FortiOS 7.2.13 release notes

The Queuing based Traffic Management (QTM) module now fixes incorrect checksums on fragments, hangs caused by packets longer than 6000 bytes, hangs during refresh, and failure to honor MTU and fragment packets after QTM.

For sessions offloaded to NP7 processors, `default-qos-type` can no longer be changed between policing and shaping using `config system npu; set default-qos-type {policing | shaping}; end`. It can only be set to `policing`.

For NP7 sessions, policy traffic shaping, per-IP shaping, and regular port shaping—`outbandwidth` enabled on an interface without a shaping profile—always use the NP7 accounting and traffic-shaping TPE module, equivalent to `default-qos-type policing`.

For NP7 sessions, interface shaping profiles, also called Multiclass shaping (MCS), now use only QTM, equivalent to `default-qos-type shaping`. Supported interface types are physical, LAG, and VLAN over physical or LAG interfaces. A maximum of 100 interfaces can have shaping profiles.

FortiOS 7.2.13 resolves the stated vulnerability. Fortinet directs users to the FortiGuard PSIRT site for additional information.

The ability to select `shaping` through `config system npu; set default-qos-type shaping; end` is no longer available; `default-qos-type` supports only `policing`.

Fortinet states that no new issues have currently been identified in FortiOS 7.2.13; all listed open issues originated in earlier versions.

Graceful upgrade is unsupported for this path. Use a maintenance window because traffic may be disrupted for up to 30 minutes. Disable `uninterruptible-upgrade`, perform a normal firmware upgrade, and wait for all management boards and FPCs or FIMs/FPMs to upgrade and both FortiGates to restart.

FortiOS 7.0 and 7.2 use different SLBC FGCP heartbeat formats, so a cluster cannot be formed with one chassis on 7.0.x and another on 7.2.x. Different patch releases within 7.0 or 7.2 can form a cluster and synchronize to the primary's firmware. A 7.2.x chassis can also form a cluster with a 7.4.x chassis, though matching versions are recommended.

On special-branch-supported models with an empty HA password, upgrading from a special-build 7.0.x GA version to 7.2.9 or 7.2.10 GA can leave one member unupgraded. Before upgrading, configure `config system ha; set password <new-password>; end`, or manually upgrade the affected member. Setting the password triggers HA re-election.

The GUI Firmware and Registration page may select an incorrect recommended FortiAP or FortiSwitch image because of a parsing issue. Workaround: initiate the Fabric Upgrade through the CLI.

If FGTVM was deployed in UEFI boot mode, do not downgrade it to any GA version earlier than FortiOS 7.2.4.

Fixed incorrect checksums for fragments after QTM processing.

Fixed a QTM hang triggered by packets longer than 6000 bytes.

Fixed an issue where refreshing caused QTM to hang.

Fixed failure to honor MTU after QTM, which previously prevented required packet fragmentation.

Unable to delete malware threat feeds using the CLI.

Custom or ISDB internet-service entries can cause negate options to fail and create issues with `internet-service6`.

The GUI explicit-proxy setting on System > Feature Visibility is lost after reboot or upgrade.

Retrieving proxy statistics can delay loading without affecting proxy operation. Workaround: restart WAD or temporarily disable WAD debugging with `diagnose wad toggle`; after reboot it must be disabled again. Use direct-connect diagnose.

After a factory reset, setting `sec-default-action` directly to `accept` can cause incoming traffic not to match proxy policy and allow all traffic. Workaround: first set `sec-default-action` to `deny` in CLI, then change it to `accept`.

Workaround: create an FTP_No_ALG custom service with the helper disabled, then associate it with a policy and add high ports `tcp-1024-65535`.

ARP entries are removed from all slots when an ARP query to one slot does not respond after failover.

Some FortiGate models can exhibit unintended behavior during a warm reboot because virtual-domain configurations are not properly applied.

On FortiGate 7000F with FGSP and FGCP, NP7 may drop TCP ACK and data packets when traffic follows an asymmetric path.

After HA failover, the IPsec route can be absent from the kernel. Workaround: bring the tunnel down and back up.

On FortiGate 6000, IPv6 VRF routing tables appear under both the new and old primary FPC after the primary FPC slot changes.

SNMP queries can return an error when the device has a large number of BGP routes.

When management interfaces are configured through `session-sync-dev`, a FortiManager update can move their VDOM from `mgmt-vdom` to `vsys_ha`, stopping session synchronization. Workaround: restore each affected interface with `config system interface; edit 1-M1; set vdom mgmt-vdom; next; edit 1-M2; set vdom mgmt-vdom; next; end`, then retrieve the FortiGate configuration into FortiManager.

On FortiGate 6000 and 7000, enabling the `encryption` option under `config system standalone-cluster` has no effect on session-synchronization traffic.

The GUI can become unreachable because certificates and private keys do not match in an HA deployment.

Concurrent IP address management can cause unexpected source-IP selection on outbound connections during FortiGate VDOM migrations, resulting in BGP flapping.

FortiGate units can unexpectedly claim primary status during HA resynchronization following a graceful upgrade.

The subscription license on the secondary chassis may be missing after a graceful upgrade from 7.2.10 to 7.2.12. Workaround: run `execute update-now` again.

Drilling into a malicious website in FortiView Threats can return “Failed to retrieve FortiView data from disk”.

The Policy & Objects > Internet Service Database View/Edit Entries pane cannot reach the end when there are more than 100000 entries.

A license-expired notification may appear for an expired FortiManager Cloud license even when a valid account-level license exists; functionality is unaffected.

When the Firewall User monitor exceeds 2000 users, lazy loading causes the search bar, column filters, and graphs to disappear.

The `Node.JS` daemon can restart with a `kill ESRCH` error after an upgrade.

Edits to IP Exemptions in Security Profiles > Intrusion Prevention are not saved when changed more than once.

On G-series models with dual WAN links, displayed incoming and outgoing bandwidth may not match actual traffic.

Inline editing from the omniselect is unavailable for Application Group entries. Workaround: edit under Security Profiles > Application Signatures > Group or use the CLI.

If the secondary unit takes several minutes to boot, the GUI may time out and display “Image upgrade failed” even though the HA upgrade can complete normally.

The newly added vcluster's `link-failure` value is not updated, which can result in selection of the wrong primary unit.

The Fabric Management page may display inconsistent information when accessed through secondary HA units on some models.

When HA members are not registered to the same FortiCare account, the cluster cannot retrieve contract information for all members from FortiGuard.

LACPDU transmission issues can occur when HA failover is triggered by disconnecting a monitored port.

After a successful CLI VLAN-ID change, an error similar to `cmdb_txn_cache_data(query=log.npu-server,leve=1) failed` may appear.

IPv6 traffic fails to load balance across multiple VDOMs with ECMP in NAT mode.

The NPU-session list does not display policy-route information when NPU-accelerated traffic uses a policy route.

Traffic drops can occur after failover in active-passive HA deployments using hardware-only sessions.

`diagnose sys npu-session list` can display incorrect policy IDs for traffic using intra-zone policies.

HA failover can remove NAT46 NPU sessions and cause traffic loss.

Running `diagnose firewall ippool list pba` on a hyperscale device may cause high CPU usage. No workaround is available.

Changing an IP-pool group on a hyperscale VDOM can interrupt traffic.

IP pools can become stuck after changes to session TTL.

Receiving IPsec VPN traffic on the VLAN interface of an NP7 vlink can cause CPU-usage problems.

A race between FortiOS and the NPU driver during IPsec SA updates can prevent BGP establishment for dynamic-hub-to-static-spoke VPNs.

A REST API GET request cannot fetch more than 1000 logs.

SD-WAN Performance SLA health checks fail when FortiGuard is the server because FortiGuard servers lack HTTP support.

The command `diagnose ip rtcache list` is no longer supported by the FortiOS 4.19 kernel.

SD-WAN member interfaces that are down may be shown as up on the Rules page, although the tooltip reports the correct status.

A duplication issue occurs when the spoke uses `set packet-duplication force` and the hub has `set packet-de-duplication` enabled.

Physical and logical topology can load slowly with many downstream FortiGates, FortiSwitches, FortiAPs, and endpoint traffic. This is GUI-only and does not affect downstream-device operation.

Multiple simultaneous GUI administrator sessions in a large Security Fabric can cause node-process CPU load and slow pages. Workaround: disconnect other concurrent administrator sessions.

Two devices in different VDOMs behind the same router can display incorrect VDOM data. Workaround: disable `device-identification` on the interface.

FortiClient for Windows cannot be launched through the SSL VPN web portal.

SSL-VPN web-mode RDP enters the wrong character for Shift+2 on a Japanese keyboard.

FortiSwitch topology can fail to load correctly and produce Java errors in HTTPS logs when switches connect through SFPs.

A FortiLink interface can flap under MCLAG with DAC when using an OPSFPP-T-05-PAB transceiver.

VLAN-over-VXLAN traffic is not offloaded to NP7, increasing CPU load and reducing performance.

On FortiGate 400F, 600F, 900G, 3200F, and 3700F, LAG members do not shut down when the corresponding remote member is administratively down.

Using `set inbandwidth <x>` or `set outbandwidth <x>` can stop traffic. The documented workaround is to use `config system npu; set default-qos-type policing; end` and restart the device. In 7.2.13, policing is the only permitted `default-qos-type`.

The x7 ports can show green link LEDs even when no cable is attached.

Creating or editing many interfaces at once can cause high CPU and memory usage in the `node` daemon.

On SoC5-based platforms, multicast or broadcast packets can intermittently interrupt traffic on a virtual VLAN switch.

A fresh image burn can leave the model stuck, while upgrades from earlier versions still work. Workaround: power-cycle the unit.

Workaround: use cleartext DNS with `config system dns; set protocol cleartext; end`.

Enabling `device-identification` can collect endpoint information even when an intermediate router separates the FortiGate and endpoints. Workaround: disable `device-identification` on the interface.

Low-end models with 2 GB RAM may enter conserve mode when handling more than 5000 large user records containing extensive IoT vulnerability data. Requests such as `GET request /api/v2/monitor/user/device/query` can cause high CPU and memory use in `httpsd`.

Incorrect WQE handling can make FortiOS unresponsive while sending IPv6 traffic through MLX5 network adapters.

FortiGate VMs running on hypervisors with Intel Skylake processors can deploy DLP configurations incorrectly.

Web-filter logs can incorrectly identify HTTP sessions as HTTPS when an HTTP VIP server is used.

Layer 3 roaming may fail when the wireless controller runs multiple `cw_acd` processes, meaning `acd-process-count` is nonzero.

In an FGT-200F HA cluster with `capwap-offload` enabled, tunnel-SSID traffic may stop passing after failover.

The automatic-connect option may not work when the local radio connection is lost on some FortiGate models.

A managed FortiSwitch may detect multiple MAC addresses using the same IP address.

Mapped drives become inaccessible after a laptop restarts when using a FortiGate ZTNA access proxy with FQDN destinations.

FortiGate supports shaping profiles on no more than 100 physical, LAG, or VLAN-over-physical/LAG interfaces.