Automatic firmware upgrades are enabled by default. When the auto-firmware-upgrade setting is enabled, the FortiGate checks for updates every day between the firmware upgrade time interval. When a newer firmware is found, the installation is scheduled after the upgrade delay in days (0-14, default = 3) between the firmware upgrade time interval. After a successful update, an email is sent to the account owner.

config system fortiguard
    set auto-firmware-upgrade {enable | disable}
    set auto-firmware-upgrade-delay <integer>
end

Where:

• auto-firmware-upgrade is enabled by default upon upgrade.

• auto-firmware-upgrade-delay is set to 3 days by default.

Affected platforms:

FGT-40F, FGT-40F-3G4G, FGT-60E, FGT-60E-DSL, FGT-60E-DSLJ, FGT-60E-POE, FGT-60F, FGT-61E, FGT-61F, FGT-70F, FGT-71F, FGT-80E, FGT-80E-POE, FGT-80F, FGT-80F-BP, FGT-80F-POE, FGT-81E, FGT-81E-POE, FGT-81F, FGT-81F-POE, FGT-90E, FGT-91E, FGR-60F, FGR-60F-3G4G, FGR-70F, FGR-70F-3G4G, FWF-40F, FWF-40F-3G4G, FWF-60E, FWF-60E-DSL, FWF-60E-DSLJ, FWF-60F, FWF-61E, FWF-61F, FWF-80F-2R, FWF-81F-2R, FWF-81F-2R-3G4G-POE, FWF-81F-2R-POE

This release fixes the issue where proxy ARP stops working for a client connected to a dialup IPsec when the previous VPN was established and is deleted.

This fix introduces a correction in the behavior for the following setting:

config vpn ipsec phase2-interface
    edit <name>
        set route-overlap use-new
    next
end

Instead of allowing route-overlapping to occur in the routing table, it now deletes the old route when a duplicate connection is detected.

However, this may also introduce flapping and packet loss when this setting is enabled, and there are multiple dynamic IPsec interfaces configured in redundancy to the same destination with add-route also enabled in Phase1.

In this situation, use set route-overlap allow instead of set route-overlap use-new.

If a DHCP Interface is added as an SD-WAN Member inside an SD-WAN zone, before config static route on SD-WAN zone, FortiOS by default adds a default route with dhcp interface distance in the routing table using the gateway IP information retrieved from the DHCP server. This default route will take precedence over other default routes that have a higher AD.