The internet-service6-custom and internet-service6-custom-group options do not work with custom IPv6 addresses.

The GUI-explicit-proxy setting on the System > Feature Visibility page is not retained after a FortiGate reboot or upgrade.

In some cases, the explicit proxy policy list can take a long time to load due to a delay in retrieving the proxy statistics. This issue does not impact explicit proxy functionality.

Workaround: restart the WAD process, or temporarily disable the WAD debugging process (when FortiGate reboots, this process will need to be disabled again).

diagnose wad toggle

(use direct connect diagnose)

The clock skew tolerance is not reflected.

For local out DNAT traffic, the best output route may not be found.

When allow-traffic-redirect is enabled (default setting), redirect traffic that ingresses and egresses from the same interface may incorrectly get dropped if the source address of the incoming packet is different from the FortiGate's interface subnet and there is no firewall policy to allow the matched traffic.

Workaround: disable allow-traffic-redirect and create a firewall policy to allow traffic to ingress and egress for the same interface.

config system global
    set allow-traffic-redirect disable
end

The DHCPv6 client does not work with vcluster2.

After a failover, ARP entries are removed from all slots when an ARP query of a single slot does not respond.

IPv6 ECMP is not supported for the FG-6000F and FG-7000E platforms. IPv6 ECMP is supported for the FG-7000F platform.

A permanent MAC address is used instead of an HA virtual MAC address during automation.

Graceful upgrade of a FortiGate 6000 or 7000 FGCP HA cluster is not supported when upgrading from FortiOS 7.0.12 to 7.2.6.

Upgrading the firmware of a FortiGate 6000 or 7000 FGCP HA cluster from 7.0.12 to 7.2.6 should be done during a maintenance window, since the firmware upgrade process will disrupt traffic for up to 30 minutes.

Before upgrading the firmware, disable uninterruptible-upgrade, then perform a normal firmware upgrade. During the upgrade process the FortiGates in the cluster will not allow traffic until all components (management board and FPCs or FIMs and FPMs) are upgraded and both FortiGates have restarted. This process can take up to 30 minutes.

SLBC for FortiOS 7.0 and 7.2 uses different FGCP HA heartbeat formats. Because of the different heartbeat formats, you cannot create an FGCP HA cluster of two FortiGate 6000s or 7000s when one chassis is running FortiOS 7.0.x and the other is running FortiOS 7.2.x. Instead, to form an FGCP HA cluster, both chassis must be running FortiOS 7.0.x or 7.2.x.

If two chassis are running different patch releases of FortiOS 7.0 or 7.2 (for example, one chassis is running 7.2.5 and the other 7.2.6), they can form a cluster. When the cluster is formed, FGCP elects one chassis to be the primary chassis. The primary chassis synchronizes its firmware to the secondary chassis. As a result, both chassis will be running the same firmware version.

You can also form a cluster if one chassis is running FortiOS 7.2.x and the other is running 7.4.x.

For best results, both chassis should be running the same firmware version, although as described above, this is not a requirement.

Image synchronization failure happened after a factory reset on FortiGate 7000E/F .

On FortiGate 6000 models, a CPU usage issue occurs in the node process when navigating a policy list with a large number (+7000) of policies in a VDOM.

Under normal conditions, a FortiGate 6000 or 7000 may generate event log messages due to a known issue with a feature added to FortiOS 7.2 and 7.4. The feature is designed to create event log messages for certain DP channel traffic issues but also generates event log messages when the DP processor detects traffic anomalies that are part of normal traffic processing. This causes the event log messages to detect false positives that don't affect normal operation.

For example, DP channel 15 RX drop detected! messages can be created when a routine problem is detected with a packet that would normally cause the DP processor to drop the packet.

Similar discard message may also appear if the DP buffer is full.

On FortiGate 7000F using FGSP and FGCP, when TCP traffic takes an asymmetric path, the TCP ACK and data packets might be dropped in NP7.

On FortiGate 6000 FPCs and FortiGate 7000 FPMs the node process may consume large amounts of CPU resources, possibly affecting FPC or FPM performance. (You can run the diagnose sys top command from an FPC or FPM CLI to view CPU usage.) This problem may be caused by security rating result submission.

Workaround: use the following commands to disable automatic security rating results submission and to disable running scheduled security ratings checks:

config system global
    set security-rating-result-submission disable
    set security-rating-run-on-schedule disable
end

Once you have entered these commands, use the following command to restart the node process:

diagnose nodejs process restart

Incorrect SLBC traffic-related statistics may be displayed on the FortiGate 6000 or FortiGate 7000 GUI (for example, in a dashboard widgets). This can occur if an FPC or FPM is not correctly registered for statistic collection during startup. This is purely a GUI display issue and does not impact system operation.

To work around this display issue, enter the command diagnose nodejs process restart to reset the aggregator. You may need to wait for a few minutes after the system has started up before entering this command to make sure that all systems have fully initialized.

On the FortiGate 7000E platform, after upgrading firmware from 7.2.8 to 7.4.x, the CLI of the secondary FIM and the FPMs in the secondary chassis of an FGCP cluster may display This firmware failed signature validation. This error message is displayed because of a known issue. The firmware is valid and the FortiGate 7000E cluster will operate normally.

HA remote access does not work as expected when ha-port-dtag-mode is double-tagging.

On FortiGate, IPv6 VRF routing tables appear under the new and old FPC primary units when the primary FPC slot is changed.

When viewing entries in the slide-out window of the Policy & Objects > Internet Service Database page, users cannot scroll down to the end if there are over 100000 entries.

FortiGate GUI should not display a license expired notification due to an expired FortiManager Cloud license if it still has a valid account level FortiManager Cloud license (function is not affected).

Edits that are made to IP Exemptions in IPS Signatures and Filters more than once on the Security Profiles > Intrusion Prevention page are not saved.

When workspace configuration save mode is set to manual in the System > Settings, configuration changes made on the primary unit and then saved do not synchronize with the secondary unit when one of the cluster units are rebooted or shutdown after the change.

Workaround: set the workspace configuration mode to automatic.

FortiGate in A-P HA mode with admin-restrict-local enabled allows the local administrator to log in to the passive host, even if LDAP is available.

When Configuration save mode is set to Manual, any firewall policy change will make the cluster out-of-sync.

SCTP traffic is not forwarded back to the session owner (FGSP asymmetric traffic with IPS , NAT mode, and SCTP).

On the Fabric Management page, the HA Secondary lists both primary and secondary FortiGate units.

When the HA management interface is set a LAG, it is not synchronized to newly joining secondary HA devices.

A secondary HA unit may go into conserve mode when joining an HA cluster if the FortiGate's configuration is large.

FortiGate may experience a memory usage issue with the node daemon once a connection is closed.

After successfully changing the VLAN ID of an interface from the CLI, an error message similar to cmdb_txn_cache_data(query=log.npu-server,leve=1) failed may appear.

NPD/LPMD cannot differentiate the different VRF's, considers as VRF 0 for all.

ECMP does not load balance IPv6 traffic between two routes in a multi-VDOM setup.

Output of diagnose sys npu-session {list | list-full} does not mention policy route information.

Packets drop, and different behavior occurs between devices in an HA pair with ECMP next hop.

The diagnose sys npu-session list command shows an incorrect policy ID when traffic is using an intra-zone policy.

NAT46 NPU sessions are lost and traffic drops when a HA failover occurs.

Connections per second (CPS) performance of SIP sessions accepted by hyperscale firewall policies with EIM and EIF disabled that include overload with port block allocation (PBA) GCN IP pools is lower than expected.

Workaround: enter the following command for each NP7 processor to resolve the performance issue.

# diagnose npu np7 setreg <npu_#> nss.nss_thrd_ctrl.thrd_ctrl 0xF

Where <npu_#> is the NP7 processor number. NP7 processors are numbered 0, 1, 2, and so on.

The configuration changes from entering these diagnose commands are reset if the FortiGate restarts. After a system restart, just re-enter the diagnose commands.

CPU usage issues occurred when IPsec VPN traffic was received on the VLAN interface of an NP7 vlink.

Disk logging files are cached in the kernel, causing high memory usage.

The following intrusion was observed: in the alert mail refers to another field in the anomaly log.

The GUI experiences a performance issue and reverts the last input when multiple ports are added to a filter for destination ports.

When uploading the log file to the FTP server, some parts of the log files are not included in the upload.

CPU usage issue in WAD caused by a high number of devices being detected by the device detection feature.

In an HA setup with vCluster, a CMDB API request to the primary cluster does not synchronize the configuration to the secondary cluster.

SD-WAN interfaces should be denoted in the interface statistics API.

SD-WAN members can be out-of-sla after some retrieve times.

The diagnose ip rtcache list command is no longer supported in the FortiOS 4.19 kernel.

Router information in the BGP summary still shows removed BGP neighbor/peer configuration.

On the Network > SD-WAN > SD-WAN Rules page, member interfaces that are down are incorrectly shown as up. The tooltip on the interface shows the correct status.

When creating a rule on the Network > Routing Objects page, the Prefix-list is set to 0.0.0.0 0.0.0.0 when an incorrect format is entered in the Prefix field.

On the Security Fabric > Automation page, the webhook request header does not contain Content-type: application/json when using the JSON format. This causes Microsoft Teams to reject the request.

FortiGate experiences a CPU usage issue in the node process when there multiple administrator sessions running simultaneously on the GUI in a Security Fabric with multiple downstream devices. This may result in slow loading times for multiple GUI pages.

Workaround: Disconnect the other concurrent administrator sessions to avoid overloading node process.

The csfd and node daemons cause a CPU usage issue on large network topologies with many FortiAPs and/or FortiSwitches configured.

FortiClient Windows cannot be launched with SSL VPN web portal.

Intermittent behavior in samld due to an absent crucial parameter in the SP login response may lead to SSL VPN users experiencing disconnections.

Japanese key input does not work correctly during RDP in SSL VPN web mode.

The FortiSwitch topology is not loading correctly on the GUI.

An interface in FortiLink is flapping with MCLAG with DAC on an OPSFPP-T-05-PAB transceiver.

Traffic going through a VLAN over VXLAN is not offloaded to NP7.

On a redundant interface, traffic may drop with some NPU-offload enabled policies when the interface is not initialized properly.

execute ping-option interface cannot specific an interface name of a.

On FortiGate 400F, 600F, 900G, 3200F, and 3700F models, LAG interface members are not shutting down when the remote end interface (one member in the LAG) is admin down.

On FortiGate, support is only provided for a single host-key ssh-ed25519 when ssh-rsa is disabled.

Status light is not showing on the FortiGate 60F or 100F after a cold and warm reboot.

On the NP7 platform, setting the interface configuration using set inbandwidth <x> or set outbandwidth <x> commands stops traffic flow.

Workaround: unset the inbandwidth and outbandwidth in the CLI:

config system interface
    edit <port>
        unset inbandwidth
        unset outbandwidth
    next
end

In a certain edge case, traffic directed towards a VLAN interface could cause a kernel interruption.

On the FortiGate 601F, the ports (x7) have no cables attached but the link LEDs are green.

On the Network > Interfaces page, hardware and software switches show VLAN interfaces as down instead of up. The actual status of the VLAN interface can be verified using the command line.

SNMP walk of the entire MIB fails when the configuration has split-port and a large number of interfaces.

DAC cable between FortiGate and FortiSwitch stops working after upgrading from 7.2.6 to 7.2.7.

FortiGate 60F and 61F models may experience a memory usage issue during a FortiGuard update due to the ips-helper process. This can cause the FortiGate to go into conserve mode if there is not enough free memory.

Workaround: User can disable CP acceleration to reduce the memory usage.

config ips global
    set cp-accel-mode none
end

Administrator accounts using an admin profile with only FortiGuard Updates read-write permissions cannot open the FortiGuard page.

Fgfmsd does not function as expected when the type is set as fortimanager in system-central management but has no route to FortiManager.

Some FortiGate models on NP6/NP6Lite/NP6xLite platforms experience unexpected behavior due to certain traffic conditions after upgrading to 7.2.8. Traffic may be interrupted momentarily.

Workaround: Users impacted by this issue can contact Fortinet Support to request a special build with a fix for this issue. Alternatively, users can disable the processing of traffic by the IPS engine’s nTurbo using the following command:

config ips global
    set np-accel-mode none
end

On the FortiGate 1800F, the 40G interface's status is DOWN after upgrading to 7.2.8.

When configuring an SNMP trusted host that matches the management Admin trusted host subnet, the GUI may give an incorrect warning that the current SNMP trusted host does not match. This is purely a GUI display issue and does not impact the actual SNMP traffic.

Workaround: If the trusted host is enabled on all administrative access, make sure the SNMP host IP is included in at least one of these trusted IP/subnets.

When auto-upgrade is disabled, scheduled upgrades on FortiGate are not automatically canceled. To cancel any scheduled upgrades, exec federated-upgrade cancel must be done manually.

When upgrading multiple firmware versions in the GUI, the Follow upgrade path option does not respect the recommended upgrade path.

When a remote LDAP user with Two-factor Authentication enabled and Authentication type 'FortiToken' tries to access the internet through firewall authentication, the web page does not receive the FortiToken notification or proceed to authenticate the user.

Workaround: click the Continue button on the authentication page after approving the FortiToken on the mobile device.

The FortiGate does not send the user's IP address to the TACACS+ server during an authorization request.

When there are over 5000 firewall users, the minimized Firewall Users widget on the dashboard does not display the donut chart or number of users. Expanding the widget to full screen displays all users.

Client IP addresses are sent in an invalid format which some servers cannot accept.

If FGTVM was deployed in UEFI boot mode, do not downgrade to any GA version earlier than 7.2.4.

IPsec tunnels on AWS have TX errors incremented every 30 seconds.

HTTP session is logged as HTTPS in web filter when VIP is used.

The layer 3 roaming feature may not work when the wireless controller is running multiple cw_acd processes (when the value of acd-process-count is not zero).

CAPWAP tunnel traffic over tunnel SSID is dropped when offloading is enabled.

The Automatically connect to nearest saved network option does not work as expected when FWF-60E client-mode local radio loses connection.

Physical and logical topology is slow to load when there are a lot of managed FortiAP devices (over 50). This issue does not impact FortiAP management and operation.

Excessive MEM POOLuse_up_cnt observed on secondary unit in an HA environment.

Managed FortiSwitch detects multiple MACs using the same IP address.

Intermittent traffic disruption observed in cw_acd caused by a rare error condition.

FortiAP units repeated joining and leaving FortiGate HA cluster when the secondary FortiGate has stored FortiAP images.

WiFi clients are disconnected from SSIDs due to an error condition in the daemon hostapd process.