FortiOS 7.4.12 release notes

During the 7-day setup period, administrators can manually upgrade or downgrade through the GUI or CLI. After that period, device registration is required.

Adds the default automation stitch Firmware Upgrade Complete, trigger Auto Firmware Upgrade Complete, and action Auto Upgrade Complete Email Notification. Firmware-upgrade email wording is clearer, and the former Firmware Upgrade Notification default stitch is disabled.

Administrators can dismiss selected firmware-upgrade prompts for extension devices. Distinct log IDs identify automatic versus manual upgrades, email alerts provide detailed status, and the login GUI requests confirmation of the auto-upgrade preference after auto-upgrade is disabled and an update is performed.

FCPC accepts a ForcedUpdate flag and major.minor.patch-build version information. If a FortiGate firmware license is invalid, FortiGuard can ignore the license check and allow an upgrade when the source and target firmware share the same major and minor version. Logs, notifications, and automation stitches more clearly identify automatic and required upgrades.

NGFW policy-mode VDOMs now drop traffic when IPS sockets are unavailable, including during startup, IPS engine upgrades, or manual IPS shutdown, instead of potentially bypassing inspection.

Pre-registration access now includes `config firewall policy`, `config router setting`, `config router static`, `config router static6`, `config system admin`, `config system central-management`, `config system dns`, `config system interface`, `config system pppoe-interface`, and `config system settings` to support central management, ZTP, and LTP.

For NP7-offloaded sessions, `config system npu` with `set default-qos-type {policing | shaping}` can no longer select shaping; `default-qos-type` can only be set to `policing`. Policy, per-IP, and regular port shaping use TPE, while interface shaping profiles use QTM.

Communication no longer breaks when application control is used in a policy over EMAC VLAN interfaces.

Protocol Enforcement now blocks applicable DNS-over-TCP traffic when non-DNS TCP traffic uses port 53.

Corrects client and server cookies returned for cached entries with conditional forwarding and EDNS cookies.

Fixes DNS-over-TLS failure on FortiGate 201E running FortiOS 7.4.10.

Corrects an error condition while WAD handles multiple responses from an upstream server.

Fixes an HTTP 303 redirect loop when accessing websites through an SWG SSO connection.

Corrects unexpected behavior when video filtering is enabled and multiple requests target the same video ID.

Corrects an error condition while handling server responses containing 100 Continue and 200 OK status codes.

Resolves CPU usage issues caused by SAML authentication with SWG and many users.

File filtering now blocks applicable MSI downloads in flow mode.

Fixes traffic failure when GRE pass-through uses a tunnel key of zero during offload.

Fixes possible traffic bypass in NGFW policy-based mode while the IPS engine is unavailable.

Fixes packet loss when ASIC offloading is enabled on SoC5 models with an ingress shaping profile.

VLAN interfaces no longer show zero receive/transmit bytes and packets when fastpath is disabled on FortiGate 6000/7000 platforms.

Fixes traffic forwarding failure when the primary FPM does not send GARP to the connected switch after failover.

Prevents both nodes from responding to ARP requests after the HA table is edited under `config system ha`.

Restores HTTPS GUI access after upgrading to FortiOS 7.4.11 when using a Low Encryption license.

Fixes verification failure during HA image upgrade when BIOS security level is High.

Corrects RX drops on HA1 and HA2 ports after upgrading the i40e driver.

Fixes instability when the primary FIM is rebooted after failover using `diagnose sys ha reset-uptime`.

Fixes disruption when many firewall policies are installed after failover during a cluster upgrade.

Restores receive traffic when unicast heartbeat is enabled on FortiGate-VM64 with SR-IOV.

Corrects packets sent by the secondary member with the cluster MAC address after failover.

Fixes heartbeat loss when highest priority is not restricted to heartbeat, routing, and LACP traffic.

Fixes authentication failures caused by Azure SDN connectors reusing incorrect tenant tokens after failover.

Fixes License Status: Warning when the root VDOM is active on the primary of a FortiGate-VM HA active-passive cluster using VDOMs and virtual clustering.

Fixes dropped ICMPv6 type 2 packets when SIP ALG and Hyperscale are enabled.

Fixes reply traffic drops when the anti-spoof check fails.

Fixes IKEv2 connection failure with a gw validation failed error when the peer ASN1DN ID has multiple OU fields.

Fixes traffic drops caused by mismatched source IP and selector range.

Corrects an error condition when Duo Proxy LDAP is used with MFA.

Fixes peer-selection failure with AES256GCM-PRFSHAxxx encryption proposals.

Fixes tunnel disruption when rekey completes with deletion of the wrong CHILD-SA.

Fixes high CPU usage when IPsec over TCP receives an RST packet.

Fixes SAML IPsec VPN connection failure when the client is connected through a Wi-Fi Tunnel SSID.

Corrects an IPS engine error when accessing safebrowsing.google.com.

Fixes channel-page blocking when an inline IPS video-filter profile contains both channel and category settings.

Corrects an IPS engine error encountered on this upgrade path.

Existing sessions are now marked appropriately to prevent an outage when nTurbo acceleration is disabled.

Corrects an IPS engine error during HTTP processing.

Resolves high CPU usage during SMB traffic scanning.

Corrects an ipsengine error encountered during upgrade to FortiOS 7.4.11.

Corrects an IPS engine error when switching packet-layer modes.

Corrects an IPS engine error while handling unusual TLS 1.3 stacks.

Corrects an IPS error when handling high volumes of application traffic.

Resolves excessive CPU usage during ipsengine operation.

IPS log-packet files are now cleaned up when retention exceeds maximum-log-age.

Restores secondary-unit logs for HA clusters running FortiOS 7.4.9 and later.

Corrects an error condition in the GeoIP database during updates.

Restores certificate-chain transmission during SSL inspection after upgrade.

Corrects an error condition while WAD handles large query responses.

Fixes high memory usage when HTTP/2 is enabled on a firewall VIP whose real server supports only HTTP/1.1.

Fixes empty responses when pageSize exceeds 105 on a FortiGate HTTPS virtual server.

Corrects a WAD error during proxy web-filter SSL stress tests.

Fixes IPv6 BGP flapping when a FortiGate FGSP cluster connects to Dell Sonic.

Fixes route flapping when external routes are redistributed into BGP.

The interface status no longer becomes Unknown while the health-check SLA is good.

Fixes high memory usage in multi-VDOM SSL-VPN deployments.

Prevents blocked IP addresses from being cleared before login-block-time expires when VDOMs have different settings.

Fixes PCI scanning on the SSL-VPN port when HTTP/1.0 is used.

Corrects an sslvpnd error while handling firewall policy schedules during peer-user authentication.

Fixes authentication failure on FortiOS 7.4.11 when username and OTP are concatenated.

Fixes managed FortiSwitches going offline when FortiGate is upgraded from 7.2.10 to 7.4.x.

Fixes firmware download failure when one firewall attempts to obtain FortiSwitch firmware from FortiGuard.

Fixes Windows Wi-Fi clients failing to obtain DHCP addresses because fragmented CAPWAP packets were dropped.

Corrects unexpected FortiGate behavior while processing IPv6 traffic with invalid destination entries.

Corrects unexpected kernel behavior under stressful multicast traffic through VXLAN in a switch interface.

Corrects unexpected kernel behavior when forwarding ICMP error messages from NAF devices.

Fixes high memory usage when SYN flood attack behavior is detected.

Fixes dial-up IPsec instability after upgrading from 7.4.9 to 7.4.11.

Fixes zero throughput during netperf testing caused by enabled 1G SFP autonegotiation.

Fixes memory usage caused by logging on FortiCarrier-4400F.

Fixes high CPU usage when creating or editing a VLAN interface through the GUI.

Fixes an update-daemon error caused by updating databases while CMDB is still loading its JSON file.

Prevents the serial number changing to FGT0000000000001 on D-series devices with older BIOS when upgrading to 7.4.10, 7.4.11, 7.6.5, or 7.6.6.

Fixes required automatic upgrades that may fail on unlicensed or end-of-support devices.

Fixes errors while downloading intermediate CAs through multiple Authority Information Access links.

Fixes hardware token activation failure when CMDB write permission is enforced.

Fixes certificate auto-enrollment through CMPv2 using an intermediate CA certificate after upgrade.

Corrects an fnbamd error when DNS responses contain multiple IP addresses.

Restores accounting logs when the TACACS+ accounting server uses per-VDOM interfaces.

Fixes LDAPS negotiation failure when FortiGate connects to OpenLDAP using TLS 1.3 and PQC parameters.

Fixes authentication failure when certificate rotation occurs on a standalone HA primary FortiGate.

Fixes trusted launch failure for FGT_VM64_AZURE.

Fixes FortiGate-VM license validation through FortiManager using an IPv6 address.

Corrects license-validation behavior when FortiGate connects to FortiManager in an air-gapped AWS environment.

Fixes FortiGate KVM boot failure after upgrading from 7.2.12 to 7.4.11.

Fixes a license-status warning when the secondary validates its VM license after upgrading to 7.4.10 or 7.4.11.

Restores effective video blocking after a YouTube API change.

Fixes video blocking from the YouTube main page when channel filters are used.

Fixes incorrect fragment checksums after QTM, hangs caused by packets longer than 6000 bytes, hangs during refresh, and failure to honor MTU and fragment packets after QTM.

Policy traffic shaping, per-IP shaping, and regular port shaping with outbandwidth but no shaping profile always use TPE. Interface shaping profiles, also called Multiclass Shaping, use QTM on physical, LAG, or VLAN interfaces. At most 100 interfaces can have shaping profiles.