Secondary device blades occasionally report critical log event Scanunit initiated a virus engine/definitions update. Affected models: FG-5K, 6K, and 7K series.

Explicit proxy error 504, DNS fails for a specific domain.

FortiGate sends traffic to an incorrect port using a wrong source NAT IP address.

When the category proxy address is applied in a proxy policy, if SOCKS traffic passes through the web proxy, when matching the SOCKS traffic with the proxy address, the WAD will crash with signal 11 at wad_url_choose_cate. Browsers may send SOCKS traffic in the background from time to time.

Abnormal prolonged CPU spike with cmdbsvr and WAD processes when making change to large policy list (10 000+ policies).

Cluster VDOM policy statistics data is not correct when VFID is different for same VDOM on primary/secondary.

SCTP secondary path not working in ECMP context; incorrect expectation session created from auxiliary session.

ICMP reply packets dropped by the FortiGate.

Firewall policy dstaddr does not show virtual server available based on virtual WAN link member.

Fragmented UDP traffic is silently dropped when fragments have different ECN values.

append command allows mixing VIP and firewall address as destination objects in a firewall policy.

External threat feed entry 0.0.0.0/0 shows as invalid but it blocks traffic.

There should be an event log when there are internet service remove/merge entries.

Firewall does not track UDP sessions on the same port.

Different ciphers for SSL/HTTPS virtual servers.

TNS connection request limited to 500 per second when client is trying to reach database server through the firewall.

Using the GUI to update a VDOM license fails when the new license has a lower VDOM count than the current license.

Source IP is not used when using the GUI to query the FortiGuard filtering service.

The help message for gui-dynamic-profile-display is not correct.

When creating a firewall with an invalid subnet mask, an error is not generated.

When disabling Allow Endpoint Registration on the VPN Creation Wizard, the action succeeds, but the error Unable to setup VPN is incorrectly displayed.

When creating a profile group with an SSL/SSH profile of no-inspection, the profile group correctly displays this, but when you edit the profile, certificate-inspection is displayed.

GUI does not allow user to select SSL VPN tunnel when configuring Multicast routing.

GARP is not sent when using the GUI to move a VDOM from one virtual cluster to another. GARP is sent when using the CLI.

FortiGates in an HA A-P configuration may lose GUI access to the HA secondary device after a period of 8 days of inactivity, when at least one static IPv6 address is configured on an interface.

On Dashboard Setup page, changes made by super administrator and administrator of multiple VDOMs should be reflected in all managed VDOMs.

FortiAnalyzer Cloud card on the Fabric Connectors page shows a connected icon when it is not connected.

GUI does not allow users to select SD-WAN as a destination interface in an SSL VPN policy while CLI does.

Web filter profile dialog cannot load URL filter table if there are a lot of URL filters.

The FortiLink Interface pane incorrectly displays high CPU usage and poor health.

GUI does not show the configured external FortiGuard category in the SSL-SSH profile's exempt list.

Unable to delete multiple phase 2 selectors at the same time from the VPN IPsec tunnels dialog.

Unable to print user data for guest management.

Unable to select an address group when configuring Source IP Pools for an SSL VPN portal.

Cannot access FortiGate GUI over IPv6 after configuring IPv6 for the first time.

When refreshing the FortiGuard page, connectivity status for Web Filtering and Anti-Spam incorrectly changes from up to down.

When VDOM is enabled, the GUI cannot be used to edit a remote user group from within the Administrators dialog.

When there are more than 600 quarantined IP addresses, the Quarantine Monitor (GUI and CLI) will not properly display them.

The top charts of the Device Inventory Monitor dashboard are empty when the visualization is set to table view.

Firewall users cannot change their password via web captive portal when password renewal is enforced by the firewall policy for remote users.

GUI interface speed test fails when there are multiple VDOMs.

GUI search does not work in the interface list if DHCP client and range columns are present.

Unable to change the action setting of Freeware and Software Downloads using the FortiGuard Category Based Filter of the DNS filter profile.

FortiGuard resource retrieval delay causes GUI pages to respond slowly. Affected pages include: Firewall Policy, Settings (log and system), Explicit Proxy (web and FTP), System Global, and System CSF.

Users cannot deselect Administrative Access options for VLAN interfaces from the GUI; the CLI must be used.

Web CLI console cannot load due to Connection lost if port 8080 is used (HTTP).

When editing the Interface column from the Multicast Policy page, an empty column appears when the any entry is selected from Select Entries and applied. The same occurs from the NAT64 and NAT46 policy pages.

Intermittent GUI process crash if a managed FortiSwitch returns a reset status.

ip6-mode was changed from delegated to static after the interface was edited from the GUI.

For AV profiles, the outbreak-prevention setting on enabled protocols is not automatically configured when enabling Use External Malware Block List.

Enabling the Dynamic Gateway toggle for a static route fails without warning when the configuration is incorrect.

Date/Time filter does not work on FortiGate Cloud logs.

Re-add the FortiView facets filtering bar to full screen or standalone mode.

When filtering log view entries by IP address range, entries higher than the upper limit of the range are shown.

Unable to load web CLI console for LDAP admin with a login name that contains a space.

Get one-time hasync crash when running HA scripts for FIPS-CC.

In Hyper-V HA, CLI will falsely report can not set mac address when MAC address is set.

CSR on cluster primary is generating out-of-sync alerts on secondary and tertiary units.

Duplicate logs are created by both primary and secondary devices for IPsec VPN.

Inconsistent data from FFDB caused several confsyncd crashes.

Inconsistent values for HA cluster inside the SNMP.

When secondary device reboots, it adds an interface to the virtual switch. Secondary cannot synchronize after it starts, as that interface disappears in system interface and virtual-switch.

Long sessions lost on new primary after HA failover.

The new join-in secondary chassis failed to sync, while primary chassis has 6K policies in one VDOM.

The mgmt interfaces are excluded for heartbeat interfaces (even if dedicate-mgmt is not enabled).

VLAN interfaces are created on a different virtual cluster primary instead of the root primary do not sync.

Logging is intermittent for FortiGate IDS passive in one-armed sniffer mode.

Cannot pass traffic over ADVPN if: tunnel-search is set to nexthop, net-device disable, mode-cfg enable, and add-route disable.

Add IKEv2 phase 2 initiator traffic selector narrowing for Cisco compatibility.

In extreme situations when thousands of tunnels are negotiating simultaneously (IKEv2), iked process gets exhausted and stuck.

FortiGate is not deleting the shortcut tunnel for ISPA (primary ISP) when ISPA is down.

User name log empty when IPsec dialup IKEv2 has client RSA certificate with empty subject.

DHCP over IPsec randomly works when net-device is disabled.

IKE HA sync IPsec SA fails on receiver when ESP null crypto algorithm is used.

IKE HA sync truncates phase 2 option flags after the first eight bits.

local-gw is replaced with primary IP on a secondary device when the secondary IP is used as a local-gw.

Setting same phase1-interface in SD-WAN member and SD-WAN zone causes iked watchdog timeout.

Could not locate phase 1 configuration for IPv6 dialup IPsec VPN.

If NAT-T IP changes, the dynamic IPsec spoke add route entry is stuck on hub.

For URLs over 66 characters, the FortiGate replaces remaining characters with dots (.) in dstname field when forwarded to syslog/FortiAnalyzer.

vwlservice should log the SD-WAN rule and not an internet service; impacts FortiAnalyzer SD-WAN monitor widgets and reports.

Move eventtime field to the beginning of the log to save performance on Splunk or other logging systems.

On FG-60F, logging and FortiCloud reporting incorrect IPv6 bandwidth usage for sessions with NPU offload.

miglogd crashes with signal 11.

FortiGate tried to connect to FortiGate Cloud with the primary IP after reboot, although the secondary IP is the source in the FortiGuard log.

Traffic log shows Policy violation for traffic hitting the allow policy in NGFW policy mode.

Should not be able to set inspection-mode proxy with IPS-enabled only policy.

Proxy deep inspection fails if server chooses to sign with ECDSA-SHA1.

When Kerberos (negotiate without NTLM) authentication method is used for web proxy user authentication, there may be a rare memory leak issue. This memory leak issue may eventually cause the FortiGate to go into conserve mode once it occurs after many users are authenticated by Kerberos repeatedly over time.

When FOH server is disconnected from a HTTP session, the HTTP session client port peer is not cleared. After this, the HTTP client port shutdown causes a crash because the peer port is freed.

Delete validation is not working for Protecting SSL Server profile.

WAD memory leak caused by Kerberos proxy authentication.

Wildcard URL filter in proxy mode with ? and * not always handled properly.

Proxy deep inspection fails if server uses TLS 1.3 cookies or record padding.

FortiGate should be in SSL bypass mode for TLS 1.2 certificate inspection with client certificate request.

Cannot access specific website using proxy-based UTM with certification inspection due to delays from the server in replying to ClientHello message when a second connection from the same IP is also waiting for ClientHello.

Application control in Azure fails to detect and block SSH traffic with proxy inspection.

SD-WAN route selection does not use the most specific route in the routing table when selecting the egress path.

Local-out TCP traffic changes output interface when irrelevant interface is flapping and causes disconnections.

diagnose ip proute match gives wrong result when VRF is configured.

Need support for SSL VPN web mode traffic to follow SD-WAN rules/policy route.

Unable to redistribute BGP into OSPF based on community (in VRF 0).

ISDB policy routes are not removed when the SD-WAN member is down.

PMTU calculation for VPN interfaces is not working. FortiGate ignores ICMP type 3 code 4 messages and does not update the routing cache.

SD-WAN route tag is removed with multiple BGP paths in place.

BGP prefix lifetime resets every 60 seconds when scanning BGP RIB.

Upgrading to FortiOS 6.4.2 breaks all SD-WAN performance SLAs that use HTTP.

Editing an existing route map rule to add set-weight 0 results in unset set-weight behavior.

Application vwl signal 11 (segmentation fault) received when HA receives 0 bytes of data.

Application vwl signal 6 (aborted) received due to wrong memory allocation for SD-WAN service when creating an ADVPN shortcut.

SD-WAN rule disappears when an SD-WAN member experiences a dynamic change, such as during a dynamic PPPoE interface update.

The OSPF neighborship cannot be established; get MD5 authentication error when the wrong MD5 key is deleted after modifying the key.

If a session is initiated from the server side, SD-WAN application control does not work as expected.

HA secondary also sends SD-WAN sla-fail-log-period to FortiAnalyzer.

IPv6 routing does not work properly to be a dual stack.

Application bfdd crashes.

When viewing CSF child Dashboard > WiFi from parent FortiGate, GUI reports, Cannot read property 'spectrum_analysis' of undefined.

FortiGate does not send interface configuration to FortiIPAM.

Root FortiGate fails to load Fabric topology if HA downstream device has a trusted device in both primary and secondary FortiGates.

The ipamd process is causing high memory usage after a few days as the JSON was not freed.

SSL VPN crashes on parsing some special URLs.

Access problem for website.

WebSocket using Socket.IO could not be established through SSL VPN web mode.

A page inside a bookmark not opening in SSL VPN web mode.

All sslvpnd daemons use 99.9% CPU when policy is being updated.

SSL VPN rewrites the URL inside the emails sent in Outlook (webmail).

Internal webpage, di***, is not loading in web mode.

Internal SharePoint 2019 website cannot be accessed in SSL VPN web portal.

Redirected URLs do not work in web mode for am***.com.

Content from internal Microsoft Dynamics CRM cr***.local portal is not loading properly in SSL VPN web mode.

When DNS domain is configured, requests with NTLM of host name-only bookmark could not get response from server.

fas crashes when using FortiToken Cloud to access SSL VPN tunnel.

Internal website loading issue in SSL VPN web portal for ca***.fr.

SSL VPN log entries display users from other VDOMs.

For RADIUS server, all-usergroup does not work if there is a same remote user created but not used by SSL VPN.

BMC Remedy Mid Tier 9.1 web app is not displayed properly in SSL VPN web mode.

BMC Remedy Mid Tier 8.1 web application elements are not displayed properly in SSL VPN web mode.

SSL VPN web mode HTTPS bookmark fails to load (times out).

SSL VPN crashes in a scenario where a large number of groups is sent to fnbam for authentication.

SSL VPN web mode not working for Ec***re website.

SAML authentications occurring through SSL VPN web mode are not completing.

SSL VPN web portal bookmark not loading internal web page after login credentials are entered.

Users with explicit web proxy authentication lose their proxy authentication group.

The system allows enabling split tunnel when the SSL VPN policy is configured with destination all. It is not consistent with 5.6.x and 6.0.x.

Internal website, https://*.da***.cz, is not working correctly in SSL VPN web mode due to source link error.

When adding an FTP link to download FortiClient and accessing it through the portal, the colon is dropped from the string.

FortiGate keeps replying to an ARP request for an IP address that was once assigned to an SSL VPN user, who has already disconnected and been deleted.

Unable to load HTTPS bookmark in Safari (TypeError: 'text/html').

Internal websites not displayed successfully in SSL VPN web portal.

SSL VPN incorrectly rewrites the script URL.

ASUS ASMB9-iKVM application shows blank page in SSL VPN web mode.

The https://outlook.office365.com and https://login.microsoft.com websites cannot be accessed in the SSL VPN web portal.

The internal website is not working properly using SSL VPN.

SSL VPN web mode cannot open DFS shared subdirectories, get Invalid HTTP request error as sslvpnd adds NT.

SCM VPN disconnects when performing an SVN checkout.

User cannot use column header for data sorting (bookmark issue).

When sslvpn processes the HTTP/HTTPS response with content disposition, it will change the response body since the content type is HTML.

HA cluster not synchronizing when configuring an active LACP with MCLAG via FortiManager.

FG-201E stops sending out packets and NP6lite is stuck.

Link monitor behavior is different between FGCP and SLBC clusters.

Error in log, msg="Interface 12345678001-ext:64 not found in the list!", while creating a long name VDOM in FG-SVM.

Out-of-order packets for an offloaded multicast stream.

Rebooting FG-1500D in 5.6.x during upgrade causes an L2 loop on the heartbeat interface and VLAN is disabled on the switch side.

NP multicast session remains after the kernel session is deleted.

NPU offloading enabled dropping traffic from IPsec VPN tunnel remote gateway.

TCP traffic disruption when traffic shaper takes effect with NP offloading enabled.

Wildcard FQDN not resolved on the secondary unit.

FG-100F memory configuration check.

Symantec connector does not work if management VDOM is not root vdom and root VDOM has no network connection.

Forward or local bi-directional traffic from NPU inter-VDOM links through separate VDOMs is subject to high latency.

FG-100F cannot forward fragmented packets between hardware switch ports.

Errors during fuzzy tests on FG-1500D.

LTE does not connect after upgrading from 6.2.3 on FG-30E-3G4G models.

FortiGate in LENC mode unable to pass firmware signature verification and shows as uncertified after GUI upgrade.

FG-100F memory configuration check fails because of wrong threshold.

FortiGate does not send service-account-id to FortiManager via fgfm tunnel when FortiCloud is activated directly on the FortiGate.

FortiGate unable to boot with kernel panic by cmdbsvr when VLAN is configured on redundant interface with non-NPU port.

FG-80E terminates the firewall session abruptly when the end-users download large files.

FG-40F/60F kernel panic if upgrading from 6.4.0 due to configuration file having a name conflict of fortilink as both aggregate interface and virtual switch name.

Cannot set overlap IP on global level if allow-subnet-overlap on management VDOM is disabled.

FortiDDNS is unable to update the renewed public IP address to FortiGuard server in some error conditions.

cmdbsvr may crash with signal 11 (segmentation fault) when frequently changing firewall policies.

DHCP relay will honor the broadcast flag set to 0 (unicast) in only one VDOM at a time in a multi-VDOM environment.

FortiExtender virtual interface cannot get IP after rebooting the system.

NP6Xlite traffic not sent over the tunnel when NPU is enabled.

Error message shown (get_ha_sync_obj_sig_4dir delete broken symbolic link /etc/cert/ca/5c44d531.0) when upgrading from 6.4.1.

The interface speed setting should be kept after deleting the virtual switch.

Kernel panic happened on FWF-61F and FWF-40F.

IPv6 passes though the DNS filter with application control enabled.

FortiGate running 6.4.2 GA cannot validate license via FortiManager due to FortiManager hardware missing Fortinet_CA2 and Fortinet_SUBCA2001.

Configuration changes take a long time and cmdbsrv processes use up to 100% CPU.

FGR-60F-3G4G hardware switch span does not work.

The maximum number of IPS supported by each NTurbo load balancer should be 7 instead of 8 on FG-3300E and FG-3301E.

Low IPS HTTP throughput on SoC4 platforms.

FortiOS allows the elimination of interfaces, although it still has a VIP reference used in firewall policies.

FSSO TS-Agent is not working properly when FortiGates use NGFW policy-based mode.

A space after a comma within CN is incorrectly removed during the bind request causing authentication failure (LDAP).

Password displayed as clear text in FortiManager installation log when resetting the system admin user password via FortiManager.

The authd and foauthd processes may crash due to crypto functions being set twice.

FortiGate sent CSR certificate instead of signed certificate to FortiManager when retrieve is performed.

REST API authentication fails for API user with PKI group enabled due to fnbamd crash.

Persistent sessions for de-authenticated FSSO users.

In FG-VM64-HV, 802.1Q does not work on interfaces with DPDK enabled.

ESXi 6.0 gets Kernel panic - not syncing: Attempted to kill init! message.

In FG-VM64-HV, portX: can not set mac address(16). error displayed in console after HA is enabled and all interfaces lose connections.

Merge FIPS ciphers to 6.4.3 and 7.0 trunk (visible to AWS and Azure only).

AWS Fabric connector always uses root VDOM even though it is not a management VDOM.

On FG-AWS, changing health check protocol to tcp-connect causes kernel panic and reboot.

Azure SDN connector filter count is not showing a stable value.

After cloning the OCI instance, the OCID does not refresh to the new OCID.

Should add router policy in vdom-exception list.

Support vfNIC driving for Broadcom 100G NIC.

EIP is not updating properly on FG-VM Azure.

Add URL flow filter counters to SNMP.

User browser gets URL block page instead of warning page when using HTTPS IP URL.

Loopback interface as source IP is not getting applied to FortiGuard web filter rating.

Web filter profile count decreased after upgrading to 6.4.0 on FG-100F.

Unable to get complete output of diagnose test application ipsufd 1.

Custom category action set to allow in web filter profile causes the URL to use the FortiGuard category rather than the custom category.

In the CLI, the WTP profile for radio-2 802.11ac and 80 MHz channels does not match the syntax collection files.

HTTPS server certificate is not presented when WiFi controller feature is disabled in Feature Visibility.

Wireless hostapd daemon crashes upon WPA3-SAE connection.

Spectrum analysis disable/enable command removed in CLI from wtp-profile and causing a bottleneck for APs, such as FAP-222C/223C at 100% CPU.

FG-600E has cw_acd crash with *** signal 8 (Floating point exception) received *** in 6.2.4.

FAP-U431F cannot view what channel is operating, and the override channel setting must be unset to change to a different channel.