Return Email DNS Check in the email filter profile is case sensitive.

On the Security Profiles > AntiVirus page, a VDOM administrator with a custom administrator profile cannot create or modify an antivirus profile belonging to the VDOM.

When UTM status is enabled and the AV profile has no configuration, all SLL traffic is dropped and there is no WAD output.

The firewall policy dialog should show the no-inspection profile and the warning should be consistent with the policy list.

The FortiGate does not parse the entries of the sensor from DLP signature package properly, and therefore cannot block files matching a sensor as expected.

DNS proxy caches DNS responses with only one CNAME record.

FortiOS should pull new avatar API from EMS and handle the avatar status on the FortiGate.

When there are many users authenticated by an explicit proxy policy, the Firewall Users widget can take a long time to load. This issue does not impact explicit proxy functionality.

Sessions between the explicit proxy and server stay in SYN_SENT state when using IP pools in the explicit proxy policy for source NAT, even though the sessions have established. Traffic is not impacted.

Explicit web proxy fails to forward HTTPS request to a Squid forward server when certificate inspection is applied.

Wrong source IP address used for packets through explicit proxy routed to a member of SD-WAN interface.

The GUI-explicit-proxy setting on the System > Feature Visibility page is not retained after a FortiGate reboot or upgrade.

The Enabled On should display the listening interfaces rather than None in explicit proxy policy on the GUI.

Forward matching is applied to check the group name for SAML Authentication with Proxy Policy.

ACL feature is incorrectly dropping fragmented UDP packets.

If the first firewall service object in the service list (based on the order in the command line table) has a protocol type of IP, the GUI may incorrectly modify its protocol number whenever a new firewall service of the same protocol type IP is created in the GUI.

This silent misconfiguration can result in unexpected behavior of firewall policies that use the impacted service. For example, some 6K and 7K platforms have firewall service ALL (protocol type IP) as the first service, and this can cause the ALL service to be modified unexpectedly.

A VIP group having members of the FQDN and static NAT VIP types cannot be created using the GUI (Policy & Objects > Virtual IPs page).

Traffic drops between two back-to-back EMAC VLAN interfaces.

Unable to add more MAC addresses once the MAC address group object for a VWP policy referenced.

Access to some websites fails after upgrading to FortiOS 7.2.3 when the firewall policy is in flow-based inspection mode.

NAT64 does not recover when the interface changes.

The diffserv-copy option in the config firewall policy command cannot be configured.

Wrong TOS field value in NetFlow report when there is no traffic.

On the Policy & Objects > Firewall Policy page, if any of the interface names contain a space, the page does not load when Interface Pair View is selected.

Optimize CPU usage caused by a rare error condition which leads to no data being sent to the collector.

On a FortiGate managed by FortiManager, after upgrading to 7.4.0, the Firewall Policy list may show separate sequence grouping for each policy because the global-label is updated to be unique for each policy.

UDP fragments dropped due to DF being set. Only the set honor-df global option.

When editing a VLAN ID, the FortiGate deletes firewall policies but does not recreate them again if the interface is in a zone.

On the Policy & Objects > Firewall Policy page, when the interface name used in a virtual wire pair is a substring of interfaces used in a firewall policy, such policies are not displayed. For example, if a virtual wire pair consists of interfaces port1 and port2, firewall policies with port10, port11, port21, port22 are not displayed.

New sessions are created and evaluated after a certain number of UDP packets, even if set block-session-timer 300 is set.

set fixedport enable in a firewall policy does not preserve the source port for SNAT with IP pool.

The Edit Address page does not load if the address name contains has special characters ([ ]).

After system synchronization, primary blades' reboot command did not take effect on the secondaries.

The FortiGate 6000 or 7000 front panel does not appear on the Network > Interfaces and System > HA GUI pages.

In some cases, the FortiGate 7000F platform cannot correctly reassemble fragmented packets.

The FortiGate 7000E and 7000F platforms do not support GTP and PFCP load balancing.

The FortiGate 6000 and 7000 System Information dashboard widget incorrectly displays the management board or primary FIM serial number instead of the chassis serial number. Use get system status to view the chassis serial number.

The FortiGate 6000 and 7000 platforms do not support EMAC VLANs.

Adding a FortiAnalyzer to a FortiGate 6000 or 7000 Security Fabric configuration from the FortiOS GUI is not supported.

Unable to select a management interface LAG to be the direct SLBC logging interface.

On a FortiGate 6000 or 7000, the active worker count returned by the output of diagnose sys ha dump-by group can be incorrect after an FPC or FPM goes down.

Unable to select a management interface LAG to be the FGSP session synchronization interface.

FortiGate 6000 GUI becomes unresponsive, and may work sometimes after a reboot.

On a FortiGate 7000F, after a new FPM becomes the primary FPM, IPsec VPN dynamic routes are not synchronized to the new primary FPM.

Sessions for IPsec dialup tunnels that are configured to be handled by a specific FPC or FPM may be incorrectly sent to a different FPC or FPM, resulting in traffic being blocked.

FGCP session synchronization may not synchronize all sessions on FortiGate 6000 and 7000 models.

Multiple IP pools in SSL VPN is not supported.

An uncertified warning appears only on the secondary chassis' FIM02 and FPMs.

After an SNMP HA failover, the SNMP trap continues to work.

Real-time FortiView Traffic Shaping monitor shows 0 bandwidth for active FTP traffic.

On FortiView Websites, the real time view is always empty if disk logging is disabled.

System > FortiGuard page's License Information table does not show the updated IPS engine version.

The FortiGate may display a false alarm message TypeError [ERR_INVALID_URL]: Invalid URL in the crashlog for the node process. This error does not affect the operation of the GUI.

The CPU and Sessions widgets report the current numbers at the wrong places for most time periods.

In an environment where the Security Fabric is enabled and there are more than 100 firewall object conflicts between the root and downstream FortiGates, the Firewall Object Synchronization pane does not list the details.

Incorrect interface is being selected in the SD-WAN Rules GUI page, but the correct one is displayed in the CLI.

The FortiGate GUI displays only the most recent 100 entries on CRL view.

On rare occasions, the GUI may display blank pages when the user navigates from one menu to another if there is a managed FortiSwitch present.

Browser returns a blank page after logging in to the GUI with an IPv6 address.

In the System > Administrators dialog, when there are a lot of VDOMs (over 200), the dialog can take more than one minute to load the Two-factor Authentication toggle. This issue does not affect configuring other settings in the dialog.

When using configuration save mode with VDOMs, the GUI still shows unsaved changes after another administrator commits their changes with SSH.

When logged in to the GUI of a non-management VDOM and trying to complete the Migrate Config with FortiConverter step in the startup menu, the page does not update and the loading spinner is stuck.

Random FortiSwitch is shown as offline on the GUI when it is actually online.

GUI should allow user to skip the Migration Config with FortiConverter step without having to wait for a server connection.

Improve the policy list performance.

HA secondary synchronization fails and keeps rebooting when the primary has a split port configuration.

Platforms in an HA environment get stuck in a reboot loop while attempting to synchronize configurations that differ in split ports.

FortiGate in A-P HA mode with admin-restrict-local enabled allows the local administrator to log in to the passive host, even if LDAP is available.

Cannot access out-of-band IPv6 address on HA secondary unit.

When entering the psksecret under config system standalone-cluster, no verifications are done against the password policy IPsec preshared key.

FortiGate sent ARP request with loopback IP address as the source address.

Secondary blade hostname and mgmt1 IP were changed after a restored configuration on the primary blade.

When upgrading a cluster of four FortiGate 2200E devices, each secondary forms a cluster with the primary only and causes an outage.

FortiGate VM Azure HA cluster goes out-of-sync due to dynamic firewall address type.

FGCP primary-secondary cluster only uses one session-sync-dev, in spite of having multiple session-sync-dev.

When adding a new interface, some other interfaces have the wrong virtual MAC address.

The execute ha failover set <vcluster number> command only support two vclusters, even when mutiple vclusters exist.

When an HA management interface is configured, the GUI may not show the last interface entry in config system interface on several pages, such as the interface list, policy list, address list, and DNS servers page. This is a GUI-only display issue and does not impact the underlying operation of the affected interface.

Heartbeat packet loss issue at random times.

The System > HA page is missing from the GUI on 5K models.

Interfaces for the root VDOM are displayed in the GUI when different VDOM is selected on the HA secondary.

When Configuration save mode is set to Manual, any firewall policy change will make the cluster out-of-sync.

HA events not synchronizing between members, leading to unexpected HA status.

Do not automatically enable LLDP transmission on an HA management port with LLDP reception enabled.

Timeouts occur when accessing the Migros Bank e-banking application and https://www.gs***.ch/ when the session is offloaded.

The IPv6 neighbor cache configuration is missing after executing a reboot or flush command.

With an enabled hyperscale license, in some cases with exception traffic (like ICMP error traverse), the FortiGate may experience unexpected disruptions when handling the exception traffic.

First-time HA failover after upgrading causes long service interruption to NAT44.

Problem with synchronizing a high amount of routes to NP7 for hyperscale firewall.

Device is rebooting randomly when driver processes exception packets.

Hyperscale firewall creates a separate session and uses a different source port for IP fragment packets.

The number of IPS sessions is higher than kernel sessions, which causes the FortiGate to enter conserve mode.

Failover on clustered web application using keepalived daemon does not work seamlessly.

Unexpected behavior in IPS engine when executing diagnose test application ipsmonitor 44.

[?Q?ci_" sekret=] causes the parser to create a new field, "sekret=".

IPS engines do not release memory after stopping traffic more than one hour.

HTTPS traffic slows when IPS with NTurbo is used over a virtual wire pair.

IPS daemon usage issue when notifying device vulnerability information to WAD.

Constant reloading of the external domain table is causing high CPU due to lock contention when reloading the table.

In an FGSP setup running emix traffic, nTurbo values run in the negative.

IPS logs show incorrect source and destination IP addresses and policy IDs, and the ports are zeros.

L2TP VPN not working when offloading is enabled.

IKE debug log filtering functionality exhibits inaccuracies, resulting in the possibility of displaying unmatched logs when filters are set.

The vpn-id-ipip encapsulated IPsec tunnel with npu-offload cannot be reached with IPv6.

Proxy ARP stops working for a client connected to a dialup IPsec when the previous VPN was established and is deleted.

VM running FIPS cipher mode does not show AES-CBC ciphers when configuring IPsec in the GUI.

Forwarded broadcast traffic on ADVPN shortcut tunnel interface dropped.

Support IKEv2 split DNS mode-cfg (RFC 8598).

IPsec performance drops after upgrade on AWS.

diagnose traffictest issues with dynamic IP addresses and loopback interfaces.

IPsec tunnels that have external DHCP services for IP assignment have an extra selector added after upgrading.

In FGSP, IKE routes are not removed from the kernel when secondary-add-ipsec-routes is disabled.

Some static tunnels in multiple VDOM HA setups do not come up after a firmware upgrade or restoring the configuration.

The forward traffic log show exabytes of data being sent and received from external to external IP addresses in multiple VDOMs.

Destination interface in traffic log does not match the SD-WAN quality description in the log details.

When viewing logs on the Log & Report > System Events page, filtering by domain\username does not display matching entries.

When a session starts on one interface and refreshes after a policy or routing change to use a new interface, information displayed in the logs is not updated properly.

IPS alert email not being sent when IPS attack event has triggered.

Free-style filter not working as defined under config fortianalyzer override-filter.

Traffic log can show exabytes of data sent and received when generating log task is triggered from userspace.

After disabling an event under the event filter, the system events summary page still shows event logs for that event.

Secondary FortiGate log cannot be viewed from primary FortiGate in HA.

Support HTTP3 for web proxy and ZTNA web service.

An error condition occurs in WAD caused by multiple outstanding requests sent from client to server with UTM enabled.

CPU usage issue in proxyd caused by the absence of TCP teardown.

Proxy mode inspection is slow when testing a single TCP stream from fast.com, which causes bandwidth slowness on FG-100F and FG-200F devices.

Memory usage issue caused by the WAD user info process while authenticating the LDAP users.

Proxy-based deep inspection connection issue occurs.

Unable to upload file to the application server in server-load-balance setup.

Website (li***.cz) is not working in proxy inspection mode with deep inspection and web filter applied.

WAD traffic to globalvideoquery.fortinet.net does not follow the FortiGuard interface-select-mode.

Memory usage issue caused by the WAD while using the access proxy.

The MTU value on an interface cannot be set using the interface REST API.

link-down-failover does not bring the BGP peering down.

When ip-fragmentation is set to pre-encapsulation, the VPNv4's VRF information cannot pass fragment traffic.

The Network > SD-WAN > SD-WAN Rules page does not show a red exclamation mark for addresses that have dst-negate enabled. This is cosmetic; users can use the CLI to confirm that the address has dst-negate enabled.

FortiGate does not use the correct BGP route with the longest match and continues using the old route.

On the Network > SD-WAN page, the Performance SLAs tab is slow to load when there is a large number (~4000) of VPN tunnels, and shortcut tunnels created by ADVPN.

The change of an IPv6 route does not mark sessions as dirty nor trigger a route change.

SD-WAN performance SLA statistics on secondary unit's GUI section are not synchronized with the primary and has stale data.

SD-WAN members can be out-of-sla after some retrieve times.

With ICMP asymmetric routing enabled, ICMP local-in/local-out reply packets will still only return through the original path, in order to maintain the ping SLA.

Issue with SD-WAN rule for FortiGuard.

Speed test result is not accurate.

High CPU due to PIMD/NSM and multicast session not being offloaded.

DHCP relay fails after a period of time with SD-WAN.

config redistribute routing subsections cannot be configured when in workspace mode.

BGP neighbor group configured with password is not working as expected.

Search broken on SD-WAN Rules tab's Source/Destination omniselect.

FortiOS is limited to 31 interfaces for Multicast Routing using PIM-SM.

Router information in the BGP summary still shows removed BGP neighbor/peer configuration.

FortiGate removing SD-WAN routes when network address is specified as the gateway of an SD-WAN member.

SD-WAN rules list in the GUI should show the interface members in priority order instead of alphabetical order.

FortiGate 40F-3G4G not adding LTE dynamic route to route table.

Static routes are installed on hub FortiGate with add-route disabled in ADVPN scenario.

When there are a lot of policies (several thousands), the interface member selection for the SD-WAN Zone dialog may take up to a minute to load.

IPv6 traffic was no longer forwarded according to route list and neighbor-cache list after upgrading from 7.2.4 to 7.2.5.

On a FortiGate that has large tables (over 1000 firewall policies, address, or other tables), security rating reports may cause the FortiGate to go into conserve mode.

In a configuration with a connected FortiAP-U, the FortiAP & FortiAP-S & FortiAP-W2 & FortiAP-U Command Injection in CLI security rating test fails and suggests an upgrade to 7.0.4, even though the FortiAP is on the latest version (7.0.0).

After adding a 20 MB blocklist file, a FortiGate with 2 GB RAM goes to conserve mode when viewing the Security Fabric > External Connectors page.

External Connectors can cause a FortiGate internal error when the configuration name has invalid characters.

Automation stitch with FortiDeceptor Fabric connector event trigger cannot be triggered.

Advanced GCP connector does not resolve if one element does not exists.

Allow comments and IP addresses to be on the same line for external IP address threat feeds.

Send Fabric API calls with pagination filter.

Unexpected behavior in Security Fabric daemon (CSFD) caused by triggering HA failover while using Security Fabric.

Threat feeds with name starting with "g-" are not allowed on non-VDOM FortiGate.

Azure SDN connector always uses HA management port for DNS resolve. This might not work on premises where the HA management port does not have a public IP address assigned.

Unable to authorize downstream FortiGate with the Security Fabric after upgrade.

The No SSL-VPN policies exist warning is displayed when an SSL VPN zone having an SSL VPN tunnel interface is used in a policy. The warning can be ignored; it does not affect the SSL VPN functionality.

Internal resource pages and menus are not showing correctly in web mode.

SSL VPN stops listening on IPv6 interface after a reboot.

SSL VPN fails to connect to graph.microsoft.com when doing Azure auto-login.

Webpage keeps loading when customer accesses an internal webpage in the SSL VPN web portal.

Customer bookmark (*.tr***.pt) is not accessible when using SSL VPN web mode.

Jira application is not loading properly when connecting through SSL VPN web mode.

PC cannot get IP from DHCP server due to find duplicate ip and causes the dialup SSL VPN to fail.

In SSL VPN web mode, the page keeps loading after logging in.

Issues with accessing an internal site using SSL VPN web mode and bookmark.

Decrease in download speeds observed for SSL VPN users when over 2000 users are connected.

Destination address of SSL VPN firewall policy may be lost after upgrading when dstaddr is set to all and at least one authentication rule has a portal with split tunneling enabled.

Disconnecting from SSL VPN using the SSL-VPN widget does not disconnect the SSL VPN tunnel.

FortiGate does not identify users on SSL VPN as 2FA users if the user and token are put together in the same field (concatenated).

Web mode bookmark showing blank page due to JS rewrite.

Some buttons in URL are not working in SSL VPN web mode.

When a user needs to enter credentials through a pop-up window, the key events for modification key detected by SDL were ignored.

FortiGate will intermittently stop accepting new SSL VPN connections across all VDOMs.

The HPE iLO 5 web server is not able to load properly from the SSL VPN portal.

FortiOS check would block iOS and Android mobile devices from connecting to the SSL VPN tunnel.

SSL VPN web portal not loading internal web page.

SSL VPN web portal HTTP bookmark forwarded site throws Java error.

When using RDP bookmarks in SSL web mode, some keys stopped working,

Internal website keeps asking for credential with SSL VPN web mode.

The external DHCP server is not receiving hostnames in SSL VPN and DHCP relay.

The SSL VPN schedule is incorrect by 1 hour when a daylight savings timezone is enabled.

DHCP option 12 hostname needed for SSL VPN with external DHCP servers.

Update SSL VPN host check logic for unsupported OS.

SSL VPN service over PPPoE interface does not work as expected if the PPPoE interface is configured with config system pppoe-interface.

config system pppoe-interface
    edit <name>
        set device <string> 
        set username <string>
        set password <password>
    next
end

config vpn ssl settings
    set source-interface <PPPoE_interface_name>
end

This issue is also observed on VNE tunnel configurations.

SSL VPN tunnel down log message not generated when an IP address is disassociated before the old tunnel times out.

An invalid user name entered in FortiClient could cause two factor PKI user login to crash sslvpnd after the client certificate checking passed.

Upon upgrade, the link to FortiSwitch stays down with QSFP.

On the WiFi & Switch Controller > FortiSwitch Ports page, the Device Information column lists the same device multiple times.

One discovery one transmit buffer was allocated and was not released on connection terminations.

WiFi & Switch Controller > FortiSwitch Ports page does not show VLANs exported to another tenant VDOM, which results in the VLAN being removed if saved from the GUI.

When a FortiSwitch port is reconfigured, the FortiGate may incorrectly retain old detected device data from the port that results in an unexpected number of detected device MACs for the port. Using diagnose switch-controller mac-cache show to check the device data can result in the Device Information column being blank on the WiFi & Switch Controller > FortiSwitch Ports page or in the Assets widget.

Security rating shows an incorrect warning for unregistered FortiSwitches on the WiFi & Switch Controller > Managed FortiSwitches.

FortiGate loses QoS ip-dscp-map configuration after reboot.

GUI shows conflicts error message when configuring a secondary IP address after allow-subnet-overlap is enabled.

CPU usage issue is observed caused by reloading the system when the system has cfg-save set to revert.

Not all ports are coming up after an LAG bounce on 8 × 10 GB LAG with ASR9K. Affected platforms: FG-3960E and FG-3980E.

Traffic passing through an EMAC VLAN interface when the parent interface is in another VDOM is blocked if NP7 offloading is enabled.

High memory usage caused by downloading a large CRL list.

Download speed issue through WAN configured with PPPoE on FortiGate.

CPU usage issue caused by clearing BGP dampened prefixes.

User loses GUI/SSH access on FG-1500D while running one-arm sniffer.

When backing up the configuration to a USB disk, if the file name is the same as specified under System > Settings > Start Up Settings > USB auto-install, an Invalid file name error is displayed.

FortiGate cannot build a 3-way handshake in TP mode using an IPv6 route.

FortiGate as DHCP relay is not showing a DHCP decline in the debugs when there is an IP conflict in the network.

FG-100F fails to boot when FortiOS image binary is larger than 94 MB.

FortiGate 200F interfaces stop passing traffic after some time.

DAC cable support is unstable on the FortiGate 1101E.

Hardware csum failure message keeps repeating on Azure 7.0.8.

False alarm of the PSU2 occurs with only one installed.

FortiGate devices configured behind a proxy may not connect to the FortiToken Mobile server, leading to errors when provisioning tokens.

CPU usage issue caused by the new Linux kernel.

The FEC configuration under the interface is not respected when port23 and port24 are members of an LACP and the connection is 100G. Affected platforms: FGT-340xE, FGT-360xE.

When an IPsec tunnel is configured with a different VRF than the underlying physical interface, and traffic is offloaded, the session expires even when traffic is flowing through it.

If the FortiGate is added to FortiManager using the IPv6 address and tunnel is down for some reason, the FortiGate will not reconnect to FortiManager since fmg under system central-management is not set properly.

If the firewall session is in check-new mode, FortiOS will not flush its NPU offload entry when there is a MAC address update of its gateway.

Host TX dropped counter incrementing and connections failing when throughput reaches 40 Gbps.

When a user is logged in as a VDOM administrator with restricted access and tries to upload a certificate (System > Certificates), the Create button on the Create Certificate pane is grayed out.

Add 100G speed option on the FortiGate 1800F.

Sensor showing temperature of 0.00 Celsius.

Traffic dropped as the matching SessionID is being deleted from session table in 20 seconds.

Status light is not showing on the FortiGate 60F or 100F after a cold and warm reboot.

Interface could not be brought up if it was part of a virtual switch.

Incorrect temperature calculation appears in sensor list on FG-8xF, FWF-8xF, FG-9xE, FG-10xE, FG-20xE, and FG-14xE.

FortiGate 1801F in transparent mode cannot reply to an SNMP query.

IPv6 addresses configured on EMAC VLAN interfaces showing FTP flag after upgrade.

QSFP/QSFP+ port23/port24 are down after upgrading to 7.0.11 on FG-3401E.

execute sensor list has blank lines in output.

On FortiGate, kernel 4.19 does not adjust packets when it receives fragments needed while in proxy mode and pmtu-discovery disabled.

SNMP OID, fgFwPolLastUsed (1.3.6.1.4.1.12356.101.5.1.2.1.1.4), does not show the correct information about the last time a specific policy was used.

Port speed 1000auto could not link up with a Cisco switch.

The crashlog might show a Node.JS restarted error, Failed to fetch web-ui.node-exports: Error: connect ECONNREFUSED, if the HTTPSD is being killed during conserve mode, stuck in some API calls, or slow response during system super busy.

The FortiGate may display a false alarm message and subsequently initiate a reboot.

dnsproxy process aborts due to stack buffer overflow being detected upon function return.

SSH users cannot access FortiGate in FIPS mode due to missing algorithms.

An error condition occurs caused by receiving ICMP redirect messages.

Unexpected behavior caused by the Linux Out of Memory (OOM) killer when memory is very low.

Last reboot reason: power cycle after rebooting due to a kernel panic is misleading.

When a non-zero DSCP copied from ingress to egress packet for NAT64, the IP checksum is calculated incorrectly.

Transparent mode FortiGate does not reply to SYN ACK when communicating with FortiManager.

High system CPU and multiple daemons enter D state on the FortiGate 4401F.

Enable auto-upgrade by default on the FortiGate 40F and 40G.

Without any traffic, memory usage of FG-1800F keeps increasing slowly over time.

DNS does not respond to short name queries.

Delay sending LACPDU in kernel 4.19.

On FortiGate, fragmented packets with specific flow types are not forwarded to the correct ports on a LAG interface.

A Signal 7 interruption occurs in the cmdbsvr daemon, causing FortiGate to enter conserve mode.

For FIPS-CC mode, the strict check for basic constraints should be removed for end entity certificates.

CPU usage issue observed in dnsproxyd caused by unused wildcard FQDN.

When performing factoryreset2, the IP addresses on "a" and "b" are set to default.

CPU usage issue observed in hasync daemon when session count is large.

FortiGate does not respond to ARP requests for the IP address on the WAN port when the interface is configured as EMAC.

System goes into halt state with Error: Package validation failed... message in cases where there are no engine files in the FortiGate when the BIOS security level is set to 2.

The DSL modem on the firewall does not work after the device starts.

IPv6 local-in ping6 to management interface failed when newly configured.

After a manual system administrator password change, the updated password-expire is not received by the FortiManager auto-update.

Running diagnose sniffer filter with blank or empty quotation marks ("" or " ") is not working.

On D-series FortiGates, a false alarm during system integrity check failure causes the firewall to reboot.

Review the temperature sensor for the SoC4 system.

Traffic over vpn-id-ipip tunnel is blocked when npu-offload is disabled in the VPN phase1 interface and the policy has UTM enabled.

Interactive CLI commands, like purge, cannot be cut and pasted into the console and exits the script. The purge command in a console puTTy session stops and waits for a y confirmation.

An error condition occurred in httpsd and newcli when trying to generate a TAC report from the GUI and CLI, respectively.

IPv6 suffixes configured on an interface are not reflected after a reboot.

The npu-vdom-link cannot forward the traffic after the first two packets.

The cmdbsvr could not secure the var_zone lock due to another process holding it indefinitely.

NAT port is out of range, causing the PBA index to be out of range.

The virtual server http-host algorithm is redirecting requests to an unexpected server.

Memory usage issue caused by excessive log files.

Enabling vdom-dns causes the VDOM DNS certificate to be blank instead of the default value.

FAS ends up in an endless loop while synching with LDAP due to special character (,) as part of the username.

When the Guest User Print Template is customized in a VDOM, printing the guest user credentials from User & Authentication > Guest Management still uses the default Guest User Print Template.

The SAML assertion is truncated in samld when the payload size is huge.

Guest administration management does not show all groups for multiple VDOMs assigned to a guest administrator account.

SSO administrator configuration breaks with Azure Cloud due to config system saml having a trailing slash in the metadata link.

FortiGate is sending Class(25) AVP with wrong length in RADIUS accounting when using 2FA with PUSH or external tokens.

When generating guest users according to the settings in the guest group, the expiration time of guest users will automatically add an extra two hours.

Device detection sometimes does not identify the correct IP addresses of devices.

Unable to view authorization page on FortiGate pop-up when the pre-login and post-login banner are set on FortiGate while using OAuth authorization.

CA bundle (CRDB) to support DigiCert second-generation (G2) full CA and intermediate CA chain.

EAP proxy daemon may keep reloading after updating the certificate bundle.

RADUIS server dialog in the GUI incorrectly changes the custom RADUIS port to 0.

AWS external account list supports regional endpoints.

An error condition occurs after a failover on the HA cluster deployed on an FG-VM64-AZURE.

When send-deny-packet enabled or ident-accept disabled, sending out responding packets (such as TCP RST or ICMP) triggers a restart.

If Azure accelerated networking is enabled, IPsec traffic cannot be redistributed using round-robin. This results in a CPU usage issue.

An error condition is observed after deploying an FG-VM64-AZURE in Standard_DS4_v2 size.

In the periodic status check of the OCI VM status, too many API calls caused a lot of 429 errors.

FortiGate-VM does not send LACP frames on the FortiLink interface toward FortiSwitch.

Copy of files between a physical server and Windows Server is slow.

Traffic drops in FortiGate HA A-A, AutoScale in Azure.

Restore operation overwrite passive configuration in AZURE A-P deployment based on SDN connector.

IPsec tunnels on AWS have TX errors incremented every 30 seconds.

FortiGate VMs in an HA cluster deployed on the Hyper-V platform may get into an unresponsive state where multiple services are impacted: GUI management, CLI commands, SSL VPN sessions, DHCP assignment, traffic throughput, and reboot function.

Event log alert Write Permission Violation to read-only file on VMware after taking snapshot.

VPN errors after upgrade: Malformed Packets, AUTHENTICATION_FAILED messages, and INVALID_KE_PAYLOAD.

FortiGate VM heartbeat authentication failed during the upgrade to 7.2.4 or 7.2.5 when HA authentication and encryption is enabled.

FortiGate-VM KVM with MLX5 not responding to ARP in RHEL environment.

On the Policy & Objects > Security Policy page for a policy-based VDOM, adding an external threat feed category to the URL Category field does not apply the changes.

HTTP session is logged as HTTPS in web filter when VIP is used.

Add web filter categories for artificial intelligence technology (category 100) and Cryptocurrency (category 101).

An error condition occurs in WAD caused by the mismatch between the SNI host and CNAME.

The Automatically connect to nearest saved network option does not work as expected when FWF-60E client-mode local radio loses connection.

RADIUS CoA does not work in some cases.

Some 5 GHz weather channels should not be allowed in certain countries.

Unable to create FortiAP profile in the GUI for dual-5G mode FortiAP U231F/U431F models.

In auth-logon and auth-logout logs, Wi-Fi users with random public IP addresses are observed.

FortiAP 431G is unable to join AC due to no response to cfg_request.

In an HA setup, after disconnecting a client from an AP, the client is removed from the primary AC but remains listed on the secondary AC.

Some VAPs that are pushed by FortiGate are not in RUN state.

Intermittent behavior in Hostapd caused by enabling/disabling fast-bss-transition.

FAP-431F is deauthenticating clients after roaming when DHCP enforcement is enabled on the SSID, even when the client gets IP from DHCP.

Usage of the cw_acds process increases and drops the FortiAP connection, which forces the FortiAP to restart in an FSM state when FortiAP settings are changed.

Add support for 6 GHz band for DARRP, wlac -c rf-analysis, and BG scan period.

Enable DFS channels on wtp-profile for FortiAP 431G and FortiAP 433G in region A/S/N(No-Brazil).

An error condition occurred for the EAP proxy while sending the RADIUS Access-Request.

MPSK keys are not loaded completely in the wpad daemon after applying a VAP with an MPSK profile selected on a FortiAP.

CAPWAP offloading does not work with more than 12,000 VAP entries.

An error case occurs in CAPWAP when the SSID interface, which has a VLAN interface over it, is deleted.

FortiAuthenticator Cloud zero trust tunnel (ZTNA connection) fails when EMS Fabric connector is configured.

After client device information is updated, the session is closed even though all information from the session still matches the policy.

FortiOS 7.4.1 is no longer vulnerable to the following CVE Reference:

• CVE-2023-37935

FortiOS 7.4.1 is no longer vulnerable to the following CVE Reference:

• CVE-2023-36639

FortiOS 7.4.1 is no longer vulnerable to the following CVE Reference:

• CVE-2023-36641