Improved handling of NAT46 traffic to prevent problems caused by the frame size increase resulting from converting an IPv4 packet to an IPv6 packet.

Resolved an NP7 driver issue that prevented L2TP VPN from working.

Resolved an issue that prevented offloading VXLAN over IPsec traffic.

Resolved syntax check issues that prevented adding valid policy routes that do not have a gateway configured and allowed adding invalid policy routes with no outgoing interface configured.

Resolved an issue that caused NPD process timeouts on the secondary FortiGate in an FGCP cluster after editing a hyperscale firewall policy and changing the CGN IP pool used in the policy.

The GUI now accurately shows that the FortiGate-4200F, 4201F, 4400F, and 4401F ha1, ha2, aux1, and aux2 interfaces are in the same port or interface group.

Resolved an issue that caused the time displayed by the real time clock to be inaccurate. Fortinet recommends enabling NTP to make sure FortiGate system time is accurate.

Resolved an issue that prevented the diagnose npu np7 gtp-stats-all and diagnose npu np7 gtp-stats <np#> commands from displaying output on the primary FortiGate in an FGCP cluster when GTP enhanced mode is enabled.

The diagnose sys npu-session purge command now works as expected to clear all NPU sessions.

The GUI will no longer display an error message when you edit the first port number in a port number range in a CGN resource allocation IP pool.

BGP prefixes are now successfully cleared from the NP7 routing table after they have been removed from the kernel because the peer they point to has gone down.

Resolved an issue that prevented NP7 processors from synchronizing the OSPF FIB when the route update rate is high.

Improved power monitoring to reduce reporting false positives. For example, the FortiGate will now check multiple times if an error is received, and only report an error if the error condition persists.

Resolved an issue that could disrupt traffic when enabling per-IP traffic shaping and max-concurrent-session for a firewall policy with NP7 offloading enabled.

Resolved an issue that could cause inaccurate statistics reporting when the system is processing a large number of sessions.

Resolved an index limit issue that prevented being able to manage a FortiSwitch if the FortiGate is licensed for 500 VDOMs and you have created a large number of VDOMs (for example, over 300).

Resolved an issue that caused the NPD process to crash if a FortiGate is under relatively high traffic load and the configuration includes the maximum number of hyperscale firewall policies, as defined in the maximum values, in multiple VDOMs.

When the SIP session helper is enabled, SIP traffic is offloaded to NP7 processors.

Resolved an issue that could cause SIP ALG traffic to produce PBA leaks and deadlocks.

Resolved an issue that caused hardware sessions to expire on the secondary FortiGate in an FGCP HA cluster.

Changing the configuration of a hardware log server group assigned to a hyperscale firewall policy that is processing traffic no longer causes sessions accepted by the firewall policy to be dropped.

Resolved an issue that caused the system to create unexpected UDP sessions after changing the hardware host logging configuration.

Resolved an issue that caused IPsec VPN sessions between VDOMs to timeout while they are processing traffic.

Resolved an issue that caused session helper sessions to be offloaded to NP7 processors after changing the IP pool in a hyperscale firewall policy.

Resolved an issue that could prevent TFTP ALG sessions from being offloaded to NP7 processors.

Configuring an interface to drop fragmented packets (drop-fragment set to enable) now works as expected.

Resolved an issue that blocked traffic going through a virtual network interface.

Hyperscale firewall systems can now generate system event log messages to report on network processor daemon (NPD) and PLE errors that would otherwise just have been written to the console. Example log message: date=2021-04-28 time=22:18:40 logid="0100053300" type="event" subtype="system" level="warning" vd="root" eventtime=1619673521069002897 tz="-0700" logdesc="NPD INFO" msg=" NPD INIT DONE "

Resolved an issue that could prevent the IP Pool option from appearing in a hyperscale firewall policy.

Sync session count information has been added to the output of the get system ha status command.

Messages similar to NPD vd=x get tmo id=xxxx fail! no longer appear after restoring the configuration.

Resolved an issue that caused the generation of NPD firewall policy offload failed event log messages.

The log rate is no longer displayed as a negative value after changing hardware logging to host logging mode.

Resolved an issue that sometimes causes ICMP logs to be generated for traffic accepted by a hyperscale firewall policy with logging disabled.

SNMP queries of IPv6 hyperscale firewall policies work as expected.

Resolved an issue that was keeping software sessions in the session table after traffic has stopped.

Resolved an issue that caused excessive memory use when adding and deleting BGP routes.

Resolved a memory leak related to hardware logging.