FortiOS 7.2.12 release notes

Channels 149, 153, 157, 161, and 165 are allowed in European countries and region-code "E" countries, with a few exceptions.

For sessions offloaded to NP7 processors, `config system npu set default-qos-type {policing | shaping} end` can no longer select `shaping`; `default-qos-type` can only be set to `policing`.

NP7 policy traffic shaping, per-IP shaping, and regular port shaping—where interface `outbandwidth` is enabled without a shaping profile—always use the NP7 accounting and traffic-shaping TPE module, equivalent to `default-qos-type policing`.

Interface shaping profiles, also called Multiclass Shaping (MCS), now use only QTM on NP7, equivalent to `default-qos-type shaping`. Supported interfaces are physical, LAG, and VLAN over physical or LAG interfaces; at most 100 interfaces may have shaping profiles.

FortiOS 7.2.12 is no longer vulnerable to CVE-2023-46718.

FortiOS 7.2.12 is no longer vulnerable to CVE-2024-46669.

FortiOS 7.2.12 is no longer vulnerable to CVE-2025-22862.

FortiOS 7.2.12 is no longer vulnerable to CVE-2025-25249. The release notes associate two Fortinet bug records with this CVE.

FortiOS 7.2.12 is no longer vulnerable to CVE-2025-53844.

FortiOS 7.2.12 is no longer vulnerable to CVE-2025-59718.

SSL VPN is removed from FG9xG models.

For FGCP HA clusters, disable `uninterruptible-upgrade` and perform a normal firmware upgrade in a maintenance window. Traffic can be disrupted for up to 30 minutes while management boards and FPCs, or FIMs and FPMs, upgrade and both FortiGates restart.

FortiOS 7.0.x and 7.2.x use different SLBC FGCP heartbeat formats and cannot form a mixed 7.0.x/7.2.x cluster. Different patch releases within 7.0 or 7.2 can cluster and synchronize to the elected primary's firmware. A 7.2.x chassis can also cluster with 7.4.x, though identical firmware is recommended.

Fixed incorrect checksums on fragments after Queuing based Traffic Management processing.

Packets longer than 6000 bytes no longer cause QTM to hang.

Refreshing no longer causes QTM to hang.

MTU is honored after QTM so packets are fragmented when required.

An empty `apn` field in a GTP APN traffic-shaping policy now applies to any APN as intended instead of matching no traffic. Relevant configuration: `config gtp apn-shaper edit <policy-id> set apn [<apn-name> <apngrp-name> ...] set rate-limit <limit> set action {drop | reject} set back-off-time <time> next end`.

FortiGate 6000 and 7000 GUI packet captures now capture through-traffic packets.

Fixed unexpected confsyncd daemon behavior caused by an erroneous memory allocation on FortiGate 6000 and 7000 platforms.

The FortiGate 6000 and 7000 bandwidth widget no longer shows cumulative transmit and receive values instead of current throughput.

Fixed inability to download large files through HTTPS internet traffic via SASE.

Adding or removing an interface bandwidth widget no longer causes multicast traffic to be dropped.

Fixed incorrect bandwidth values in GUI bandwidth widgets after an upgrade to 7.2.11.

HA synchronization no longer fails across VDOMs because of CA-certificate checksum mismatches when bundle-sourced certificates are added or modified.

Different HA clusters on the same subnet no longer receive each other's L2 session-synchronization packets.

Addresses unsupported virtual serial number and `logical-sn` behavior on FG-100F and FG-101F following vSN support added in 7.2.9, 7.4.6, and 7.6.1.

Fixed an IKE HA-sync loop and high memory consumption when a peer address or port changes.

Token license activation no longer fails when a new HA FortiGate uses a virtual serial number.

Fixed a system error when an IPv6 FTP client uses passive mode through NAT64 and the IPv4 server returns a nonstandard PASV response.

Fixed packet drops and reduced CPU utilization on FPC blades with IPv6 traffic when `np-accel-mode` and `auto-asic-offload` are enabled.

BGP neighbors can establish over IPsec tunnels when DPDK is enabled in Azure.

Fixed IPsec VPN traffic drops reported after upgrading to 7.4.3.

The new-kernel platform now processes UDP-encapsulated ESP packets when a custom IKE port is used.

Fixed IPsec forwarding from a dial-up spoke through hub1 and then through a site-to-site tunnel.

Fixed CPU-usage problems during establishment of a large number of IPsec tunnels.

IPsec SA offloading no longer stops on affected models when handling more than 50,000 concurrent security associations.

Group lists are no longer truncated because of fixed-size buffers.

L2TP over IPsec can establish when offloading is enabled on FortiGate-90G.

Traffic is no longer dropped by anti-spoof checking through IPsec phase 2 transport mode with GRE encapsulation.

VPN authentication no longer fails when many RADIUS groups are configured.

Fixed a signal 11 WAD crash caused by memory corruption while handling VIP cases.

Fixed SSL protocol errors caused by incorrect TLS 1.3 session-ID handling during flow-based deep inspection between client, proxy, and internet.

WAD no longer crashes with signal 11 if a client session closes before the server connection completes in virtual-server pool mode.

Clients now learn the VR MAC rather than the secondary FortiGate's physical MAC when requesting a VIP.

BGP neighbors over GRE tunnels now establish after upgrade; anti-spoof processing was corrected.

Fixed malfunctioning SAML database insertion that caused excessive CPU usage.

Fixed SSL VPN crashes and client disconnects caused by a DHCP state-machine issue, high CPU usage, and watchdog timeouts.

A management interface no longer incorrectly appears when its status is down.

ULL interfaces x5, x6, x7, and x8 no longer all remain down after being set to 25G speed.

Fixed firmware-upgrade timeout when upgrading an LTE modem from FortiGuard.

Fixed an SNMP daemon malfunction that caused query timeouts.

Firmware upgrades no longer fail when the LTE modem is in download mode.

Fixed unexpected traffic increases over the FortiGate 6000 base backplane.

Fixed CPU spikes and management-access problems on affected models after upgrade when IPsec phase 1 NPU offload was enabled during maintenance.

The built-in CRDB bundle is updated to version 1.56.

On NP7 platforms, destination-MAC or FIB changes no longer cause traffic to stop on affected interfaces.

Fixed memory-usage problems caused by an OVERRUN in DPDKHelper.

An IPsec tunnel interface no longer retains a destination reference after its underlying interface is removed.

PPPoE interfaces on FortiGate-VM now obtain IP addresses after firmware upgrades.

FortiGate-VM64-GCP now obtains the correct system time when booting on GCP.

FortiGate-VM64-GCP licenses no longer become invalid because of incorrect system time.

Fixed WanOpt memory-usage problems caused by an error condition.

Local category overrides now work after reboot in flow mode.

User category overrides now work after reboot in flow mode.

Local and external user-category override databases are recreated after a FortiGate reboot or IPS engine restart.

FTP does not work in passive mode through a helper session. Workaround: configure an FTP_No_ALG custom service with the helper disabled, then create a policy associating FTP_No_ALG and high ports `tcp-1024-65535`.

FortiGate 6000 and 7000 units may claim primary unexpectedly during HA resynchronization after a graceful upgrade.

After a graceful upgrade from 7.2.10 to 7.2.12, the secondary chassis may lack its subscription license. Workaround: run `execute update-now` again.

LACPDU transmission problems can occur when HA failover is triggered by disconnecting a monitored port.

The CLI cannot delete malware threat feeds.

Custom or ISDB internet-service configuration can cause negate options to fail and produce `internet-service6` problems.

The GUI explicit-proxy setting under System > Feature Visibility is lost after reboot or upgrade.

Retrieving proxy statistics can delay loading of the explicit-proxy policy list without affecting proxy functionality. Workaround: restart WAD or temporarily disable WAD debugging using `diagnose wad toggle`; after reboot, debugging must be disabled again.

After a factory reset, initially setting `sec-default-action` to `accept` can cause incoming traffic not to match the proxy policy and allow all traffic. Workaround: set `sec-default-action` to `deny` in the CLI first, then change it to `accept`.

After failover, ARP entries can be removed from all slots when an ARP query to one slot does not respond.

Affected FortiGate models may exhibit unintended behavior after a warm reboot because virtual-domain configurations are not applied correctly.

With FGSP and FGCP, TCP ACK and data packets may be dropped by NP7 when traffic follows an asymmetric path.

An IPsec route may be absent from the kernel following HA failover. Workaround: bring the tunnel down and then back up.

On FortiGate 6000, IPv6 VRF routing tables can appear on both the new and old primary FPC after the primary FPC slot changes.

SNMP queries may return errors when the device has a large number of BGP routes.

On FortiGate 7000F clusters, FortiManager may change management interfaces listed in `session-sync-dev` from `mgmt-vdom` to `vsys_ha`, stopping HA session synchronization. Example: `config system ha set session-sync-dev 1-M1 1-M2 end`. Workaround: restore the interface VDOM using `config system interface edit 1-M1 set vdom mgmt-vdom next end`, then retrieve the FortiGate configuration from FortiManager.

The notes state that no new issues were identified in 7.2.12, but then list Firewall, FortiGate 6000/7000, and HA issues under the New known issues heading.