SSID config changes cannot be installed when SSID mode selected as Tunnel under AP.

Traffic Shaping widgets keep loading on Dashboard page of the Device Manager.

Unable to set non-HEX values for DHCP Option; it displays an error message: "...enter a valid Hexadecimal number...".

FortiManager fails to add FortiAnalyzer as a managed device.

Workaround:

Configure the following on the FortiManager to allow FortiAnalyzer to connect:

config system global

set fgfm-peercert-withoutsn enable

end

FGFM's tunnel went down after upgrade because the device's SN doesn't match the expected certificate.

Workaround:

This check can be manually disabled globally on FortiManager side by the following CLI:

config system global

set fgfm-peercert-withoutsn enable

end

The out-of-sync notification is missing in FortiManager after upgrading to version 7.2.5.

Workaround:

• Reboot the FortiManager, or

• Find the process IDs (PIDs) of "webworker","websocket", and "webevent", then terminate them using the following command: diag sys process kill 11 <pid>

On the Log View (when FortiAnalyzer is added to FortiManager) changing time filters, first request always fails but second one is successful.

Workaround:

Use FortiAnalyzer's Log View to view logs.

Policy installation may stuck on the validation due to recurrent Segmentation Fault errors on the webevent / webworker processes.

Workaround:

FortiManager may be rebooted.

Unable to upgrade ADOM from 7.0 to 7.2, due to the error "Do not support urlfilter-table for global scope webfilter profile".

Workaround:

Run the following script against the ADOM DB:

config webfilter profile

edit "g-default"

config web

unset urlfilter-table

end

next

end

The GUI crashes with "Uncaught TypeError: Cannot read properties..." as soon as the first dot of an IP address is entered in the generic search of the Firewall Addresses table. This occurs when there is an address object with a <NULL> subnet.

The policy installation fails when FortiManager attempts to apply changes related to the "management address" on the interface of the FortiGates.

Install preview randomly hangs and doesn't return any data on next screen.

Workaround:

Close the install preview window and re-run the install.

Modification to Policy with install target does not update the policy package status.

Workaround:

Remove the Installation Target and re-add to the policy, which will trigger Policy Package Modification and the install preview will also show the changes made.

If using Static Route template, FortiManager may become unresponsive when trying to install multiple devices simultaneously.

Workaround:

Disassociate device from static route template.

FortiManager attempts to remove the existing external-resource when "set external-blocklist-enable-all enable" in AV profile.

Workaround: Use "set external-blocklist <external-profile-name> <external-profile-name2>".

When an address object is cloned, it is not automatically included in the original address group.

Workaround:

Manually add the cloned address to the original address group after cloning.

FortiManager removes the Web Filter Profile from the Profile Group for Policy-Based FortiGates.

Workaround:

Use individual profiles in the policy instead of the profile group.

The policy package installation is hanging due to a crash in the "securityconsole" application. This is more likely to happen when installing to more than 5 devices.

Workaround:

Avoid using static route templates OR template groups.

Searching for an address object by its IP address does not display the related address groups; instead, it only shows the address object.

When editing an address group in a firewall policy, the members do not display correctly.

Workaround:

First edit the policy, and then edit the address group.

Unable to add VIP/VIP group in the destination address field of policies, as they are not visible when trying to add them in ADOM 6.4.

Policy package might not be installed due to the following error message:

"unassign template object vpn ipsec phase1-interface <...> fail: Do not delete fortitoken during ADOM to device copy."

This case is still under investigation for the root cause analysis (RCA).

Pre-installation from CLI Template fails with the error message "Attribute source-IP check error for RADIUS users."

The "ext-auth-group-match" feature doesn't work for SAML SSO users.