On the System > FortiGuard page, the override FortiGuard server for AntiVirus & IPS Updates shows an Unknown status, even if the server is working correctly. This is a display issue only; the override feature is working properly.

On the Network > Interfaces page when VDOM mode is enabled, the Global view incorrectly shows the status of IPsec tunnel interfaces from non-management VDOMs as up. The VDOM view shows the correct status.

On the Policy & Objects > Firewall Policy page, the policy list can take around 30 seconds or more to load when there is a large number (over 20 thousand) of policies.

Workaround: use the CLI to configure policies.

When an administrator ends a session by closing the browser, the administrator timeout event is not logged until the next time the administrator logs in.

System > Certificates list sometimes shows an incorrect reference count for a certificate, and incorrectly allows a user to delete a referenced certificate. The deletion will fail even though a success message is shown. Users should be able to delete the certificate after all references are removed.

When using the SSL VPN web portal in the Firefox, users cannot paste text into the SSH terminal emulator.

Workaround: use Chrome, Edge, or Safari as the browser.

When a FortiGate is managed by FortiManager with FortiWLM configured, the HTTPS daemon may crash while processing some FortiWLM API requests. There is no apparent impact on the GUI operation.

Unable to reuse link local or multicast IPv6 addresses for multiple interfaces from the GUI.

Workaround: use the CLI.

When LDAP server settings involve FQDN, LDAPS, and an enabled server identity check, the following LDAP related GUI items do not work: LDAP setting dialog, LDAP credentials test, and LDAP browser.

GUI incorrectly displays a warning saying there is not a valid upgrade path when upgrading firmware from 7.0.0 or 7.0.1 to 7.0.1 or 7.0.2.

On a mobile phone, the WiFi captive portal may take longer to load when the default firewall authentication login template is used and the user authentication type is set to HTTP.

Workaround: edit the login template to disable HTTP authentication or remove the href link to googleapis.

The Device Inventory widget shows no results when there are two user_info parameters.

Workaround: use the CLI to retrieve the device list.

On the Log & Report > Forward Traffic page, filtering by the Source or Destination column with negation on the IP range does not work.

When creating a new (public or private) SDN connector, users are unable to specify an Update interval that contains 60, as it will automatically switch to Use Default.

An IPsec phase 1 interface with a name that contains a / cannot be deleted from the GUI. The CLI must be used.

Static IPsec tunnel with signature authentication method cannot be established on FIPS-CC mode FortiGate because the certificate subject verification changes to RDN bitwise comparison based.

SD-WAN service traffic will be interrupted after upgrading to 7.0.1 if all of the following conditions are matched in its 6.4.x configuration:

• Using set gateway enable in a particular SD-WAN service

• Having mode-cfg configured

• Not having ADVPN configured on the hub

Workaround: Before upgrading, update the hub and spoke configurations as follows:

• On the hub, enable the exchange-interface-ip option on the dial-up phase1 interface with mode-cfg configured.

• On the spoke, enable auto-discovery-receiver on the related phase1 interface.

FortiOS 7.0 has new design for dialup VPN (no more route tree in the IPsec tunnel), so traffic might not traverse over the dialup IPsec VPN after upgrading from FortiOS 6.4.6 to 7.0.1, 7.0.2, or 7.0.3 if the server replies on the static route over the dynamic tunnel interface to route the traffic back to the client.

Workaround: configure the src-subnet on the client phase 2 interface. Then, static routes will be added by IKE on the server side (add-route enable is required).

config vpn ipsec phase2-interface
    edit <name>
        set src-subnet <x.x.x.x/x>
    next
end

Crash seen in WAD user information daemon when updating user group count upon user log off.

An error case occurs in WAD while handling the HTTP requests for an explicit proxy policy.

Security rating for Local Log Disk Not Full reporting as failed for FortiGate models without log disks.

Dashboard Security Fabric widget takes a long time to load in the GUI.

In some conditions, the web mode JavaScript parser will encounter an infinite loop that will cause SSL VPN crashes.

A large number of detected devices causes httpsd to consume resources, and causes entry-level devices to enter conserve mode.

TCP 8008 permitted by authd, even though the service in the policy does not include that port.

A DNS proxy crash occurs during ssl_ctx_free.

NTurbo does not work with EMAC VLAN interface.

DHCP discovery dropped on virtual wire pair when UTM is enabled.

Random LTE modem disconnections due to certain carriers getting unstable due to WWAN modem USB speed under super-speed.

DST_Root_CA_X3 certificate is expired.

Workaround: see the Fortinet PSIRT blog, https://www.fortinet.com/blog/psirt-blogs/fortinet-and-expiring-lets-encrypt-certificates, for more information.

After updating the FSSO DC agent to version 5.0.0301, the DC agent keeps crashing on Windows 2012 R2 and 2016, which causes lsass.exe to reboot.