FortiOS 7.4.10 release notes

The setup wizard can configure a gateway for internet connectivity and FortiCare registration. Air-gapped deployments can upload an offline license file directly.

Models requiring registration before full GUI and CLI access now permit full configuration for seven days before registration becomes mandatory.

Default soft-switch interfaces and open SSIDs were removed across FortiWiFi platforms. On 4xF, 6xF, and G-series models, the default WiFi VAP remains in tunnel mode with predefined IP, DHCP, and firewall policy settings. On 8xF-2R models, VAPs use bridge mode with the hardware switch, obtain DHCP through the internal interface, and remain subject to firewall policy control.

802.1X can now be enabled when the software switch's `intra-switch-policy` is set to `explicit`, allowing dynamic VLAN control and traffic regulation.

When `auth-ike-saml-port` is used, iprope matches local-in traffic only if the destination port equals `auth-ike-saml-port` and the destination interface has `ike-saml-server` enabled.

The default FortiGuard package update schedule changed from automatic to daily.

When Anycast is enabled, VM license activation uses `vmactivation1.fortinet.net`, `vmactivation2.fortinet.net`, and `vmactivation3.fortinet.net` instead of general update FQDNs. Firewall and DNS allowlists may need adjustment.

The defaults for `allow-traffic-redirect` and `ipv6-allow-traffic-redirect` changed from enabled to disabled. Upgrade forcibly changes both settings to disabled even if previously enabled. Same-interface redirected traffic therefore requires an explicit firewall policy. To restore routing-only redirection, manually enable the settings. Configuration: `config system global set allow-traffic-redirect disable set ipv6-allow-traffic-redirect disable end`

For NP7-offloaded sessions, `default-qos-type` can only be `policing`; the previous selectable form `config system npu set default-qos-type {policing | shaping} end` is no longer available. Policy shaping, per-IP shaping, and regular port shaping use TPE policing. Interface shaping profiles use QTM shaping.

The `shaping` value is no longer supported for `config system npu` → `set default-qos-type`; only `policing` can be configured.

Large file uploads over HTTP/2 failed when proxy-mode AntiVirus and deep inspection were enabled.

SSL inspection did not correctly add the Authority Key Identifier when flow mode DPI was enabled.

FTP traffic was blocked when Application Control was enabled over SOCKS5.

IEC 60870-5-104 detection could become incomplete after clearing an IPS session. The stated workaround was to clear the system session.

Queries from different VRFs with identical transaction IDs and source and destination addresses were treated as retransmissions and discarded.

An expired EMS Cloud license on the global FortiCare account prevented connections even when other VDOMs had valid access keys.

Frequent TPM requests from httpsd caused intermittent EMS Cloud disconnections.

Fast fallback incorrectly used an IPv4 DNS address to connect to a server in an IPv6-only setup.

FTPS data connections failed with flow-mode firewall policies configured for the FTP service.

The authentication pop-up did not appear for HTTPS access when proxy authentication rules, `webproxy-forward-server`, and certificate inspection were configured.

Clients using a forward server could not reach the captive portal for internet access after a firmware upgrade.

FTP Proxy experienced intermittent connectivity through an NPU VDOM link.

Asymmetric routing caused ICMPv6 traffic to be blocked when the original direction was NPU-offloaded but the reply direction was not.

Websites loaded slowly because packets larger than MSS generated many fragmentation-needed packets when firewall-policy NPU offload was enabled.

FortiGate did not respond when it received a low-TTL packet while a deny-all policy was configured.

`auth-ike-saml-port` responded on VIP or IP pool addresses when interface IP addresses did not match.

Video playback was disrupted because the RTSP session helper did not rewrite the destination field when SNAT was applied.

Packets were dropped when both `auto-asic-offload` and IPS were enabled.

Traffic was allowed by local-in policy 4294967295 when a VIP used port forwarding.

The firewall address table reached an unintended 20,000-entry limitation on FortiGate 900G under FortiOS 7.4.

A secondary SCTP session failed when an existing SCTP session used a source port different from the expected session.

Traffic disruption occurred when `egress-shaping-profile` was enabled with NPU offload.

FTP passive mode did not work through the helper session.

Packets were sent back over the same trunk interface when an EMAC VLAN was removed from an EMAC-over-LAG setup.

NetBIOS broadcast packets were forwarded on the same interface even when `netbios-forward` was disabled.

ICMP packets were dropped when hardware offloading was enabled.

An error condition occurred in confsyncd when file sizes changed between scans.

FortiGate failed to forward received fragmented UDP-ESP packets.

SSL VPN load balancing did not work correctly when `split-port` was set to `1-M1` and `1-M2` on FortiGate 6000 and 7000 platforms.

Management access was lost when FIM02 on the standby chassis became the primary worker.

Stale WebSocket connections caused persistent memory allocation errors or Node.js restarts.

The GUI page timed out when the administrator profile used the never-timeout option.

Filtering services became unavailable when Anycast was enabled.

Node.js writing to a closed socket caused memory-usage problems.

Toggling a security posture tag in a ZTNA policy automatically enabled NAT.

Saving a packet capture failed in Chromium-based browsers.

The LDAP password was removed when the user pressed OK.

Changing an aggregate-interface member in FGCP active-active mode disrupted traffic.

An `ips.sensor` attribute change without recalculation of the cached checksum caused HA synchronization failure after upgrading from 7.4.3.

Traffic was disrupted while moving VDOMs between VClusters.

The secondary unit experienced high CPU usage when started in an Azure vWAN SD-WAN NGFW deployment with dynamic rerouting.

An undestroyed FGFM session prevented creation of a new session after HA failover.

A split-brain condition in GCP caused route-table deletion.

Large FQDN response packets caused packet-size problems during synchronization in autoscaling environments.

A slave EMAC VLAN member responded to ARP requests in an HA setup using LACP and VLAN, resulting in packet loss.

CGNAT VDOM configuration caused memory-usage problems in hyperscale deployments.

Traffic was disrupted when an interface's VDOM was changed.

Egress shaping did not enforce bandwidth limits on VPN IDs using IPIP-encapsulated IPsec interfaces because forwarding across multiple NPUs was handled incorrectly.

IPsec traffic could stop in SOC4 corner cases when the outbound process became unresponsive.

IKED consumed increasing memory and could force the device into conserve mode.

A transport-mode IPsec phase 2 configuration could not successfully set a nonzero protocol.

Traffic using GRE encapsulation through phase 2 transport mode was dropped by anti-spoof checking.

IPsec tunnel problems occurred on SOC4 platforms when NPU offload was enabled.

An error condition occurred in IKE when TCP transport was used.

The `auth-ike-saml-port` setting was lost when configured as 10443 and the FortiGate rebooted or was updated.

CPU utilization increased under high traffic and session load when remote-access VPN users connected or disconnected.

IPsec tunnels became stuck and traffic was intermittently disrupted when the engine hung on SOC4.

IPsec traffic was intermittently disrupted when IKE tunnel status became out of sync with the kernel.

Enabling DPDK caused intermittent BGP disruption.

RADIUS authentication failed when packets fragmented over IPsec tunnels.

A write-sequence problem in the IPsec tunnel manager caused traffic disruption.

Traffic dropped when a tunnel ID changed from a random `10.0.0.x` address to the remote gateway's public IP.

FortiGate could incorrectly block packets belonging to established TCP sessions when no corresponding IPS session existed.

Packets exceeding the MTU caused delayed acknowledgments and unintended behavior.

Legitimate traffic that did not create a session could be disrupted in NGFW mode.

The IPS engine exhibited unexpected behavior while processing HTTPS traffic over HTTP/2 in certain configurations.

Inefficient RTSP decoder resource management caused high CPU usage while processing multiple streams.

The SCADA dissector caused unintended IPS engine behavior.

Multiple HTTP/2 connections with many open streams caused high memory usage.

HTTP/2 connections containing many open streams caused high CPU usage.

HTTP/2 streams were not closed correctly, causing memory-usage issues.

A gradual increase in IPS engine AnonPages memory forced the system into conserve mode.

The IPS engine encountered an error when `outbreak-prevention-archive-scan` was enabled.

IPS engines encountered an error when the Lua stack size was exceeded.

QUIC traffic triggered an IPS engine error that caused BFD sessions to flap.

FortiGate lost connectivity with FortiAnalyzer after `interface-select-method` was changed to SD-WAN and DNS resolution failed.

Authentication logs were missing when two-factor authentication timed out during SSL VPN authentication.

Alert email was not sent when the device rebooted in HA mode.

WAD encountered an error when `wad-restart-mode` was `time` and `wad-restart-start-time` and `wad-restart-end-time` were configured.

SSL errors occurred for a specific website because of an unexpected record type when Web Filtering and DPI were enabled in flow mode.

WAD preferred the default FortiGuard CA bundle over user-installed CAs while building chains for cross-signed server certificates.

HTTP status 302 was not forwarded to clients when `ssl-http-location-conversion` was enabled.

An incorrect SD-WAN rule was selected when `fib-best-match` was configured under a zone.

BGP service was disrupted when a LAG interface flapped.

The BGP default route was not installed when `capability-default-originate` was enabled.

BGP peers flapped under stressful traffic on an interface configured with top-priority QoS.

QTM fixes address incorrect checksums after fragmentation, hangs from packets longer than 6000 bytes, hangs during refresh, and failure to honor MTU and fragment packets. NP7 policy, per-IP, and ordinary port shaping use TPE; interface shaping profiles, also called Multiclass Shaping (MCS), use QTM.

QTM-based shaping profiles are supported on physical, LAG, and VLAN interfaces over physical or LAG links, with a maximum of 100 interfaces.