Producent oprogramowania udostępnił najnowszą aktualizację dla FortiOS o oznaczeniu 7.0.11. Dzięki aktualizacji, został naprawiony problem z integracją FortiClient EMS, gdzie system tracił autoryzację połączenia. Ponadto, został poprawiony tryb web dla modułu SSL-VPN, gdzie wiele błędów było związane z wyświetlaniem zakładek. Od wersji 7.0.11, został poprawiony proces WAD, który powodował błędne działanie systemu również skorygowano błąd dotyczący urządzeń 61F, gdzie po aktualizacji systemu tunele IPsec nie były widoczne na urządzeniu. Po więcej informacji, zapraszam do dalszej części materiału.
Aktualnie wspierane modele:
| FortiGate | FG-40F, FG-40F-3G4G, FG-60E, FG-60E-DSL, FG-60E-DSLJ, FG-60E-POE, FG-60F, FG-61E, FG-61F, FG-70F, FG-71F, FG-80E, FG-80E-POE, FG-80F, FG-80F-BP, FG-80F-POE, FG-81E, FG-81E-POE, FG-81F, FG-81F-POE, FG-90E, FG-91E, FG-100E, FG-100EF, FG-100F, FG-101E, FG-101F, FG-140E, FG-140E-POE, FG-200E, FG-200F, FG-201E, FG-201F, FG-300E, FG-301E, FG‑400E, FG-400E-BP, FG-400F, FG-401F, FG‑401E, FG‑500E, FG-501E, FG-600E, FG-601E, FG-600F, FG-601F, FG-800D, FG‑900D, FG-1000D, FG-1100E, FG-1101E, FG‑1200D, FG-1500D, FG-1500DT, FG-1800F, FG-1801F, FG-2000E, FG-2200E, FG-2201E, FG-2500E, FG-2600F, FG-2601F, FG-3000D, FG-3000F, FG-3001F, FG-3100D, FG‑3200D, FG-3300E, FG-3301E, FG-3400E, FG-3401E, FG-3500F, FG-3501F, FG-3600E, FG-3601E, FG-3700D, FG-3800D, FG-3960E, FG‑3980E, FG-4200F, FG-4201F, FG-4400F, FG-4401F, FG-5001E, FG‑5001E1 |
| FortiWiFi | FWF-40F, FWF-40F-3G4G, FWF-60E, FWF-60E-DSL, FWF-60E-DSLJ, FWF-60F, FWF-61E, FWF-61F, FWF-80F-2R, FWF-81F-2R, FWF-81F-2R-POE, FWF-81F-2R-3G4G-POE |
| FortiGate Rugged | FGR-60F, FGR-60F-3G4G |
| FortiFirewall | FFW-3980E, FFW-VM64, FFW-VM64-KVM |
| FortiGate VM | FG-ARM64-AWS, FG-ARM64-KVM, FG-ARM64-OCI, FG-VM64, FG-VM64-ALI, FG-VM64-AWS, FG-VM64-AZURE, FG‑VM64‑GCP, FG-VM64-HV, FG-VM64-IBM, FG-VM64-KVM, FG‑VM64‑OPC, FG‑VM64-RAXONDEMAND, FG-VM64-SVM, FG-VM64-VMX, FG-VM64-XEN |
| Pay-as-you-go images | FOS-VM64, FOS-VM64-HV, FOS-VM64-KVM, FOS-VM64-XEN |
Rozwiązane problemy:
Anti Virus
| Bug ID | Description |
|---|---|
| 818092 | CDR archived files are deleted at random times and not retained. |
| 845960 | Flow mode opens port 8008 over the AV profile that does not have HTTP scan enabled. |
| 849020 | FortiGate enters conserve mode and the console prints a fork() failed message. |
Data Leak Prevention
| Bug ID | Description |
|---|---|
| 873608 | DLP blocking of SMB traffic gives unreliable results. |
Endpoint Control
| Bug ID | Description |
|---|---|
| 834168 | FortiGates get deauthorized on EMS. |
Explicit Proxy
| Bug ID | Description |
|---|---|
| 823319 | Authentication hard timeout is not respected for firewall users synchronized from WAD user. |
| 842016 | Client gets 304 response if a cached object has varying headers and is expired. |
| 849794 | Random websites are not accessible with proxy policy after upgrading to 6.4.10. |
| 865135 | Multipart boundary parsing failed with CRLF before the end of boundary 1. |
Firewall
| Bug ID | Description |
|---|---|
| 728734 | The VIP group hit count in the table (Policy & Objects > Virtual IPs) is not reflecting the correct sum of VIP members. |
| 794901 | Unable to create a geography type address object and get a Can not be geography address when it is a member of addrgrp used by ipsec_tunnel! error. |
| 816493 | The set sub-type ems-tag option is blocked in HA diff installation. |
| 835413 | Inaccurate sFlow interface data reported to PRTG after upgrading to 7.0. |
| 840689 | Virtual server aborts connection when ssl-max-version is set to tls-1.3. |
| 847086 | Unable to add additional MAC address objects in an address group that already has 152 MAC address objects. |
| 852714 | Making a full HTTP session is sometimes bypassed if ssl-hsts is enabled for a server-load-balance VIP. |
| 854901 | Full cone NAT (permit-any-host enable) causes TCP session clash. |
| 856187 | Explicit FTPS stops working with IP pool after upgrading. |
| 860480 | FG-3000D cluster kernel panic occurs when upgrading from 7.0.5 to 7.0.6 and later. |
| 861990 | Increased CPU usage in softIRQ after upgrading from 7.0.5 to 7.0.6. |
| 865661 | Standard and full ISDB sizes are not configurable on FG-101F. |
| 875565 | The policy or other cache lists are sometimes not freed in time. This may cause unexpected policies to be stored in the cache list. |
FortiView
| Bug ID | Description |
|---|---|
| 804177 | When setting the time period to the now filter, the table cannot be filtered by policy type. |
GUI
| Bug ID | Description |
|---|---|
| 722358 | When a FortiGate local administrator is assigned to more than two VDOMs and tries logging in to the GUI console, they get a command parse error when entering VDOM configuration mode. |
| 753328 | Incorrect shortcut name shown on the Network > SD-WAN > Performance SLAs page. |
| 773258 | FortiAP icon cannot be moved once placed on the WiFi map. |
| 833306 | Intermittent error, Failed to retrieve FortiView data, appears on real-time FortiView Sources and FortiView Destination monitor pages. |
| 837836 | The Network > Interfaces faceplate shows two SFP interfaces, which do not exist on that FortiGate model. |
| 845513 | On G-model profiles, changing the platform mode change from single 5G (dedicated scan enabled) to dual 5G is not taking effect. |
| 853414 | Dashboard widgets are not loading when the FortiGate manages FortiSwitch with tenant ports (exported from root to other VDOM). |
| 867589 | Local VDOM administrator randomly sees a blank white page after logging in with the interface that belongs to the VDOM. |
| 869138 | Unable to select addresses in FortiView monitors. |
| 870675 | CLI console in GUI reports Connection lost. when the administrator has more than 100 VDOMs assigned. |
| 872064 | Creating a monitor from a dashboard widget in a non-root VDOM incorrectly uses the root VDOM. |
HA
| Bug ID | Description |
|---|---|
| 662978 | Long lasting sessions are expired on HA secondary device with a 10G interface. |
| 777394 | Long-lasting sessions expire on the HA secondary in large session synchronization scenarios. |
| 810175 | set admin-restrict-local is not working for SSH. |
| 813207 | Virtual MAC address is sent inside GARP by the secondary unit after a reboot. |
| 818432 | When private data encryption is enabled, all passwords present in the configuration fail to load and may cause HA failures. |
| 830879 | Running execute ha manage 0 <remote_admin> fails and displays a Permission denied, please try again. error if the 169.254.0.0/16 local subnet is not in the trusted host list. |
| 835331 | Communication is disrupted when HA switching is performed in an environment where the VDOM is split to accommodate two IPoE lines. |
| 837888 | CLI deployment of a configuration to the secondary unit results in an unresponsive aggregate interface. |
| 840305 | Static ARP entry is removed after reboot or HA failover. |
| 853900 | The administrator password-expire calculation on the primary and secondary returns a one-second diff, and causes HA to be out-of-sync. |
| 854445 | When adding or removing an HA monitor interface, the link failure value is not updated. |
| 856004 | Telnet connection running ping fails during FGSP failover for virtual wire pair with VLAN traffic. |
| 856643 | FG-500E interface stops sending IPv6 RAs after upgrading from 7.0.5 to 7.0.7. |
| 860497 | Output of diagnose sys ntp status is misleading when run on a secondary cluster member. |
| 864226 | FG-2600F kernel panic occurs after a failover on both members of the cluster. |
| 885844 | HA shows as being out-of-sync after upgrading due to a checksum mismatch for endpoint-control fctems. |
Hyperscale
| Bug ID | Description |
|---|---|
| 807476 | After packets go through host interface TX/RX queues, some packet buffers can still hold references to a VDOM when the host queues are idle. This causes a VDOM delete error with unregister_vf. If more packets go through the same host queues for other VDOMs, the issue should resolve by itself because those buffers holding the VDOM reference can be pushed and get freed and recycled. |
| 824733 | IPv6 traffic continues to pass through a multi-VDOM setup, even when the static route is deleted. |
| 877696 | Get KTRIE invalid node related error and kernel panic on standby after adding a second device into A-P mode HA cluster. |
Intrusion Prevention
| Bug ID | Description |
|---|---|
| 845944 | Firewall policy change causes high CPU spike with IPS engine. |
IPsec VPN
| Bug ID | Description |
|---|---|
| 726326, 745331 | IPsec server with NP offloading drops packets with an invalid SPI during rekey. |
| 765174 | Certain packets are causing IPsec tunnel drops on NP6XLite platforms after HA failover because the packet is not checked properly. |
| 798045 | FortiGate is unable to install SA (failed to add SA, error 22) when there is an overlap in configured selectors. |
| 810833 | IPsec static router gateway IP is set to the gateway of the tunnel interface when it is not specified. |
| 822651 | NP dropping packet in the incoming direction for SoC4 models. |
| 842571 | If mode-cfg is used, a race condition can result in an IP conflict and sporadic routing problems in an ADVPN/SD-WAN network. Connectivity can only be restored by manually flushing the IPsec tunnels on affected spokes. |
| 848014 | ESP tunnel traffic hopping from VRF. |
| 855772 | FortiGate IPsec tunnel role could be incorrect after rebooting or upgrading, and causes negotiation to be stuck when it comes up. |
| 858715 | IPsec phase 2 fails when both HA cluster members reboot at the same time. |
| 869166 | IPsec tunnel does not coming up after the upgrading firmware on the branch FortiGate (FG-61E). |
| 873097 | Phase 2 not initiating the rekey at soft limit timeout on new kernel platforms. |
| 876795 | RADIUS server will reject new authentication if a previous session is missing ACCT-STOP to terminate the session, which causes the VPN connection to fail. |
Log & Report
| Bug ID | Description |
|---|---|
| 838357 | A deny policy with log traffic disabled is generating logs. |
| 860264 | The miglogd process may send empty logs to other logging devices. |
| 873987 | High memory usage from miglogd processes even without traffic. |
| 850519 | Log & Report > Forward Traffic logs do not return matching results when filtered with !<application name>. |
Proxy
| Bug ID | Description |
|---|---|
| 746587 | WAD crashes during traffic scan in proxy mode. |
| 769955 | WAD process crashes (signal 11) with disclaimer and user authentication being applied to the web proxy. |
| 781613 | WAD crash occurs four times on FG-61F during stress testing. |
| 818371 | WAD process crashes with some URIs. |
| 823078 | WAD user-info process randomly consumes 100% CPU of one core. |
| 825977 | WAD crash occurs on FG-101F during stress testing. |
| 834387 | In a firewall proxy policy, the SD-WAN zone assigned to interface is not checked. |
| 835745 | WAD process is crashing after upgrading to FortiOS 7.2.1. |
| 843318 | If a client sends an HTTP request for a resource which is not yet cached by the FortiGate and the request header contains Cache-Control: only-if-cached, then the WAD worker process will crash with signal 11. |
| 855853 | WAD crashes frequently and utilizes high CPU. |
| 855882 | Increase in WAD process memory usage after upgrading. |
| 856235 | The WAD process memory usage gradually increases over a few days, causing the FortiGate to enter into conserve mode. |
| 857368 | WAD crash with signal 11 caused by a stack allocated buffer overflow when parsing Huffman-encoded HTTP header name if the header length is more than 256 characters. |
Routing
| Bug ID | Description |
|---|---|
| 618684 | When HA failover is performed to the other cluster member that is not able to reach the BFD neighbor, the BFD session is down as expected but the static route is present in the routing table. |
| 708904 | No IGMP-IF for ifindex log points to multicast enabled interface. |
| 809321 | IS-IS LSP packets do not include the checksum and the authentication key ([Checksum: [missing]], [Checksum Status: Not present] and authentication "hmac-md5 (54), message digest]). |
| 816582 | IPv6 connected subnet in VRF, other than VRF 0, gets an RPF failure after HA failover. |
| 846107 | IPv6 VRRP backup is sending RA, which causes routing issues. |
| 847037 | When the policy route has a set gateway, the FortiGate is not following the policy route to forward traffic and sends unreasonable ARP requests. |
| 848270 | Reply traffic from the DNS proxy (DNS database) is choosing the wrong interface. |
| 848310 | IPsec traffic sourced from a loopback interface does not follow the policy route or SD-WAN rules. |
| 850862 | GUI does not allow an AS path to be to configured with multiple similar AS numbers. |
| 852525 | When enabled, FEC is not effectively reducing packet loss when behind NAT. |
| 860075 | Traffic session is processed by a different SD-WAN rule and randomly times out. |
| 862165 | FortiGate does not add the route in the routing table when it changes for SD-WAN members. |
| 862418 | Application VWL crash occurs after FortiManager configuration push causes an SD-WAN related outage. |
| 862573 | SD-WAN GUI does not load, and the lnkmtd process crashes frequently. |
| 865914 | When BSM carries multiple CRPs, PIM might use the incorrect prefix to update the mroute’s RP information. |
Security Fabric
| Bug ID | Description |
|---|---|
| 798795 | API that registers appliances to the Fabric stopped working. |
| 801048 | During the FortiOS initialization process, there is a small chance that other services using UDP take the specific port that caused csfd initialization to fail. |
| 814674 | Failed to retrieve upgrade progress message appears when upgrading a FortiAP or FortiSwitch that is connected to a downstream FortiGate. |
| 835765 | Automation stitch trigger is not working when the threshold based email alert is enabled in the configuration. |
| 839258 | Unable to add another FortiGate to the Security Fabric after updating to the latest patch. |
| 870527 | FortiGate cannot display more than 500 VMs in a GCP dynamic address. |
SSL VPN
| Bug ID | Description |
|---|---|
| 746230 | SSL VPN web mode cannot display certain websites that are internal bookmarks. |
| 748085 | Authentication request of SSL VPN realm can now only be sent to user group, local user, and remote group that is mapped to that realm in the SSL VPN settings. The authentication request will not be applied to the user group and remote group of non-realm or other realms. |
| 783167 | Unable to load GitLab through SSL VPN web portal. |
| 803576 | Comments in front of <html> tag are not handled well in HTML file in SSL VPN web mode. |
| 808107 | FortiGate is not sending Accounting-Request packet that contains the Interim-Update AVP when two-factor authentication is assigned to a user (defined on the FortiGate) while connecting using SSL VPN. |
| 810239 | Unable to view PDF files in SSL VPN web mode. |
| 819754 | Multiple DNS suffixes cannot be set for the SSL VPN portal. |
| 825750 | VMware vCenter bookmark in not working after logging in to SSL VPN web mode. |
| 825810 | SSL VPN web mode is unable to access EMS server. |
| 828194 | SSL VPN stops passing traffic after some time. |
| 831069 | A blank page displayed after logging in to the back-end server in SSL VPN web mode. |
| 848067 | RDP over VPN SSL web mode stops work after upgrading. |
| 850898 | OS checklist for the SSL VPN in FortiOS does not include macOS Ventura (13). |
| 852566 | User peer feature for one group to match to multiple user peers in the authentication rules is broken. |
| 854143 | Unable to access Synology NAS server through SSL VPN web mode. |
| 854642 | Internal website with JavaScript is proxying some functions in SSL VPN web mode, which breaks them. |
| 863860 | RDP over SSL VPN web mode to a Windows Server changes the time zone to GMT. |
| 864096 | EcoStruxure Building Operations 2022 does not render using SSL VPN bookmark. |
| 864417 | In the second authentication of RADIUS two-factor authentication, the acct-update-interval returned is 0. SSL VPN uses the second return and not send RADIUS acct-interim-update packet. |
| 876683 | SSL VPN web mode has issue accessing specific URL, https://gt***.si***.fr. |
| 877896 | When accessing the VDOM’s GUI in SSL VPN web mode, policies are only shown for a specific VDOM instead of all VDOMs. |
Switch Controller
| Bug ID | Description |
|---|---|
| 762615, 765283 | FortiLink flcfgd crash occurs when pushing all configurations to FortiSwitch, which includes quarantined MACs. |
| 857778 | VLAN changes on FortiGate are pushed to FortiSwitch, but they are not taking effect. |
| 876021 | FortiLink virtually managed switch port status is not getting pushed after the FortiGate reboots. |
System
| Bug ID | Description |
|---|---|
| 550701 | WAD daemon signal 11 causes cmdbsvr deadlock. |
| 649729 | HA synchronization packets are hashed to a single queue when sync-packet-balance is enabled. |
| 700621 | The forticron daemon is constantly being restarted. |
| 722273 | SA is freed while its timer is still pending, which leads to a kernel crash. |
| 724085 | Traffic passing through an EMAC VLAN interface when the parent interface is in another VDOM is blocked if NP7 offloading is enabled. If auto-asic-offload is disabled in the firewall policy, then the traffic flows as expected. |
| 757482 | When fastpath is disabled, counters in the dashboard are showing 0 bytes TX/RX for a VLAN interface configured on an LACP interface. |
| 778794 | Incorrect values in NP7/hyperscale DoS policy anomaly logs. For packet rate-based meter log, the repeated numbers do not reflect the amount of dropped packets for a specific anomaly/attack; for the session counter meter log, the pps number is negative. |
| 784169 | When a virtual switch member port is set to be an alternate by STP, it should not reply with ARP; otherwise, the connected device will learn the MAC address from the alternate port and send subsequent packets to the alternate port. |
| 795104 | A member of an LAG interface is not coming up due to a different actor key. |
| 799487 | The debug zone uses over 400 MB of RAM. |
| 799570 | High memory usage occurs on FG-200F. |
| 807629 | NP7 dos-offload triggers an established TCP session to have synproxy process issues. |
| 810137 | Scheduled speed test crash is caused by adding the same object to a list twice. |
| 813162 | Kernel panic occurs after traffic goes through IPsec VPN tunnel and EMAC VLAN interface. |
| 813607 | LACP interfaces are flapping after upgrading to 6.4.9. |
| 815937 | FCLF8522P2BTLFTN transceiver is not working after upgrade. |
| 818452 | The ifLastChange SNMP OID only shows zeros. |
| 819667 | 1G copper SFP port is always up on FG-260xF. |
| 819724 | LTE fails to connect after the firewall reboots. Multiple reboots are required to bring back connectivity. |
| 824543 | The reply-to option in the email server settings is no longer visible in a default server configuration on FortiOS 7.2.0. |
| 826490 | NP7 platforms may reboot unexpectedly when unable to handle kernel null pointer de-reference. |
| 827240 | FortiGate in HA may freeze and reboot. Before the reboot, softIRQ may be seen as high. This leads to a kernel panic. |
| 827241 | Unable to resolve sp***.saas.ap***.com on a specific VDOM. |
| 833062 | FortiGate becomes unresponsive, and there are many WAD and forticron crashes. |
| 840960 | When kernel debug level is set to >=KERN_INFO on NP6xLite platforms, some tuples missing debug messages may get flooded and cause the system ti get stuck. |
| 841932 | The GUI and API stopped working after loading many interfaces due to httpsd stuck in a D state (kernel I/O socket). |
| 845736 | After rebooting the FortiGate, the MTU value on the VXLAN interface was changed. |
| 845781 | Kernel panic and regular reboots occur on NP7 platforms, which are caused by FortiOS trying to offload a receiving ESP packet from the EMAC VLAN interface and convert to an IPv6 destination address with NAT46 NPU offloaded sessions. |
| 847077 | Can't find xitem. Drop the response. error appears for DHCPOFFER packets in the DHCP relay debug. |
| 847314 | NP7 platforms may encounter random kernel crash after reboot or factory reset. |
| 849186 | Unexpected console error appears: unregister_netdevice: waiting for pim6reg1 to become free. Usage count = 3. |
| 850683 | Console keeps displaying bcm_nl.nr_request_drop ... after the FortiGate reboots because of the cfg-save revert setting under config system global. Affected platforms: FG-10xF and FG-20xF. |
| 850688 | FG-20xF system halts if setting cfg-save to revert under config system global and after the cfg-revert-timeout occurs. |
| 853144 | Network device kernel null pointer is causing a kernel crash. |
| 853794 | Issue with the server_host_key_algorithm compatibility when using SSH on SolarWinds. |
| 853811 | Fortinet 10 GB transceiver LACP flapping when shut/no shut was performed on the interface from the switch side. |
| 854388 | Configuring set src-check disable is not persistent in the kernel after rebooting for GRE interfaces. |
| 855573 | False alarm of the PSU2 occurs with only one installed. |
| 856202 | Random reboots and kernel panic on NP7 cluster when the FortiGate sends a TCP RST packet and IP options are missing in the header. |
| 858633 | When any 10 Gigabit (SFP+) port is connected a switch, all configurations related to the 10 Gigabit ports is removed (trunks) when traffic is flowing upon boot. Affected platforms: FG-40xF, FG-60xF, FG-300xF. |
| 859717 | The FortiGate is only offering the ssh-ed25519 algorithm for an SSH connection. |
| 860385 | IPv6 BGP session drops when passing through a FortiGate configured with VRF. |
| 861144 | execute ping-option interface cannot specific an interface name of a. |
| 868225 | After a cold reboot (such as a power outage), traffic interfaces may not come up with a possible loss of VLAN configurations. |
| 869599 | Forticron memory is leaking. |
| 870381 | Memory corruption or incorrect memory access when processing a bad WQE. |
| 873805 | CPSS usage goes to 99% and causes initiation issues when traffic is flowing upon boot. Affected platforms: FG-40xF, FG-60xF, FG-300xF. |
| 877154 | FortiGate with new kernel crashes when starting debug flow. |
| 877240 | Get zip conf file failed -1 error message when running a script configuring the FortiGate. |
| 880290 | NP7 is not configured properly when the ULL ports are added to LAG interface, which causes accounting on the LAG to not work. |
Upgrade
| Bug ID | Description |
|---|---|
| 850691 | The endpoint-control fctems entry 0 is added after upgrading from 6.4 to 7.0.8 when the FortiGate does not have EMS server, which means the endpoint-control fctems feature was not enabled previously. This leads to a FortiManager installation failure. |
| 854550 | After upgrading to 7.0.8, replacemsg utm parameters are not taken over and revert to the default. Affected replacement messages under config system replacemsg utm: virus-html, virus-text, dlp-html, dlp-text, and appblk-html. |
User & Authentication
| Bug ID | Description |
|---|---|
| 751763 | When MAC-based authentication is enabled, multiple RADIUS authentication requests may be sent at the same time. This results in duplicate sessions for the same device. |
| 835859 | Incorrect source MAC address is used in LLDP TX packet when the interface has https in allowaccess. |
| 839801 | FortiToken purge in a VDOM clears all FortiToken statuses in the system. |
| 842517 | Adding a local user to a group containing many users causes a delay in GUI and CLI due to cmdbsvr (high CPU). |
| 843528 | RADIUS MAC authentication using ClearPass is intermittently using old credentials. |
| 851233 | FortiToken activation emails should include HTTPS links to documentation instead of HTTP. |
| 853793 | FG-81F 802.1X MAC authentication bypass (MAB) failed to authenticate Cisco AP. |
| 872051 | When the LDAP server has a huge amount of LDAP groups configured, it might return LDAP_SIZELIMIT_EXCEEDED to indicate not all results from SearchResultEntries were returned. The user-info daemon does not handle this error code correctly, and causes a huge amount of LDAP traffic. |
VM
| Bug ID | Description |
|---|---|
| 740796 | IPv6 traffic triggers <interface>: hw csum failure message on CLI console. |
| 764392 | Incorrect VMDK file size in the OVF file for hw13 and hw15. |
| 856645 | Session is not crated over NSX imported object when traffic starts to flow. |
| 859165 | Unable to enable FIPS cipher mode on FG-VM-ARM64-AWS. |
| 860096 | CPU spike observed on all the cores in a GCP firewall VM. |
| 868698 | During a same zone AWS HA failover, moving the secondary IP will cause the EIP to be in a disassociated state. |
| 869359 | Azure auto-scale HA shows certificate error for secondary VM. |
| 885829 | Azure SDN connector stopped processing when Azure returned NotFound error for VMSS interface from an AD DS-managed subscription. |
VoIP
| Bug ID | Description |
|---|---|
| 757477 | PRACK will cause voipd crashes when the following conditions are met: block-unknown is disabled in the SIP profile, the PRACK message contains SDP, and PRACK fails to find any related previous transactions (this is not a usual case). |
Web Filter
| Bug ID | Description |
|---|---|
| 856793 | In flow mode, URL filter configuration changes cause a spike in CPU usage of the IPS engine process. |
WiFi Controller
| Bug ID | Description |
|---|---|
| 807605 | FortiOS exhibits segmentation fault on hostapd on the secondary controller configured in HA. |
| 828901 | Connectivity loss occurs due to switch and FortiAPs (hostapd crash). |
| 831736 | Application hostapd crash found on FG-101F. |
| 834644 | A hostapd process crash is shown in device crash logs. |
| 856830 | HA FortiGate encounters multiple hostapd crashes. |
| 857084 | Console exhibits hostapd segmentation fault with signal 6:R28: 0000000002b4e120: $d at fgtassert.c:?. |
| 857140 | Hostapd segmentation fault signal 11 occurs upon RF chamber setup. |
| 858653 | Invalid wireless MAC OUI detected for a valid client on the network. |
| 865260 | Incorrect source IP in the self-originating traffic to RADIUS server. |
| 868022 | Wi-Fi clients on a RADIUS MAC MPSK SSID get prematurely de-authenticated by the secondary FortiGate in the HA cluster. |
| 882551 | FortiWiFi fails to act as the root mesh AP, and leaf AP does not come online. |
ZTNA
| Bug ID | Description |
|---|---|
| 832508 | The EMS tag name (defined in the EMS server’s Zero Trust Tagging Rules) format changed in 7.0.8 from FCTEMS<serial_number>_<tag_name> to EMS<id>_ZTNA_<tag_name>.
After upgrading, the EMS tag format was converted properly in the CLI configuration, but the WAD daemon is unable to recognize this new format, so the ZTNA traffic will not match any ZTNA policies with EMS tag name checking enabled. |
| 863057 | ZTNA real server address group gets unset once the FortiGate restarts. |
| 865316 | Adding an EMS tag on the Policy & Objects > Firewall Policy edit page for a normal firewall policy forces NAT to be enabled. |
Notatki producenta: FortiOS 7.0.11
Pozdrawiamy,
Zespół B&B
Bezpieczeństwo w biznesie
