FortiGate devices are supported only in NAT mode.

FortiLink mode over a layer-3 network is not supported.

The FortiPolicy icon is not supported with 7.0.6.

For your security, the FortiPolicy window locks after a period of inactivity. By default, this period is 15 minutes. Any unsaved work will be lost when the FortiPolicy window locks.

Workaround: Save your work before leaving FortiPolicy tasks.

Security events from the Security Fabric are not supported in the FortiPolicy 7.2.4 release; they will be supported in a future release.

The deployed ACL rules displayed in the Policy > Access Control table are a read-only summary of all the rules that have been deployed.

FortiPolicy does not support editing ACL rules after they are deployed to the FortiGate devices. All edits to the ACL rules must be done in the ACL tables on the FortiGate devices.

The Policy > Access Control table allows you to add new rules, but, after they are saved and therefore deployed, they can only be edited on the FortiGate devices.

IP overlaps across VDOMs are not supported.

Policy mode is supported using address objects. Address objects have performance constraints.

After applying a newly registered FortiPolicy license, it may take some time to load license contracts. If contracts are not displayed after 15-20 minutes, please try re-importing the license.

Custom virtual domains (VDOMs) are not supported.

In the 7.2.4 release, FortiPolicy does not provide data for Risky Domains, Malware, and Sensitive Data on the Insights > Detections page. The Malware widget will be supported in a future release.

FortiGate fails to authorize the certificate request type fabric device in GUI.

Workaround: Re-login to FortiGate.

Faults are not raised when a configured management proxy on a UM is unreachable.

When workloads are inserted, multiple port processing updates are received on passage and the IP addresses continuously move around.

When the original FortiLink VLAN of a workload is different from the Primary LAN Segment Interface, the workloads will experience a change of IP addresses based on the DHCP server associated with both the VLANs. This IP change is very slow and indeterminate, which causes traffic disruption.

When a workload is deleted, it is not removed from the factory and GUI pages.

After a child FortiGate is deleted from SF, the workloads belonging to the child path still show up in workloads call.

The SX_PermittedCIDRs stale entry can be seen after upgrading to 7.2.4-GA.