FortiManager 7.6.2 and FortiOS 7.2.11 compatibility issues
This section identifies interoperability issues that have been identified with FortiManager 7.6.2 and FortiOS 7.2.11.
|
The following compatibility issues are in addition to the "Compatibility issues with FortiOS 7.2.11" documented in Special Notices. |
|
When specific platforms are indicated, the syntax change applies to both the FortiGate and FortiCarrier platform for the model. For example, |
The following objects were added in FortiOS 7.2.11. These objects can only be configured on the FortiOS device, and they cannot be configured from FortiManager 7.6.2.
-
(attr) system admin old-password (148 platforms: excludes 80F-2R-3G4G-DSL)
-
(attr) system npu dedicated-lacp-queue (43 platforms: 901G,600F,3701F,3500F,3200F,1000F,3501F,2600F,401F,1801F,3700F,400F,3001F,4200F,601F,4401F,4400F,3000F,900G,2601F,1001F,3201F,4201F)
-
(attr) system password-policy login-lockout-upon-downgrade (148 platforms: excludes 80F-2R-3G4G-DSL)
-
(attr) user radius require-message-authenticator (148 platforms: excludes 80F-2R-3G4G-DSL)
-
(attr) vpn ssl web portal os-check-list minor-version
The following objects were removed in FortiOS 7.2.11. These objects cannot be pushed from FortiManager 7.6.2 to FortiOS devices running 7.2.11.
-
(attr) system settings gui-endpoint-control (146 platforms: excludes 140E-POE,80F-2R-3G4G-DSL,101E)
-
(attr) system settings gui-endpoint-control-advanced (146 platforms: excludes 140E-POE,80F-2R-3G4G-DSL,101E)
The following default values changed in FortiOS 7.2.11. If you do not wish to use these default settings, you must update the setting in FortiManager and push to the FortiOS devices running 7.2.11.
-
log tacacs+accounting filter cli-cmd-audit (enable -> disable)
-
log tacacs+accounting2 filter cli-cmd-audit (enable -> disable)
-
log tacacs+accounting3 filter cli-cmd-audit (enable -> disable)
-
system global ssh-kex-algo (diffie-hellman-group-exchange-sha256 curve25519-sha256@libssh.org ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 -> diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha256 curve25519-sha256@libssh.org ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521)
-
web-proxy global max-waf-body-cache-length (32 -> 1)
-
webfilter profile antiphish max-body-len (65536 -> 1024)
Additional option changes in FortiOS 7.2.11. You must confirm these option changes do not conflict with options that you have set from FortiManager. For example, from FortiManager 7.6.2, you cannot use options that have been removed and you cannot set options that have been added.
system global ssh-kex-algo
++ 3 opts: diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 (2 platforms: 90G,120G)
web-proxy explicit pref-dns-result
++ 2 opts: ipv4-strict ipv6-strict (2 platforms: 90G,120G)
Other changes in FortiOS 7.2.11. If a table size or integer range has changed in FortiOS 7.2.11, you are still restricted to the old table size or integer range in FortiManager.
switch-controller managed-switch
tab-size (tag|tz): 0,8,0 -> 0,24,0 (1 platforms: 90G)
switch-controller system parallel-process
int-range (tag|lmt): 1,8 -> 1,24 (1 platforms: 90G)
system csf group-password
tag: mu -> None (2 platforms: 90G,120G)
system global faz-disk-buffer-size
tag: lmt -> None (2 platforms: 90G,120G)
tag: lsz -> None (2 platforms: 90G,120G)
web-proxy global max-waf-body-cache-length
int-range (tag|lmt): 10,1024 -> 1,1024 (138 platforms: excludes 80F-2R-3G4G-DSL)