50). This issue does not impact FortiAP management and operation.

Managed FortiSwitch detects multiple MACs using the same IP address.

FortiAP units repeated joining and leaving FortiGate HA cluster when the secondary FortiGate has stored FortiAP images.