FortiOS 7.2.14 release notes

AV Engine 6.00303 is included as the built-in AV Engine.

The command `config system npu set default-qos-type {policing | shaping} end` can no longer select `shaping`; `default-qos-type` can only be set to `policing`.

For NP7 sessions, policy traffic shaping, per-IP shaping, and regular port shaping where interface `outbandwidth` is enabled without a shaping profile always use the NP7 accounting and traffic-shaping TPE module, equivalent to `default-qos-type policing`. Interface shaping profiles, also called Multiclass Shaping (MCS), now use only QTM, equivalent to the former `default-qos-type shaping` behavior.

MCS shaping profiles may be applied to physical, LAG, and VLAN interfaces over physical or LAG interfaces. A FortiGate supports shaping profiles on no more than 100 interfaces.

Administrators can no longer use `set default-qos-type shaping` under `config system npu`; only `policing` is accepted.

Supported paths depend on the FortiGate model, current FortiOS version, and target version. Select FortiGate/FortiOS, the product model, current version, and target version in Fortinet's Upgrade Path Tool before upgrading.

An individual FortiGate can be upgraded manually, or automatically according to the FortiGuard upgrade path.

Multiple FortiGates in a Security Fabric support manual, immediate, or scheduled updates based on the FortiGuard upgrade path.

Upgrade a FortiGate 6000 through its management-board GUI or CLI and a FortiGate 7000 through the primary FIM GUI or CLI. All management boards, FPCs, FIMs, and FPMs use the same firmware image, which is copied to each component before installation and restart.

On standalone FortiGate 6000/7000 systems, or HA clusters with `uninterruptible-upgrade` disabled, all components upgrade in one step and traffic is interrupted for several minutes. Schedule these upgrades during a quiet maintenance period.

Fortinet recommends enabling `uninterruptible-upgrade` and `session-pickup` for a graceful FGCP HA cluster upgrade. Enable the former with `config system ha set uninterruptible-upgrade enable end`.

For a graceful upgrade, download the FortiOS 7.2.14 FG-6000F, FG-7000E, or FG-7000F firmware image from Fortinet Support and perform a normal HA-cluster upgrade using that file.

Confirm the installed release from the dashboard or with `get system status`. Then verify that all components are synchronized and healthy through the Cluster Status widget or `diagnose sys confsync status`.

Fixed incorrect checksums on fragmented packets after QTM processing.

Fixed a QTM hang triggered by packets longer than 6000 bytes.

Fixed a condition in which refreshing caused QTM to hang.

Fixed post-QTM handling that ignored the MTU and failed to fragment packets.

FTP failed in passive mode through a helper session.

On FortiGate 6000/7000 platforms, FQDN broadcast packets left stale FQDN address entries in the firewall.

Fixed an error condition in confsyncd when file sizes changed between scans.

A second file scan with a file size larger than the initial scan caused confsyncd to restart unexpectedly.

On System > HA, all HA vcluster device roles incorrectly appeared as Primary in the Role column.

Mobile Token assignment failed after HA failover on older models that do not support vSN.

Interfaces could not be enabled as FortiLink interfaces on FortiGate hardware revision 2.

Fixed configuration loss on FGT-60F when the appliance entered extreme conserve mode.

FortiGate HA became out of sync after provisioning a certificate through ACME.

Configuration backup to FortiGate Cloud failed while retrieving the full configuration.

Fixed SAML authentication issues when `LASSO_PROFILE_SIGNATURE_VERIFY_HINT_FORCE` was set and the SAML response was not signed.

Fixed a diag daemon error condition during VM image-upgrade matrix operations.

After upgrading to the Frontier AI vulnerability-fix releases 7.2.14, 7.4.13, 7.6.8, or 8.0.2, browsers may show `net::ERR_EMPTY_RESPONSE` for sites using nonstandard HTTPS ports such as 8443 or 8011 when deep inspection is enabled. Standard HTTPS sites continue to work.

Malware threat feeds cannot be deleted through the CLI.

Custom or ISDB internet-service entries can cause failed negate options and problems with `internet-service6`.

The GUI explicit-proxy setting on System > Feature Visibility is lost after reboot or upgrade.

Retrieving proxy statistics can delay policy-list loading. Workaround: restart WAD, or temporarily disable WAD debugging with `dia wad toggle` through direct-connect diagnose; disable it again after reboot. Explicit-proxy traffic is unaffected.

After a factory reset, setting `sec-default-action` directly to `accept` can cause incoming traffic not to match the proxy policy and allow all traffic. Workaround: first set `sec-default-action` to `deny` in the CLI, then change it to `accept`.

On FortiGate 6000/7000, if an ARP query to one slot receives no response after failover, ARP entries can be removed from every slot.

Use a maintenance window because traffic may be disrupted for up to 30 minutes. Disable `uninterruptible-upgrade` and perform a normal firmware upgrade; traffic is blocked until all management boards and FPCs, or FIMs and FPMs, are upgraded and restarted.

FortiGate 6000/7000 SLBC heartbeat formats differ between FortiOS 7.0 and 7.2, so one 7.0.x chassis and one 7.2.x chassis cannot form an FGCP HA cluster. Different patch releases within 7.0 or 7.2 can cluster and synchronize firmware. A 7.2.x chassis may also cluster with 7.4.x, but matching firmware is recommended.

Some FortiGate models can perform a warm reboot without correctly applying virtual-domain configuration.

On FortiGate 7000F using FGSP and FGCP, NP7 may drop TCP ACK and data packets when traffic follows an asymmetric path.

After failover, the IPsec route may be absent from the kernel. Workaround: bring the tunnel down and back up.

On FortiGate 6000, IPv6 VRF routing tables appear under both the new and old primary FPC units after the primary FPC slot changes.

SNMP queries can return an error when the BGP routing table is large.

FortiManager may change management interfaces listed in `session-sync-dev` from `vsys_ha` to `mgmt-vdom`, stopping session synchronization. Reconfigure `session-sync-dev` on the cluster, then retrieve the FortiGate configuration into FortiManager.

On FortiGate 6000/7000 FGSP configurations, enabling the `encryption` option under `config system standalone-cluster` has no effect on session-synchronization traffic.

Certificate and private-key mismatches in an HA setup can prevent GUI access.

Concurrent IP address management during FortiGate VDOM migrations can select an unexpected source IP for outbound connections and cause BGP flapping.

FortiGate units may unexpectedly claim the primary role during HA resynchronization in graceful upgrades.

A secondary chassis may lose its subscription license after a graceful upgrade from 7.2.10 to 7.2.12. Workaround: run `execute update-now` again.

In a FortiGate 6000/7000 active-passive cluster with HA override enabled, the original primary may reclaim its role before FPCs or FPMs are online and synchronized, causing traffic and session failures.

On 7KF/B2933, an uninterruptible upgrade from 7.2.13 to 7.4.13 fails.

Drilling down into a malicious website under FortiView Threats can return “Failed to retrieve FortiView data from disk.”

In Policy & Objects > Internet Service Database, slide-out details cannot be scrolled to the end when there are more than 100,000 entries.

An expired device-level FortiManager Cloud license may trigger a warning despite a valid account-level license. Functionality is unaffected.

With more than 2000 users, the Dashboard > Firewall User monitor widget does not show search, column filters, or graphs because lazy loading does not support these features.

Node.js can restart after an upgrade and produce a kill ESRCH error.

Under Security Profiles > Intrusion Prevention > IPS Signatures and filters, GUI edits to an IP exemption are not saved when edited more than once.

On G-series FortiGates with dual WAN links, displayed incoming and outgoing bandwidth may differ from actual traffic.

The SD-WAN rule omniselect does not provide inline editing for Application Group entries. Edit the application under Security Profiles > Application Signatures > Group or through the CLI.

If a secondary unit takes several minutes to boot, the GUI can time out and display “Image upgrade failed” even though the HA upgrade completes successfully.

A newly added vcluster does not update its link-failure value, which can cause incorrect primary selection.

On some models, Fabric Management information is inconsistent when accessed through a secondary HA unit.

For special-branch-supported models, upgrading an HA cluster from a special FortiOS 7.0.x build to an official release such as 7.2.9 or 7.2.10 can fail on the primary if the HA password is empty. Configure a valid password before upgrading with `config system ha set password <new-password> end`, or manually upgrade the affected member. Setting the password triggers HA re-election.

The cluster cannot obtain contract information for all members unless they are registered under the same FortiCare account.

LACPDU transmission issues can occur when HA failover is triggered by disconnecting a monitored port.

After successfully changing a VLAN ID through the CLI, an error similar to `cmdb_txn_cache_data(query=log.npu-server,leve=1) failed` may appear.

IPv6 traffic may fail to load-balance across multiple VDOMs when ECMP is used in NAT mode.

The NPU session list does not display policy-route details for traffic routed by policy route.

Traffic drops can occur after failover in active-passive HA deployments using hardware-only sessions.

`diagnose sys npu-session list` can report incorrect policy IDs for traffic using intra-zone policies.

NAT46 NPU sessions may be lost and traffic dropped during HA failover.

Running `diag firewall ippool list pba` on a hyperscale device may cause high CPU utilization. No workaround is available.

Changing IP-pool groups on hyperscale VDOMs can cause a traffic outage.

Changing `session-ttl` can leave IP pools stuck.

Receiving IPsec VPN traffic on the VLAN interface of an NP7 vlink can cause CPU utilization problems.

A race between FortiOS and the NPU driver during IPsec SA updates can prevent BGP peering in dynamic-hub-to-static-spoke VPNs.

A REST API GET request returns no more than 1000 logs.

SD-WAN Performance SLA health checks fail when FortiGuard is selected as the server because FortiGuard servers do not support HTTP for this purpose.

`diagnose ip rtcache list` is no longer supported in FortiOS using the 4.19 kernel.

Network > SD-WAN > SD-WAN Rules can display a down member interface as up, although its tooltip shows the correct status.

A hub-and-spoke deployment can experience duplication when the spoke uses `set packet-duplication force` and the hub has packet deduplication enabled.

Physical and logical topology views can be slow when many downstream FortiGates, FortiSwitches, FortiAPs, and endpoints are present. This is display-only and does not affect downstream operation.

Many simultaneous GUI administrators and downstream Fabric devices can cause high Node CPU and slow GUI pages. Workaround: disconnect other concurrent administrator sessions.

Devices on different VDOMs but behind the same router can show incorrect VDOM data in topology tooltips. Workaround: disable `device-identification` on the interface.

FortiClient for Windows cannot be launched through the SSL-VPN web portal.

SSL-VPN web-mode RDP sessions enter the wrong character for Shift+2 on Japanese keyboards.

Topology can fail to load and produce Java errors in HTTPS logs when FortiSwitches are connected through SFPs.

A FortiLink interface can flap when an MCLAG FortiSwitch uses DAC with an OPSFPP-T-05-PAB transceiver.

VLAN-over-VXLAN traffic is processed by the CPU instead of NP7, reducing performance and increasing CPU load.

On 400F, 600F, 900G, 3200F, and 3700F, LAG member interfaces do not shut down when a corresponding remote member is administratively down.

On NP7, `set inbandwidth <x>` or `set outbandwidth <x>` can stop traffic. The documented workaround is to configure policing and restart: `config system npu set default-qos-type policing end`. In 7.2.14, policing is the only permitted `default-qos-type`.

Ports x7 may display an up/green link state when no cables are connected.

Creating or editing many interfaces at once can cause the `node` daemon to consume high CPU and memory.

On SoC5-based platforms, receiving a multicast or broadcast packet can intermittently interrupt traffic on a virtual VLAN switch.

A fresh image burn may leave the device stuck, although upgrades from an earlier version work. Workaround: power-cycle the unit.

The issue affects only FG-200G. Workaround: use DNS instead of SDNS by configuring cleartext rather than DoT, for example changing `set protocol dot`.

Enabling `device-identification` may collect endpoint data even when a router sits between FortiGate and the endpoints. Workaround: disable `device-identification` on the interface.

The root FortiGate may parse recommendations incorrectly and select the wrong image for managed FortiAPs or FortiSwitches. Workaround: initiate the Fabric Upgrade through the CLI.

Low-end models with 2 GB RAM can enter conserve mode while processing more than 5000 user records with extensive IoT vulnerability data. Requests such as `GET /api/v2/monitor/user/device/query` can spike httpsd CPU and memory.

A FortiGate VM deployed in UEFI boot mode should not be downgraded to any GA release earlier than 7.2.4.

Incorrect WQE handling when sending IPv6 traffic over MLX5 adapters can make FortiOS unresponsive.

DLP configuration may be deployed incorrectly on FortiGate VMs hosted on Intel Skylake processors.

Web-filter logs incorrectly identify HTTP sessions as HTTPS when an HTTP VIP server is used.

Layer-3 roaming may not work when the wireless controller has multiple `cw_acd` processes, meaning `acd-process-count` is nonzero.

In an FGT-200F HA cluster with `capwap-offload` enabled, tunnel-SSID traffic may stop after failover.

The automatic-connect option can fail when the local radio connection is lost on some FortiGate models.

A managed FortiSwitch can detect multiple MAC addresses using the same IP address.

Mapped drives can become inaccessible after reboot when using a FortiGate ZTNA access proxy with FQDN destinations.

Before and after upgrading a FortiGate 6000/7000, test important services and compare key indicators such as session count, CPU use, memory use, reachability, and performance.

FortiGate 6000/7000 upgrades generally take several minutes; duration varies by hardware and configuration and may increase when DP or NP7 processor software is upgraded.