FortiOS 7.0.17 release notes

FortiOS 7.0.17 is no longer vulnerable.

FortiOS 7.0.17 is no longer vulnerable.

FortiOS 7.0.17 is no longer vulnerable.

FortiOS 7.0.17 is no longer vulnerable.

FortiOS 7.0.17 is no longer vulnerable.

FortiOS 7.0.17 is no longer vulnerable.

Supported paths depend on the FortiGate model and current version. In Fortinet's Upgrade Path Tool, select FortiGate / FortiOS, the product model, current version, and target version, then click Go to obtain the supported sequence.

Fixed an issue where an administrator could log in to the GUI over HTTPS with a password even when `admin-https-pki-required` was enabled.

Updated JavaScript components to the latest Long Term Support version.

Fixed `aws.amazon.com` being listed in the SD-WAN default health-check list.

Fixed insufficient session expiration in SSL VPN when using SAML authentication.

FortiClient cannot connect to FortiGate SSL VPN using SAML login when an internal browser is selected as the SAML authentication user agent.

On certain FortiGate models, CPU spikes and management-access problems can occur after upgrade when IPsec Phase 1 NPU offload is enabled during maintenance.

Creating an IP-protocol firewall service in the GUI may silently modify the protocol number of the first IP-type service, potentially affecting policies such as those using `ALL` on some 6K and 7K platforms. Workaround: create the service in the CLI or place a non-IP service first, for example: `config firewall service custom`; `edit "unused"`; `set tcp-portrange 1`; `next`; `move "unused" before "ALL"`; `end`.

After upgrading a FortiManager-managed FortiGate to 7.0.13, unique `global-label` values may create separate sequence groups for each policy. Workaround: drag policies into the correct group or remove `global-label` from each member except the leading policy.

The best output route may not be found for local-out DNAT traffic.

The Category filter on Dashboard > FortiView Websites does not work in the Japanese GUI.

The System > FortiGuard page may show Unknown for a working AntiVirus and IPS update override server. This is display-only; the override continues to function.

With VDOM mode enabled, Network > Interfaces in Global view may show IPsec interfaces from non-management VDOMs as UP. The VDOM view is accurate.

Policy & Objects > Firewall Policy can take about 30 seconds or longer to load with more than 20,000 policies. Workaround: configure policies through the CLI.

System > Certificates may show an incorrect reference count and permit an attempted deletion of a referenced certificate. The deletion fails despite a success message; remove all references before deletion.

Users cannot paste text into the SSL VPN web portal SSH terminal emulator in Firefox. Workaround: use Chrome, Edge, or Safari.

The GUI displays an invalid-upgrade-path warning when upgrading firmware from 7.0.1 to 7.0.2.

An undefined error appears when an administrator password is changed for the first time on NP7 platforms.

The View/Edit Entries pane under Policy & Objects > Internet Service Database cannot scroll to the end when it contains more than 100,000 entries.

Editing a prefix list with many rules under Network > Routing Objects fails with an integer-range error. Workaround: edit the prefix list through the CLI.

With more than 200 VDOMs, System > Administrators may take over one minute to load the Two-factor Authentication toggle. Other settings are unaffected. Workaround: configure `two-factor-authentication` under `config system admin` in the CLI.

The GUI may show a FortiManager Cloud expiration notification for an expired device-level license even when a valid account-level license exists. Functionality is unaffected.

On FortiGate 12xG and 9xG devices, graceful upgrade of the secondary HA node fails at high security level. Workaround: disable HA and upgrade units separately, or temporarily lower the security level and restore it afterward.

Hyperscale firewall policies do not support VIP features `srcfltr`, `srcintf-fltr`, `service`, `arp-reply`, `nat-source-vip`, or port forwarding, although these appear in the CLI or GUI for IPv4 and IPv6 VIP configuration.

HA1, HA2, AUX1, and AUX2 interfaces cannot be added to an LAG on FortiGate 4200F, 4201F, 4400F, and 4401F.

Sessions may be dropped when dynamically changing a hyperscale policy's hardware log server `log-processor` from `hardware` to `host`. Make this change during quiet periods.

The implicit-deny policy hit count does not increment for hardware sessions carrying NAT46 or NAT64 traffic.

`srcaddr-negate` and `dstaddr-negate` do not work correctly for IPv6 traffic with FTS.

ACL policies added while a hyperscale VDOM is processing traffic can take longer than expected to become effective; traffic intended to be blocked may be allowed during the transition.

The NPU session list does not display policy-route information for traffic routed through a policy route on NPU-accelerated models.

A diagnostic command is unavailable for showing `hit_count` and `last_used` for policy routes and NPU sessions in a hyperscale VDOM.

The console can report `PARSE SKIP ERROR=17 NPD ERR PBR ADDRESS` during system startup.

The `diagnose firewall ippool list` command does not produce correct output for overload-type IP pools.

Editing a hyperscale policy with an overload CGN IP pool causes the GUI to disable `cgn-eif`, regardless of its previous state.

The out-of-memory killer may terminate NPD or LPMD after mixed-session traffic and HA failover.

`diagnose sys npu-session stat` incorrectly reports a `setup rate` of `0` for EIF sessions.

Hardware session synchronization does not work on FG-480xF devices in hyperscale mode.

The HA primary's NPU session list can contain many sessions while NPU session state reports `0`.

A kernel interruption can occur in a hyperscale VDOM when `set nat46-generate-ipv6-fragment-header` is enabled.

After FTP traffic passes, `npu-session stat` does not report the actual session count accurately.

An IPsec aggregate static route is not marked inactive when its IPsec aggregate is down.

Disabling `src-check` reverse-path forwarding on the parent tunnel is not inherited by ADVPN shortcuts.

Traffic logs may not appear when numerous configuration changes occur simultaneously.

FortiGate may enter conserve mode when a missing or invalid HTTP date is posted through the web proxy.

GUI performance is slow in a Fabric topology with more than 50 downstream devices.

The Rogue AP Detection and FortiCare Support checks in Security Rating reports may show incorrect results.

Running Security Rating reports on a FortiGate with more than 1,000 firewall policies, addresses, or other table entries may cause conserve mode.

Physical and logical Security Fabric topology views load slowly with many downstream FortiGates, FortiSwitches, FortiAPs, and endpoint traffic. This is a GUI-only issue and does not affect downstream operation.

The console may display `mce: [Hardware Error]` after a fresh image burn or reboot.

An 802.3ad aggregate configured for 1 Gbps may have an unlit port LED and pass no traffic. Affected platforms are 110xE, 220xE, 330xE, 340xE, and 360xE.

The cmdbsvr process may fail to secure the var_zone lock because another process holds it indefinitely.

The console may print `check_gui_redir_file: No such file or directory` after reboot.

Download and upload performance may be slow when traffic traverses from a 1G interface to a 10G interface on FortiGate 200F.

Upgrading from 7.0.15 to 7.0.16 with BIOS security level 2 may produce `System file integrity check failed!`.

An ESXi VLAN interface based on LACP is nonfunctional.

ARM64 KVM, AWS, and OCI FortiGate VMs and VM64 OPC can encounter a kernel error while upgrading from 7.0.15 to 7.0.16. The OCI bare-metal kernel image is unsupported in 7.0.16 when upgrading from 7.0.13, 7.0.14, or 7.0.15.

The block replacement page is not automatically pushed to replace video content when a video filter blocks it.

With more than 500 managed FortiAPs and 5,000 WiFi clients, the Managed FortiAPs page and FortiAP Status widget can take a long time to load. FortiAP operation is unaffected.

After an upgrade or reboot on NP7 platforms, WiFi data cannot pass when the SSID VLAN interface uses DHCP Relay Server.

Mapped drives can become inaccessible after a laptop reboots when using a FortiGate ZTNA access proxy with FQDN destinations.

ZTNA TCP forwarding does not work when the real server uses an FQDN address type. Publicly resolvable FQDNs are not recommended because the internal DNS database zone may override them; after reboot, the private address may not take effect and the real server may not be found.