The internet-service6-custom and internet-service6-custom-group options do not work with custom IPv6 addresses.

The GUI-explicit-proxy setting on the System > Feature Visibility page is not retained after a FortiGate reboot or upgrade.

In some cases, the explicit proxy policy list can take a long time to load due to a delay in retrieving the proxy statistics. This issue does not impact explicit proxy functionality.

Workaround: restart the WAD process, or update the number of WAD processors.

config system global
    set wad-worker-count <integer>
end

The clock skew tolerance is not reflected.

The DHCPv6 client does not work with vcluster2.

Existing ARP entries are removed from all slots when an ARP query of a single slot does not respond.

IPv6 ECMP is not supported for the FG-6000F and FG-7000E platforms. IPv6 ECMP is supported for the FG-7000F platform.

A permanent MAC address is used instead of an HA virtual MAC address during automation.

Graceful upgrade of a FortiGate 6000 or 7000 FGCP HA cluster is not supported when upgrading from FortiOS 7.0.12 to 7.2.6.

Upgrading the firmware of a FortiGate 6000 or 7000 FGCP HA cluster from 7.0.12 to 7.2.6 should be done during a maintenance window, since the firmware upgrade process will disrupt traffic for up to 30 minutes.

Before upgrading the firmware, disable uninterruptible-upgrade, then perform a normal firmware upgrade. During the upgrade process the FortiGates in the cluster will not allow traffic until all components (management board and FPCs or FIMs and FPMs) are upgraded and both FortiGates have restarted. This process can take up to 30 minutes.

SLBC for FortiOS 7.0 and 7.2 uses different FGCP HA heartbeat formats. Because of the different heartbeat formats, you cannot create an FGCP HA cluster of two FortiGate 6000s or 7000s when one chassis is running FortiOS 7.0.x and the other is running FortiOS 7.2.x. Instead, to form an FGCP HA cluster, both chassis must be running FortiOS 7.0.x or 7.2.x.

If two chassis are running different patch releases of FortiOS 7.0 or 7.2 (for example, one chassis is running 7.2.5 and the other 7.2.6), they can form a cluster. When the cluster is formed, FGCP elects one chassis to be the primary chassis. The primary chassis synchronizes its firmware to the secondary chassis. As a result, both chassis will be running the same firmware version.

You can also form a cluster if one chassis is running FortiOS 7.2.x and the other is running 7.4.x.

For best results, both chassis should be running the same firmware version, although as described above, this is not a requirement.

Image synchronization failure happened after a factory reset on FortiGate 7000E/F .

Under normal conditions, a FortiGate 6000 or 7000 may generate event log messages due to a known issue with a feature added to FortiOS 7.2 and 7.4. The feature is designed to create event log messages for certain DP channel traffic issues but also generates event log messages when the DP processor detects traffic anomalies that are part of normal traffic processing. This causes the event log messages to detect false positives that don't affect normal operation.

For example, DP channel 15 RX drop detected! messages can be created when a routine problem is detected with a packet that would normally cause the DP processor to drop the packet.

Similar discard message may also appear if the DP buffer is full.

On FortiGate 7000F using FGSP and FGCP, when TCP traffic takes an asymmetric path, the TCP ACK and data packets might be dropped in NP7.

Incorrect SLBC traffic-related statistics may be displayed on the FortiGate 6000 or FortiGate 7000 GUI (for example, in a dashboard widgets). This can occur if an FPC or FPM is not correctly registered for statistic collection during startup. This is purely a GUI display issue and does not impact system operation.

To work around this display issue, enter the command diagnose nodejs process restart to reset the aggregator. You may need to wait for a few minutes after the system has started up before entering this command to make sure that all systems have fully initialized.

On the View/Edit Entries slide-out pane (Policy & Objects > Internet Service Database dialog), users cannot scroll down to the end if there are over 100000 entries.

On the policy list page, all policy organization with sequence and label grouping is lost.

FortiGate GUI should display a license expired notification due to an expired FortiManager Cloud license if it still has a valid account level FortiManager Cloud license (function is not affected).

The address objects page is not loading the content.

When workspace configuration save mode is set to manual in the System > Settings, configuration changes made on the primary unit and then saved do not synchronize with the secondary unit when one of the cluster units are rebooted or shutdown after the change.

Workaround: set the workspace configuration mode to automatic.

FortiGate in A-P HA mode with admin-restrict-local enabled allows the local administrator to log in to the passive host, even if LDAP is available.

When Configuration save mode is set to Manual, any firewall policy change will make the cluster out-of-sync.

SCTP traffic is not forwarded back to the session owner (FGSP asymmetric traffic with IPS , NAT mode, and SCTP).

On the Fabric Management page, the HA Secondary lists both primary and secondary FortiGate units.

When the HA management interface is set a LAG, it is not synchronized to newly joining secondary HA devices.

A secondary HA unit may go into conserve mode when joining an HA cluster if the FortiGate's configuration is large.

After successfully changing the VLAN ID of an interface from the CLI, an error message similar to cmdb_txn_cache_data(query=log.npu-server,leve=1) failed may appear.

NPD/LPMD cannot differentiate the different VRF's, considers as VRF 0 for all.

ECMP does not load balance IPv6 traffic between two routes in a multi-VDOM setup.

Output of diagnose sys npu-session list/list-full does not mention policy route information.

Packets drop, and different behavior occurs between devices in an HA pair with ECMP next hop.

The diagnose sys npu-session list command shows an incorrect policy ID when traffic is using an intra-zone policy.

NAT46 NPU sessions are lost and traffic drops when a HA failover occurs.

Connections per second (CPS) performance of SIP sessions accepted by hyperscale firewall policies with EIM and EIF disabled that include overload with port block allocation (PBA) GCN IP pools is lower than expected.

Workaround: enter the following command for each NP7 processor to resolve the performance issue.

# diagnose npu np7 setreg <npu_#> nss.nss_thrd_ctrl.thrd_ctrl 0xF

Where <npu_#> is the NP7 processor number. NP7 processors are numbered 0, 1, 2, and so on.

The configuration changes from entering these diagnose commands are reset if the FortiGate restarts. After a system restart, just re-enter the diagnose commands.

CPU usage issues occurred when IPsec VPN traffic was received on the VLAN interface of an NP7 vlink.

Disk logging files are cached in the kernel, causing high memory usage.

Fixed in FortiOS 7.2.8: Issue with Disk log has rolled case.

The following intrusion was observed: in the alert mail refers to another field in the anomaly log.

CPU usage issue in WAD caused by a high number of devices being detected by the device detection feature.

In an HA setup with vCluster, a CMDB API request to the primary cluster does not synchronize the configuration to the secondary cluster.

SD-WAN interfaces should be denoted in the interface statistics API.

SD-WAN members can be out-of-sla after some retrieve times.

The diagnose ip rtcache list command is no longer supported in the FortiOS 4.19 kernel.

Router information in the BGP summary still shows removed BGP neighbor/peer configuration.

On the Network > SD-WAN > SD-WAN Rules page, member interfaces that are down are incorrectly shown as up. The tooltip on the interface shows the correct status.

FortiClient Windows cannot be launched with SSL VPN web portal.

SSL VPN users are dropped due the samld process stopping.

Japanese key input does not work correctly during RDP in SSL VPN web mode.

The FortiSwitch topology is not loading correctly on the GUI.

The FortiGate GUI shows incorrect port statuses for managed FortiSwitches.

An interface in FortiLink is flapping with MCLAG with DAC on an OPSFPP-T-05-PAB transceiver.

Traffic going through a VLAN over VXLAN is not offloaded to NP7.

execute ping-option interface cannot specific an interface name of a.

LAG interface members are not shutting down when the remote end interface (one member in the LAG) is down.

Control the server host key algorithm in the CLI.

Status light is not showing on the FortiGate 60F or 100F after a cold and warm reboot.

Setting the interface configuration inbandwidth or outbandwidth commands stops traffic flow.

In a certain edge case, traffic directed towards a VLAN interface could trigger a kernel panic.

GUI is inaccessible when using a SHA1 certificate as admin-server-cert.

On the FortiGate 601F, the ports (x7) have no cables attached but the link LEDs are green.

On the Network > Interfaces page, hardware and software switches show VLAN interfaces as down instead of up. The actual status of the VLAN interface can be verified using the command line.

SNMP walk of the entire MIB fails when the configuration has split-port and a large number of interfaces.

DAC cable between FortiGate and FortiSwitch stops working after upgrading from 7.2.6 to 7.2.7.

On FortiOS, administrator accounts using upd-read-write cannot open the FortiGuard page.

Some FortiGate models on NP6/NP6Lite/NP6xLite platforms experience kernel panics due to certain traffic conditions after upgrading to 7.2.8. Traffic may be interrupted momentarily.

Workaround: Users impacted by this issue can contact Fortinet Support to request a special build with a fix for this issue. Alternatively, users can disable the processing of traffic by the IPS engine’s nTurbo using the following command:

config ips global
    set np-accel-mode none
end

When upgrading multiple firmware versions in the GUI, the Follow upgrade path option does not respect the recommended upgrade path.

When a remote LDAP user with Two-factor Authentication enabled and Authentication type 'FortiToken' tries to access the internet through firewall authentication, the web page does not receive the FortiToken notification or proceed to authenticate the user.

Workaround: click the Continue button on the authentication page after approving the FortiToken on the mobile device.

The FortiGate does not send the user's IP address to the TACACS+ server during an authorization request.

When there are over 5000 firewall users, the minimized Firewall Users widget on the dashboard does not display the donut chart or number of users. Expanding the widget to full screen displays all users.

If FGTVM was deployed in UEFI boot mode, do not downgrade to any GA version earlier than 7.2.4.

HTTP session is logged as HTTPS in web filter when VIP is used.

The layer 3 roaming feature may not work when the wireless controller is running multiple cw_acd processes (when the value of acd-process-count is not zero).

CAPWAP tunnel traffic over tunnel SSID is dropped when offloading is enabled.

The Automatically connect to nearest saved network option does not work as expected when FWF-60E client-mode local radio loses connection.

Physical and logical topology is slow to load when there are a lot of managed FortiAP (over 50). This issue does not impact FortiAP management and operation.

Excessive MEM POOLuse_up_cnt observed on secondary unit in an HA environment.

Managed FortiSwitch detects multiple MACs using the same IP address.

Intermittent traffic disruption observed in cw_acd caused by a rare error condition.