Policy lookup should not get result with policy_action: deny for non-TCP protocols and non-80/443 TCP ports.

The best output route may not be found for local out DNAT traffic.

GUI does not display the configured parameters for traffic shaping policies when editing a policy with an SD-WAN zone.

Existing ARP entries are removed from all slots when an ARP query of a single slot does not respond.

IPv6 ECMP is not supported for the FortiGate 6000F and 7000E platforms. IPv6 ECMP is supported for the FortiGate 7000F platform.

UTM traffic is blocked by an FGSP configuration with asymmetric routing.

FortiGate 6000 and 7000 platforms do not support managing FortiSwitch devices over FortiLink.

Virtual clustering is not supported by FortiGate 6000 and 7000 platforms.

SNMP walk failed to get the BGP routing information.

Authenticated users are not synchronized to the secondary FortiGate 6000 or 7000 chassis when the secondary chassis joins a primary chassis to form an FGCP cluster.

The FortiGate 6000 and 7000 platforms do not support IPsec VPN over a loopback interface or an NPU inter-VDOM link interface.

On the FortiGate 7000F platform, fragmented IPv6 ICMP traffic is not load balanced correctly when the dp-icmp-distribution-method option under config load-balance is set to dst-ip. This problem may also occur for other dp-icmp-distribution-method configurations.

The FortiGate 6000s or 7000s in an FGSP cluster may load balance FTP data sessions to different FPCs or FPMs. This can cause delays while the affected FortiGate 6000 or 7000 re-installs the sessions on the correct FPC or FPM.

FortiGate 7000E IPv6 routes may not be synchronized correctly among FIMs and FPMs.

FortiGate-7000F chassis with FIM-7941Fs cannot load balance fragmented IPv6 TCP and UDP traffic. Instead, fragmented IPv6 TCP and UDP traffic received by the FIM-7941F interfaces is sent directly to the primary FPM, bypassing the NP7 load balancers. IPv6 ICMP fragmented traffic load balancing works as expected. Load balancing fragmented IPv6 TCP and UDP traffic works as expected in FortiGate-7000F chassis with FIM-7921Fs.

Graceful upgrade from 7.0.12 to 7.2.6 or 7.2.7, or from 7.0.12 to 7.4.2 or 7.4.3 will fail on the FortiGate 6501F/6500F, FortiGate 7060E with slot6 occupied, and FortiGate 7121F with slot12 occupied.

Workaround: Disable uninterruptible-upgrade before performing the firmware upgrade:

config system ha
    set uninterruptible-upgrade disable 
end

Note that traffic will be interrupted for 15 to 45 minutes, depending on the size of the configurations.

Read-only administrator may encounter a Maximum number of monitored interfaces reached error when viewing an interface bandwidth widget for an interface that does not have the monitor bandwidth feature enabled.

Workaround: super_admin users can enable the monitor bandwidth feature on the interface first, then the widget can work for read-only administrators.

When the FortiGate is in conserve mode, node process (GUI management) may not release memory properly causing entry-level devices to stay in conserve mode.

When administrator GUI access (HTTPS) is enabled on SD-WAN member interfaces, the GUI may not be accessible on the SD-WAN interface due to incorrect routing of the response packet.

Workaround: access the GUI using another internal interface that is not part of an SD-WAN link.

NPD/LPMD cannot differentiate the different VRFs, and considers all VRFs as 0.

The parse error, NPD-0:NPD PARSE ADDR GRP gmail.com MEMBER ERR, appears after rebooting the system.

Connections per second (CPS) performance of SIP sessions accepted by hyperscale firewall policies with EIM and EIF disabled that include overload with port block allocation (PBA) GCN IP pools is lower than expected.

Workaround: enter the following command for each NP7 processor to resolve the performance issue.

# diagnose npu np7 setreg <npu_#> nss.nss_thrd_ctrl.thrd_ctrl 0xF

Where <npu_#> is the NP7 processor number. NP7 processors are numbered 0, 1, 2, and so on.

The configuration changes from entering these diagnose commands are reset if the FortiGate restarts. After a system restart, just re-enter the diagnose commands.

FortiAnalyzer report is not available to view for the secondary unit in the HA cluster on the Log & Report > Reports page.

Workaround: view the report directly in FortiAnalyzer.

An error case occurs in WAD while redirecting the web filter HTTPS sessions.

A rare error condition occurred in WAD caused by compounded SMB2 requests.

The diagnose ip rtcache list command is no longer supported in the FortiOS 4.19 kernel.

FortiGate as SSL VPN client does not work on NP6 and NP6XLite devices.

When configuring an 802.3ad aggregate interface with a 1 Gbps speed, the port's LED is off and traffic cannot pass through. Affected platforms: 110xE, 220xE, 330xE, 340xE, and 360xE.

NP7 did not offload jumbo packet, but get NPU INFO: offload=9/9 in the console output.

FGR-70F and FGR-70F-3G4G failed to perform regular reboot process (using execute reboot command) with an SD card inserted.

GUI is inaccessible when using a SHA1 certificate as admin-server-cert.

When the URL filter requests the FortiGuard (FGD) rating server address using DNS, it will try to get both A (IPv4) and AAAA (IPv6) records.

High CPU usage might be observed on entry-level FortiGates if the cache size reaches 10% of the system memory.

DHCP server on LAN interface is lost after rebooting or restoring the configuration file.

Unexpected behavior occurred in the kernel when creating EMAC VLAN interfaces based on an aggregate interface with the new kernel 4.1.9.

After deauthorizing a downstream FortiGate from the System > Firmware & Registration page, the page may appear to be stuck to loading.

Workaround: perform a full page refresh to allow the page to load again.

When a search is performed on a user (User & Authentication > User Definition page), the search results highlight all the groups the user belongs to.

NTLM authentication does not work with Chrome.

When there are extra large number of managed FortiAP devices (over 500) and large number of WiFi clients (over 5000), the Managed FortiAPs page and FortiAP Status widget can take a long time to load. This issue does not impact FortiAP operation.

CAPWAP tunnel traffic over tunnel SSID is dropped when offloading is enabled.

Physical and logical topology is slow to load when there are a lot of managed FortiAP (over 50). This issue does not impact FortiAP management and operation.

On the WiFi & Switch Controller > Managed FortiAPs page of a non-management VDOM, the Register button is unavailable in the Device Registration pane.