FortiOS 7.4.11 release notes

The Queuing based Traffic Management (QTM) module now fixes incorrect fragment checksums, hangs caused by packets longer than 6000 bytes, hangs during refresh, and failure to honor MTU and fragment packets after QTM.

For NP7-offloaded sessions, `default-qos-type` can only be set to `policing`; administrators can no longer select `shaping` with `config system npu set default-qos-type {policing | shaping} end`.

For NP7 sessions, policy traffic shaping, per-IP shaping, and regular port shaping where `outbandwidth` is enabled without a shaping profile always use the NP7 accounting and traffic-shaping TPE module, equivalent to `default-qos-type policing`. Interface shaping profiles, also called Multiclass shaping (MCS), now use QTM exclusively, equivalent to `default-qos-type shaping`.

Fortinet identifies this vulnerability fix under bug 1246654. Consult FortiGuard PSIRT for additional information.

The command `diagnose ip rtcache list` is no longer supported in the FortiOS 4.19 kernel.

After upgrade to FortiOS 7.4.10, 7.4.11, 7.6.5, or 7.6.6, affected D-series devices may report serial number `FGT0000000000001`.

New in FortiOS 7.4.11.

When connected to FortiAnalyzer, its logs are not visible through the FortiGate GUI or CLI. New in FortiOS 7.4.11.

TCP traffic over VXLAN is impacted when both `auto-asic-offload` and UTM are enabled on the policy. Workaround: disable `auto-asic-offload` on the affected policy. New in FortiOS 7.4.11.

An error occurs when downloading intermediate CAs through multiple Authority Information Access links. New in FortiOS 7.4.11.

Web pages do not load when `persistent-cookie` is disabled for session-cookie-based authentication with captive portal.

Creating or deleting a shaper on Policy & Objects > Traffic Shaping clears counters for the other shapers.

The GUI cannot correctly filter Address objects using CIDR notation.

Packet loss may occur on SoC5 FortiGate models when ASIC offloading is enabled and an ingress shaping profile is configured.

IPv6 routes may not synchronize correctly among FIMs and FPMs.

Workaround: bring the tunnel down and then back up.

On FortiGate 7000F with virtual clustering and syslog configured, running a diagnose log test from a primary-vcluster VDOM may not produce messages from some FPMs.

After the secondary rejoins the cluster, SIP sessions are not resynchronized.

FortiManager may change management-interface VDOMs used by `set session-sync-dev 1-M1 1-M2` from `vsys_ha` to `mgmt-vdom`, stopping them from operating as session-sync interfaces. Workaround: reconfigure `session-sync-dev` on the cluster, then retrieve the FortiGate configuration into FortiManager.

Counter values may not match totals and can overflow during continuous clearing on certain FortiGate models.

SSH login attempts through special ports fail for VDOM administrators with `mgmt-vdom` access on SLBC FortiController models.

The secondary chassis may lack its subscription license after a graceful upgrade from 7.2.10 to 7.2.12. Workaround: run `execute update-now` again.

FortiView Threats may report that it failed to retrieve FortiView data from disk when drilling into a malicious website entry.

The GUI slide-out cannot reach the end when an Internet Service Database entry contains more than 100,000 items.

This is a GUI-only display problem. Workaround: view SFP status in the CLI interface list.

The GUI has no setting for the `type` option on an `npu_vlink` interface.

Custom HTML content configured through the GUI or CLI does not render correctly on login pages.

Dynamic VLANs are not visible in the GUI when a port-security policy is applied.

If the secondary takes several minutes to boot, a premature timeout can display "Image upgrade failed" even though the HA upgrade can complete successfully.

If HA members are not registered under the same FortiCare account, the cluster cannot retrieve contract information for all members from FortiGuard.

HA can become out of sync due to a certificate.

The button is absent in local-only or secondary-only MVC upgrade mode. Workaround: upgrade the secondary from the CLI.

In new VRRP-based FGSP setups, the peer reports approximately 50% fewer sessions.

Hardware sessions may not synchronize when one of multiple `hw-session-sync-dev` interfaces is down.

The issue affects hardware session-sync devices and not software session-sync devices.

On 4201, hardware sessions are not synchronized when a member of `hw-session-sync-dev` is down.

A dirty Rsession can cause unintended session deletion after FGSP failover.

Using a threat-feed object in an IPv6 High Security policy can incorrectly disable IPv6 functionality and prevent TCP/UDP traffic.

Configuring unsupported ports for `hw-session-sync-dev` can stop hardware session synchronization. Workaround: change the interface and reboot; correcting the configuration alone does not restore operation.

Unsupported network interfaces can be added to a LAG configured for hardware session synchronization, creating potentially invalid configurations.

Renaming an IP pool in a VDOM deployment can cause unintended network-traffic behavior.

On 4401F, approximately 60 million connections with log2host configured and repeated failovers can produce a memory leak.

On 4401F, not all hardware sessions are synchronized to the new secondary after failover.

GRE over IPsec, or IPsec traffic with GRE encapsulation, is not offloaded on NP7-based units.

IPsec VPN over `vdom-link` or `npu-vlink` is unsupported on FortiGate 6000/7000 platforms.

Tunnel traffic is encrypted as FortiGate-ESP packets when transport is UDP and FortiGate-ESP is enabled. Workaround: disable `fortinet-esp` when transport is set to `udp`.

Proxy-based inspection policies on FortiGate models with 2 GB RAM require a reboot after upgrade.

REST API requests fail because of HTTP-header validation.

Since 7.4.1, local-out traffic can use different ECMP routes or ports. For source-sensitive traffic, specify an interface or SD-WAN, for example: `config system fortiguard set interface-select-method specify set interface "wan1" end`.

The IPoE tunnel interface cannot be selected in the Interface Bandwidth widget.

Security Fabric Asset Identity Center displays "Failed to load user device store data".

SFTP backup can fail when triggered by an automation stitch on an HA FortiGate using Windows-style paths.

Offline FortiSwitches appear offline in the topology but online in the list.

The `le-switch` member list is not updated after an interface role changes in a LAN-extension environment.

A fresh image burn may leave a FortiFirewall 2600F stuck, though upgrades from previous releases work. Workaround: power-cycle the unit.

A FortiGate may become unresponsive when `default-qos-type` is set to `shaping`.

NP7 `EIF0_IGR` and `EIF1_IGR` usage may remain at 100%, with host softirq near 99%, after IP-tunnel traffic.

Remote login produces one successful administrator event and one unsuccessful PKI-administrator event.

NP7 can cease forwarding traffic after reassembling a large packet in DFR.

When DIO module alarm functionality is active on FGR-70G and FGR-70G-5G-Dual, `set condition-type input` is unavailable under `config system automation-condition`.

After upgrading from 7.2.x behavior, FGT700G/701G `wan1`, `wan2`, and `lan1`-`lan6` may remain at `5000auto`, which in 7.4.9 operates only at 5000 Mb/s rather than negotiating to 1 Gb/s. Workaround: manually set port speed to `auto`.

Workaround: enable automatic web-service restart with `config system global set web-svc-auto-restart enable end`.

Workaround: configure an ACL to drop the known denial-of-service traffic.

Observed after upgrading FortiGate from 7.4.5 GA to 7.4.6 GA. Workaround: manually reboot FortiExtender.

After a FortiOS upgrade, the update daemon may update databases while CMDB is loading its JSON file, producing an error condition.

RADIUS group usage is not displayed correctly when the group is used for firewall-administrator authentication.

Searching an LDAP server with over 100,000 users from the GUI can make HTTPSD consume excessive memory, slowing or freezing the device and potentially requiring HTTPSD termination or reboot. Workaround: search through the CLI.

User names appear in lowercase, filtering does not work, and pie charts are not visible.

Additional Microsoft restrictions on remote Event Log reading affect the connector.

In FTP passive mode with a GWLB deployment, Geneve-header VNI lengths are zero in SYN-ACK packets, causing retransmissions.

The `set distance` option under an interface configured as a DHCP client does not work on virtual machines.

FGT_VM64_AZURE fails trusted launch on Azure.

FortiGate VM cannot validate its license from a FortiManager addressed through IPv6.

With more than 500 managed FortiAPs and 5,000 clients, Managed FortiAP and FortiAP Status can take a long time to load; FortiAP operation is unaffected.

Station logs may show RADIUS requests and challenges while the FortiGate fails to produce debug or sniffer logs for the affected user.

Offline station entries are not automatically cleaned up and may cause high memory usage.

Mapped drives become inaccessible after reboot when using a FortiGate ZTNA access proxy with FQDN destinations.

QTM-based shaping profiles are supported on physical, LAG, and VLAN interfaces over physical or LAG interfaces. A FortiGate supports shaping profiles on at most 100 interfaces.