Fortinet black logo

Resolved issues

Resolved issues

The following issues have been fixed in FortiProxy 7.0.2. For inquiries about a particular bug, please contact Customer Service & Support.

Bug ID Description
681854, 743805, 753747, 758753 Users can still log in to the FortiProxy GUI, even with HTTP and HTTPS access disabled for the interface.
684640 On the FPX-2000E, the HA monitor does not failover when the monitored port is down.

690810

There was a missing break in the WAN optimization explicit proxy component.

741568

After activating FortiCloud, the user could not enable FortiSandbox Cloud.

743029 When upgrading from FortiProxy 2.0 to 7.0, the remote certificates are lost, and the firewall profile protocol options change to the default setting.
743746 The WAD crashes with signal 11 when upgrading to FortiOS 6.2.9 build 9108.
744855 After upgrading from FortiProxy 2.0.5 to 2.0.6, some of the commands under config firewall profile-group are missing.

746009

The IP pool configuration in an explicit policy is ignored on outbound traffic.

752944

LACP fails when an HA cluster is configured.

753947

There are too many TIME_WAIT sessions after the admin user logs in to the GUI.

753952

The set ssl-ssh-profile command works in the CLI but not in the GUI.

754298 The WAD crashes with signal 11 when running the autotest group.

754575

Users cannot download the PAC file when the pac-file-server-port is set to a different port than the proxy port.

755298 When the policy is in proxy mode and DPI is enabled, the connection to Callone Accession Meeting fails.
755861 When upgrading FortiProxy, the units for the proxy-auth-timeout value need to be converted.
756293 The aggregate interface cannot be used as the HA management interface.
756526 The diagnose firewall dynamic list and diagnose firewall dynamic address commands are missing for ZTNA tags.
756720 There was a crash on the ICAP server when antivirus scanning and DLP were enabled.
756844 The WAD crashes on the ICAP client with signal 11.
757212 Using transparent mode and the VMware SDN connector results in “response fails schema validation” errors.
757452 Traffic shaping using the Internet Service does not work.

758458

The FortiProxy VM in Azure does not restart properly after the execute reboot command.

758947

After creating an HA cluster in Config-Sync mode, the FortiProxy units cannot be accessed because of a memory leak.

759132 After an existing aggregate interface is deleted, the forticron application crashes.

759204

The explicit proxy settings differ in the CLI and GUI.

759216

From the System > Replacement Messages page, some of the pages mention FortiGate instead of FortiProxy.

759220

Trying to preload cache content results in error 255.

759646

After adding the Quarantine Monitor widget to the dashboard, the new widget does not load data.

759985

When a policy has Internet service addresses in the Destination field, the Destination field is blank in the GUI.

760022

The Safe Search option is available in the CLI but not in the GUI.

760371

You cannot import a certificate without adding a password.

760529

When Isolate is selection for the action in a new policy, some options are missing in the GUI.

760550

The DLP log cannot be viewed in the GUI.

760642

The HTTP Proxy-Authorization/Authorization header needs to be removed to prevent user credential leaking.

760817

After FortiProxy is upgraded from 2.0.6 to 7.0.1, the UUIDs do not match in the proxy address groups in an HA cluster.

760835

The WCCP cache engine cannot be enabled or disabled in the GUI.

760840

DNS protection not working in the transparent proxy policy.

761568

The WAD crashes multiple times after the user upgrades from FortiProxy 2.0.6 to 7.0.1.

761732

The diagnose hardware deviceinfo nic command does not work in FortiProxy 7.0.1.

762511

The set http-view command does not appear under config system global.

763023

FortiManager 7.0.3 does not support FortiProxy 7.0.1.

764062

After upgrading from FortiProxy 2.0 to 7.0, the fields of the antivirus profile are unset.

764462

After using the set ha-mgmt-status disable command, connecting with Telnet does not work.

764978

Zero-trust network access traffic needs to keep the setting of the source-affinity flag.

764990

Upgrading the firmware of a FortiProxy unit that is a member of an HA Config-Sync cluster causes a wa_cs crash.

765553

After upgrading to build 0051, CRWL keeps crashing.

765806

When the destination is ISDB for a transparent policy, traffic is not forwarded.

768361

When ICAP is enabled for web proxy and cURL is used to send a file, the contents of the Submitted By field are corrupted.

768699

The WAD crashes if the authentication rule configuration is updated while WAD is synchronizing.

768980

The set host-regex command is not working correctly.

769398

When the ICAP local server is configured, the ICAP server crashes.

769601

When traffic is sent to a transparent proxy policy, the FortiProxy unit crashes.

770178

When a proxy address is used as the destination in a policy, unrelated traffic matches the policy.

770941

URL filter is not blocking a specific page while allowing access to other pages for that domain.

771051

The following commands do not work:

  • diagnose ipv6 neighbor-cache list

  • diagnose ipv6 route list

  • diagnose ipv6 address list

773465

When antivirus caching and inspect-all are enabled, the cached infection scanning results are not used in the FTP download.

773614

After deleting a new system administrator, the CLI responds with an error message, “Add table index error: type=4.”

773909

Preloading cache content fails with error 4 and causes a WAD crash.

774191

The set ztna-ems-tag command is not working.

774373

The infection cache needs to skip content when the size is 0.

774567

After upgrading the Azure FortiProxy VM from build 0050 to build 0054, the VM does not start.

774642

After upgrading the GCP FortiProxy VM from build 0047 to build 0054, the VM keeps restarting.

775247

The WAD keeps crashing when the service for the IPv4 API gateway is set to the web portal without a predefined bookmark.

775513

There is a MAC address conflict after enabling the LAG interface in FortiProxy 7.0.1.

775626

Upgrading the firmware in an HA Config-Sync cluster fails.

775648

The forward traffic logs do not display the FSSO user names.

776242

The config web-proxy explicit command has been changed to config web-proxy explicit-proxy.

776276

After upgrading from FortiProxy 2.0.7 to 7.0.0, multiple errors 160 are logged.

776549, 776550

There was an unintentional integer overflow in the WAN optimization explicit proxy component.

776577

A dereference-after-null-pointer problem was found in the WAN optimization explicit proxy component.

776578

The wrong sizeof argument was used in the WAN optimization explicit proxy component.

776619

After FortiProxy is upgraded to build 0057, the WAD keeps crashing.

776623

The FortiProxy 400E reports that “Maximum WAD worker count 4 is not equal to current cpu number.” when it starts.

776877

When the ICAP server returns an HTTP message other than 200, the client gets an empty reply instead of the actual HTTP message.

776917

The HTTP and HTTPS daemon keeps crashing.

777082

When the FortiProxy unit is in transparent mode, NTLM authentication does not work.

777344

A WAD memory leak occurs when using ICAP.

777364

After the web-proxy entry is deleted, the WAD must be manually restarted for the change to be learned.

777370

When fast-match is disabled, the HTTPS request fails to match the source proxy address in the policy.

777405

After the policy type is changed to explicit, the address in the firewall policy cannot be edited in the GUI.

777544

When using the Active-Passive mode in an HA cluster, the primary unit crashes during synchronization.

777718

The WAD should use the port in the TCP header to match the service field.

778656

When the FortiProxy units are in HA Config-Sync cluster, the secondary unit displays ha req read header error:1 type:59 in the console.

778659

When proxy inspection is enabled with at least one flow feature (such as IPS or Application Control), all connections to all websites fail and an ERR_EMPTY_RESPONSE is reported.

778992

The load-balancing server list for ICAP cannot be edited in the GUI.

Common vulnerabilities and exposures

FortiProxy 7.0.2 is no longer vulnerable to the following CVEs:

  • CWE-79

  • CWE-120

  • CWE-124

  • CWE-134

  • CWE-190
  • CWE-347

  • CWE-550

  • CWE-788

Visit https://fortiguard.com/psirt for more information.

Resolved issues

The following issues have been fixed in FortiProxy 7.0.2. For inquiries about a particular bug, please contact Customer Service & Support.

Bug ID Description
681854, 743805, 753747, 758753 Users can still log in to the FortiProxy GUI, even with HTTP and HTTPS access disabled for the interface.
684640 On the FPX-2000E, the HA monitor does not failover when the monitored port is down.

690810

There was a missing break in the WAN optimization explicit proxy component.

741568

After activating FortiCloud, the user could not enable FortiSandbox Cloud.

743029 When upgrading from FortiProxy 2.0 to 7.0, the remote certificates are lost, and the firewall profile protocol options change to the default setting.
743746 The WAD crashes with signal 11 when upgrading to FortiOS 6.2.9 build 9108.
744855 After upgrading from FortiProxy 2.0.5 to 2.0.6, some of the commands under config firewall profile-group are missing.

746009

The IP pool configuration in an explicit policy is ignored on outbound traffic.

752944

LACP fails when an HA cluster is configured.

753947

There are too many TIME_WAIT sessions after the admin user logs in to the GUI.

753952

The set ssl-ssh-profile command works in the CLI but not in the GUI.

754298 The WAD crashes with signal 11 when running the autotest group.

754575

Users cannot download the PAC file when the pac-file-server-port is set to a different port than the proxy port.

755298 When the policy is in proxy mode and DPI is enabled, the connection to Callone Accession Meeting fails.
755861 When upgrading FortiProxy, the units for the proxy-auth-timeout value need to be converted.
756293 The aggregate interface cannot be used as the HA management interface.
756526 The diagnose firewall dynamic list and diagnose firewall dynamic address commands are missing for ZTNA tags.
756720 There was a crash on the ICAP server when antivirus scanning and DLP were enabled.
756844 The WAD crashes on the ICAP client with signal 11.
757212 Using transparent mode and the VMware SDN connector results in “response fails schema validation” errors.
757452 Traffic shaping using the Internet Service does not work.

758458

The FortiProxy VM in Azure does not restart properly after the execute reboot command.

758947

After creating an HA cluster in Config-Sync mode, the FortiProxy units cannot be accessed because of a memory leak.

759132 After an existing aggregate interface is deleted, the forticron application crashes.

759204

The explicit proxy settings differ in the CLI and GUI.

759216

From the System > Replacement Messages page, some of the pages mention FortiGate instead of FortiProxy.

759220

Trying to preload cache content results in error 255.

759646

After adding the Quarantine Monitor widget to the dashboard, the new widget does not load data.

759985

When a policy has Internet service addresses in the Destination field, the Destination field is blank in the GUI.

760022

The Safe Search option is available in the CLI but not in the GUI.

760371

You cannot import a certificate without adding a password.

760529

When Isolate is selection for the action in a new policy, some options are missing in the GUI.

760550

The DLP log cannot be viewed in the GUI.

760642

The HTTP Proxy-Authorization/Authorization header needs to be removed to prevent user credential leaking.

760817

After FortiProxy is upgraded from 2.0.6 to 7.0.1, the UUIDs do not match in the proxy address groups in an HA cluster.

760835

The WCCP cache engine cannot be enabled or disabled in the GUI.

760840

DNS protection not working in the transparent proxy policy.

761568

The WAD crashes multiple times after the user upgrades from FortiProxy 2.0.6 to 7.0.1.

761732

The diagnose hardware deviceinfo nic command does not work in FortiProxy 7.0.1.

762511

The set http-view command does not appear under config system global.

763023

FortiManager 7.0.3 does not support FortiProxy 7.0.1.

764062

After upgrading from FortiProxy 2.0 to 7.0, the fields of the antivirus profile are unset.

764462

After using the set ha-mgmt-status disable command, connecting with Telnet does not work.

764978

Zero-trust network access traffic needs to keep the setting of the source-affinity flag.

764990

Upgrading the firmware of a FortiProxy unit that is a member of an HA Config-Sync cluster causes a wa_cs crash.

765553

After upgrading to build 0051, CRWL keeps crashing.

765806

When the destination is ISDB for a transparent policy, traffic is not forwarded.

768361

When ICAP is enabled for web proxy and cURL is used to send a file, the contents of the Submitted By field are corrupted.

768699

The WAD crashes if the authentication rule configuration is updated while WAD is synchronizing.

768980

The set host-regex command is not working correctly.

769398

When the ICAP local server is configured, the ICAP server crashes.

769601

When traffic is sent to a transparent proxy policy, the FortiProxy unit crashes.

770178

When a proxy address is used as the destination in a policy, unrelated traffic matches the policy.

770941

URL filter is not blocking a specific page while allowing access to other pages for that domain.

771051

The following commands do not work:

  • diagnose ipv6 neighbor-cache list

  • diagnose ipv6 route list

  • diagnose ipv6 address list

773465

When antivirus caching and inspect-all are enabled, the cached infection scanning results are not used in the FTP download.

773614

After deleting a new system administrator, the CLI responds with an error message, “Add table index error: type=4.”

773909

Preloading cache content fails with error 4 and causes a WAD crash.

774191

The set ztna-ems-tag command is not working.

774373

The infection cache needs to skip content when the size is 0.

774567

After upgrading the Azure FortiProxy VM from build 0050 to build 0054, the VM does not start.

774642

After upgrading the GCP FortiProxy VM from build 0047 to build 0054, the VM keeps restarting.

775247

The WAD keeps crashing when the service for the IPv4 API gateway is set to the web portal without a predefined bookmark.

775513

There is a MAC address conflict after enabling the LAG interface in FortiProxy 7.0.1.

775626

Upgrading the firmware in an HA Config-Sync cluster fails.

775648

The forward traffic logs do not display the FSSO user names.

776242

The config web-proxy explicit command has been changed to config web-proxy explicit-proxy.

776276

After upgrading from FortiProxy 2.0.7 to 7.0.0, multiple errors 160 are logged.

776549, 776550

There was an unintentional integer overflow in the WAN optimization explicit proxy component.

776577

A dereference-after-null-pointer problem was found in the WAN optimization explicit proxy component.

776578

The wrong sizeof argument was used in the WAN optimization explicit proxy component.

776619

After FortiProxy is upgraded to build 0057, the WAD keeps crashing.

776623

The FortiProxy 400E reports that “Maximum WAD worker count 4 is not equal to current cpu number.” when it starts.

776877

When the ICAP server returns an HTTP message other than 200, the client gets an empty reply instead of the actual HTTP message.

776917

The HTTP and HTTPS daemon keeps crashing.

777082

When the FortiProxy unit is in transparent mode, NTLM authentication does not work.

777344

A WAD memory leak occurs when using ICAP.

777364

After the web-proxy entry is deleted, the WAD must be manually restarted for the change to be learned.

777370

When fast-match is disabled, the HTTPS request fails to match the source proxy address in the policy.

777405

After the policy type is changed to explicit, the address in the firewall policy cannot be edited in the GUI.

777544

When using the Active-Passive mode in an HA cluster, the primary unit crashes during synchronization.

777718

The WAD should use the port in the TCP header to match the service field.

778656

When the FortiProxy units are in HA Config-Sync cluster, the secondary unit displays ha req read header error:1 type:59 in the console.

778659

When proxy inspection is enabled with at least one flow feature (such as IPS or Application Control), all connections to all websites fail and an ERR_EMPTY_RESPONSE is reported.

778992

The load-balancing server list for ICAP cannot be edited in the GUI.

Common vulnerabilities and exposures

FortiProxy 7.0.2 is no longer vulnerable to the following CVEs:

  • CWE-79

  • CWE-120

  • CWE-124

  • CWE-134

  • CWE-190
  • CWE-347

  • CWE-550

  • CWE-788

Visit https://fortiguard.com/psirt for more information.