FortiOS 7.2.11 release notes

FortiGate now hashes and stores system administrator passwords using PBKDF2 with randomized salts. Downgrade handling can be configured with `config system password-policy set login-lockout-upon-downgrade {enable | disable} end`.

`cert-probe-failure` in `firewall ssl-ssh-profile` is now supported for flow-mode policies.

The database update process uses less ipshelper CPU, improving system performance and operational smoothness.

Previously, with `allow-traffic-redirect enabled` (the default), FortiGate dropped a one-arm packet when its source IP belonged to a different subnet than the incoming FortiGate interface. After the fix, one-arm traffic can always pass without policy matching by default.

After upgrading to FortiOS 7.2.11, `set cert-probe-failure` applies to flow-mode policies and may produce the SSL error `SSL connection is blocked due to unable to retrieve the server's certification`. To avoid this, set the action to allow: `config firewall ssl-ssh-profile edit "profile_name" config https set cert-probe-failure allow end end`. The release notes state that this behavior also applies after upgrading to 7.4.5.

BIOS security levels 0/1/2 are replaced by Low and High. High corresponds to former level 2 behavior, while Low corresponds to former level 1 behavior. BIOS configurations still using level 0 now behave as level 1/Low.

On supported new installations, GUI users are directed to the FortiCare registration dialog after login. Initial support is limited to FortiGate 900G and 200G series devices.

For NP7 sessions, policy traffic shaping, per-IP shaping, and regular port shaping—where `outbandwidth` is enabled on an interface without a shaping profile—always use the NP7 accounting and traffic-shaping TPE module. This is equivalent to setting `default-qos-type` to `policing`.

For NP7 sessions, interface shaping profiles, also called Multiclass shaping (MCS), now use only QTM for traffic shaping, equivalent to `default-qos-type` set to `shaping`. Supported interface types are physical, LAG, and VLAN interfaces over physical or LAG interfaces.

For sessions offloaded to NP7 processors, `config system npu set default-qos-type {policing | shaping} end` can no longer be used to select shaping. `default-qos-type` can only be set to `policing`.

Fixed incorrect checksums on packet fragments after processing by the NP7 Queuing based Traffic Management module.

Fixed a condition in which packets longer than 6000 bytes caused the NP7 QTM module to hang.

Fixed a condition in which refreshing caused the NP7 QTM module to hang.

Fixed an issue where MTU was not honored after NP7 QTM processing, preventing required packet fragmentation.

FortiGate supports NP7 shaping profiles on a maximum of 100 interfaces.