FortiOS 7.4.13 release notes

The New features or enhancements page lists no release-specific additions and refers readers to the FortiOS 7.4 New Features Guide.

Previously, traffic could bypass inspection while the IPS engine was starting, upgrading, or manually stopped. NGFW policy-mode VDOMs now drop traffic when IPS sockets are unavailable.

Devices may now use these command scopes before registration for central management, ZTP, and LTP configuration: `config firewall policy`, `config router setting`, `config router static`, `config router static6`, `config system admin`, `config system central-management`, `config system dns`, `config system interface`, `config system pppoe-interface`, and `config system settings`.

The command `config system npu` / `set default-qos-type {policing | shaping}` / `end` can no longer select `shaping`; `default-qos-type` may only be set to `policing`.

For NP7 sessions, policy traffic shaping, per-IP shaping, and regular port shaping always use the TPE accounting and shaping module. Interface shaping profiles, also called multiclass shaping, use QTM exclusively. Supported interfaces include physical, LAG, and VLAN interfaces over physical or LAG links, with a maximum of 100 interfaces.

FortiOS 7.4.13 addresses the referenced vulnerability. Fortinet directs users to FortiGuard PSIRT for further information.

Starting with FortiOS 7.4.4, proxy-related features are no longer supported on FortiGate/FortiWiFi 40F, 50G, 60E, 60F, 80E, and 90E series and variants, plus 2 GB FortiGate-Rugged 60F models.

The `shaping` value is no longer available for `default-qos-type`; only `policing` is permitted.

Select FortiGate/FortiOS, the exact product model, current version, and target version in Fortinet's Upgrade Path Tool. Do not infer a direct upgrade path from version numbers alone.

An individual FortiGate can be upgraded manually or automatically according to the FortiGuard upgrade path.

Multiple FortiGate devices in a Security Fabric can be upgraded manually, immediately, or on a schedule according to the FortiGuard upgrade path.

Verify all FIMs and FPMs are synchronized and healthy before upgrading, after each step in a multi-step path, and after completion.

FortiGate 6000 management boards and FPCs, and FortiGate 7000 FIMs and FPMs, run the same image. Start the upgrade from the primary 6000 management board or the primary FIM in the primary 7000 chassis.

For a FortiGate 6000/7000 FGCP cluster, use `config system ha` / `set upgrade-mode uninterruptible` / `end`. During the process, the secondary upgrades first, traffic fails over, and the original primary then upgrades.

Use `config system ha` / `set session-pickup enable` / `end` to improve session synchronization during a graceful upgrade.

For 7000F, session pickup requires `session-sync-dev`. Fortinet recommends a LAG using the slot-1 and slot-2 FIM M1 100 Gbps management interfaces connected through a switch. Configuration includes `config system ha`, `set upgrade-mode uninterruptible`, `set session-sync-dev <lag>`, `set session-pickup enable`, and `end`.

Standalone 6000/7000 systems and clusters using `upgrade-mode simultaneous` upgrade all components in one step and can interrupt traffic for several minutes. Schedule during a quiet maintenance period.

Some firmware upgrades do not support `upgrade-mode uninterruptible`; verify support in the release notes before starting.

Fixes incorrect fragment checksums after QTM, hangs caused by packets longer than 6000 bytes or refresh operations, and failure to honor MTU and fragment packets after QTM.

DLP now filters documents when a MIP label is in an OLE XML stream or an unencrypted MS Office Open XML file.

SRV records are no longer redirected to the management interface when a DNS filter profile is applied.

Corrects an issue in which the DNS over TLS server appeared unreachable.

Fixes intermittent HTTPS request timeouts when proxy-based UTM inspection is enabled on a Virtual Server VIP.

PAC file data is preserved when deleting a VDOM named `root`.

Corrects queue behavior that dropped high-priority traffic during bursts on low-priority queues.

Fragmented packets are no longer dropped when an egress shaping profile is configured on a VLAN interface.

Fixes `default-qos-type` unexpectedly changing to `policing-enhanced` after reboot.

Traffic shaping remains functional when SD-WAN load balancing is enabled across a reboot.

Traffic is no longer blocked with `auto-asic-offload` enabled in a back-to-back EMAC VLAN and inter-VDOM-link topology.

VXLAN traffic now passes when hardware offloading is enabled.

Fixes traffic fragmentation issues when packets traverse multiple VDOMs.

L2TPv3 packets are no longer discarded because protocol 115 is absent from the known-protocol list.

Fixes unexpected QTM behavior when an egress shaping profile is configured on the parent of a VLAN interface.

The `TLS_AES_256_GCM_SHA384` cipher suite is now advertised when an EC384 certificate is used on a VIP.

Corrects installation failure when a firewall policy contains a large number of address objects.

Corrects traffic disruption when offloading is enabled in a firewall policy.

Corrects traffic shaping when memory optimization settings are applied.

Corrects dropped fragmented IKE packets on FortiGate 6000/7000 platforms.

Clarifies that FGCP HA is not supported between AC-powered and DC-powered FortiGate 6000F, 7000E, or 7000F chassis.

Corrects internet traffic disruption caused by an `httpsd` error condition after upgrading to 7.4.8.

Corrects memory usage problems associated with the V8 JavaScript engine.

Corrects memory growth caused by a V8 ExternalPointerTable leak.

Rebooting a secondary active-passive member no longer causes split-brain, unintended ARP broadcasts, and traffic loss.

Corrects FGSP session synchronization issues when FGSP links have high latency.

DHCP server offers now use the virtual MAC rather than the physical MAC when HA forms after reboot or upgrade.

Adding a new VDOM on the HA primary no longer causes cluster synchronization failure.

TCP/135 traffic now works with the DCE-RPC session helper and asymmetric traffic in FGSP transparent mode.

Corrects authentication failures caused by a serial-number mismatch during HA failover.

Corrects session synchronization in FGSP deployments over an FGCP cluster.

Corrects traffic blocking after HA failover when the IKE NAT port changes.

Fixes IPS engine error conditions during FortiGate-200E stress traffic, with Thread Protection enabled, and with FortiSandbox enabled.

Corrects an IPS engine error condition when Thread Protection is enabled.

Corrects an IPS engine error condition when FortiSandbox is enabled.

Corrects Malicious Certificate Database update issues in NGFW policy mode.

A ClientHello larger than the MSS no longer generates an SSL error when retransmitted to the server.

Local-in Virtual Patch now inspects traffic using the HA-MGMT interface.

Corrects traffic drops with `npu-offload` enabled under an IPsec phase1 interface.

Corrects traffic disruption when FortiExtender or LAN Extension sessions are offloaded on FortiGate.

IPsec tunnels no longer fail when IKE Diffie-Hellman processing encounters the corrected condition.

FortiGate now avoids sending the full DN instead of the CN in DHCP Option 61 during IKEv2.

Corrects reduced MTU when IPsec with GCM is used on 9xG and 12xG devices.

Corrects traffic forwarding failures with NPU offload enabled for IPsec VPN.

Corrects negotiation timeout when an OTP is entered within its 120-second validity period.

IPsec dial-up VPN connections now tolerate the corrected username case-sensitivity condition for RADIUS users.

Corrects high memory usage when VWL triggers shortcut offers for existing tunnels in an SD-WAN ADVPN deployment.

Corrects unexpected system behavior when receiving large ICMP packets over IPsec with NPU offload enabled.

Corrects data transmission issues in IPsec tunnels with `npu-offload` enabled.

Enabling `system.settings.ike-policy-route` after configuring an IPsec tunnel no longer prevents ESP traffic from reaching the egress interface.

Log field information is no longer lost when URL or Referrer headers exceed the prior character limit.

Corrects failure to send OT information to FortiAnalyzer when many IoT/OT vulnerabilities are generated.

FortiGate no longer loses the FortiAnalyzer serial number when failing over between primary and secondary FortiAnalyzer systems.

Corrects blocking or bypass when the first ClientHello TCP segment payload is 1024 bytes or less.

Corrects intermittent page-reachability failures when QUIC authentication is required.

Corrects high memory use with inline IPS, long-lived connections, and IPS database updates.

Corrects an error condition in WAD during peer-port validation.

WAD remains responsive when an FSSO lookup returns no user and no proxy policy matches.

Corrects VRRP failure when a hardware switch is used.

Routing tables are no longer incorrectly assigned to VRF 0 when restoring a VDOM configuration.

Corrects SD-WAN speed-test failure in BGP-over-loopback designs.

Corrects packet loss observed after the specified upgrade path.

Corrects high CPU usage when SFTP backup automation is configured.

Corrects an Autod error when deprecated triggers are deleted during upgrade to 7.4.12.

Corrects an SSL-VPN-related security vulnerability triggered by connecting to a malicious SSH server sending crafted packets.

Corrects virtual VLAN switch forwarding with STP enabled in HA setups containing multiple members.

Corrects a system hang when deleting a VDOM while IPv6 traffic remains present.

Corrects VDSL connection failure and failure to acquire an IP address from a DSL modem.

Corrects TCP packet loss over VLAN and redundant-port combinations.

Corrects proxy-ARP configuration failure when an address group exceeds 256 entries.

Corrects excessive bandwidth consumption from downloading the complete Malicious Certificate Database on every update.

Corrects configuration loss when FortiGate enters extreme low-memory mode.

Corrects intermittent reboots when Wi-Fi clients connect using RADIUS or 802.11ax bands.

Corrects intermittent FortiGate-71G reboots caused by an IPS engine error condition.

Corrects uneven bandwidth distribution when LACP is used after upgrading to FortiOS 7.4.

Fixes dropped third-party CAPWAP fragments traversing NP7 or NP7Lite FortiGate systems.

Corrects UWDB header-only delta update failure and IPGO `bspatch` delta update errors.

Off-network `.lic` files generated on Windows no longer produce `FortiGate Manual License is invalid` during TFTP upload.

Private-data encryption no longer wipes IPsec PSKs on TPM-equipped platforms when upgrading from 7.2.13 to 7.4.11.

Corrects loss of selected `config system global` settings, including hostname, timezone, `admin-scp`, and `vdom-mode`, when upgrading from 7.6.6 to 7.6.7.

Using `execute restore secondary-image` no longer prevents FortiGate from booting into the secondary partition.

Corrects an `fnbamd` error when two peer users are referenced during certificate authentication.

Corrects token verification failure caused by username case mismatches for LDAP users with 2FA.

WAD remains responsive when authentication configuration changes during a SAML authentication loop.

The SDN connector can manage Azure vWAN deployments in the GermanyWestCentral location.

Azure VM live migration no longer clears RPS settings under `config system affinity-packet-redistribution`.

The web-filter profile table size now reports 512 instead of 32.

Corrects a missing SSID interface in the routing table after FortiManager pushes configuration.

Corrects invalid PMKID and reassociation rejection failures during fast transition roaming.

After upgrading to 7.4.13, sites on nonstandard HTTPS ports such as 8443 or 8011 may return `net::ERR_EMPTY_RESPONSE` when deep inspection is enabled; standard HTTPS sites continue to work.

Web pages may not load when `persistent-cookie` is disabled for session-cookie authentication with captive portal.

Packets can be forwarded to an offline server when the active-passive load-balancing method is used.

Creating or deleting a shaper on Policy & Objects > Traffic Shaping clears counters for other shapers.

Address objects cannot be filtered correctly using CIDR notation in the GUI.

IPv6 routes may be inconsistently synchronized among FIMs and FPMs.

After failover, the IPsec route may be absent from the kernel. Workaround: bring the tunnel down and back up.

FortiManager may move management interfaces configured by `config system ha` / `set session-sync-dev 1-M1 1-M2` / `end` from `vsys_ha` to `mgmt-vdom`. Reconfigure `session-sync-dev` on the cluster, then retrieve the configuration into FortiManager.

IPv6 fragment traffic may fail intermittently.

With HA override enabled, the original primary may reclaim its role before FPCs or FPMs are fully online and synchronized, causing traffic loss and session failures.

An uninterruptible upgrade from 7.2.13 to 7.4.13 may fail.

Drilling into a malicious website entry can report failure to retrieve FortiView data from disk.

The Internet Service Database slide-out may not scroll to the end when it contains more than 100,000 entries.

A working SFP port can appear grayed out. This is display-only; use the CLI interface list to verify status.

Custom HTML configured through the GUI or CLI may not render correctly on login pages.

Dynamic VLANs are not visible in the GUI when a port-security policy is active.

If the secondary takes several minutes to boot, the GUI may time out and display `Image upgrade failed` even though the upgrade completes.

HA synchronization fails when members have different private keys.

A cluster cannot obtain contract information for all members if they are registered under different FortiCare accounts.

A certificate-related condition can cause HA synchronization failure.

No upgrade button appears for a secondary in `local-only` or `secondary-only` MVC mode. Workaround: upgrade the secondary through the CLI.

LACPDU transmission issues may occur when failover is triggered by a monitored-port disconnect.

In new VRRP-based FGSP setups, the peer may report 50% fewer sessions.

Hardware sessions may not synchronize when one member of `hw-session-sync-dev` is down.

An unclean receive-session state may trigger unintended deletion after FGSP failover.

IPv6 TCP/UDP traffic may fail when a threat-feed object is included in an IPv6 High Security policy.

Unsupported `hw-session-sync-dev` ports can break hardware session synchronization. Change the interface and reboot; correcting only the configuration may not restore service.

Approximately 60 million connections with `log2host` followed by failovers can leak memory in the log2host table.

Not all hardware sessions may synchronize to the new secondary after failover.

GRE-over-IPsec traffic, or IPsec traffic with GRE encapsulation, is not offloaded on NP7-based units.

GRE over IPsec may fail in transport mode.

IPsec VPN over `vdom-link` or `npu-vlink` is unsupported on FortiGate 6000/7000.

Tunnel traffic may be encrypted as FortiGate-ESP packets when transport is UDP and FortiGate-ESP is enabled. Workaround: disable `fortinet-esp` when transport is UDP.

A DH group mismatch may produce `INVALID_KE` when the peer proposes an allowed group in an unexpected order.

A proxy-based inspection policy may require a reboot after upgrading a 2 GB RAM model.

HTTP/2 requests with multiple Cookie header fields may be blocked. Workaround: `config web-proxy global` / `set strict-web-check disable` / `end`.

HTTP header validation can cause dynamic fabric-address creation through the FortiNAC REST API to fail.

Since 7.4.1, local-out traffic can use different routes or ports under ECMP. For source-sensitive traffic, specify an interface or SD-WAN, for example: `config system fortiguard` / `set interface-select-method specify` / `set interface "wan1"` / `end`.

IPv6 routes may persist incorrectly in the kernel routing table.

An SFTP backup triggered by an automation stitch can fail in an HA cluster when Windows-style paths are used.

A fresh image burn may leave the appliance stuck, although upgrades from previous versions work. Workaround: power-cycle the unit.

FortiGate may become unresponsive when `default-qos-type` is set to `shaping`.

NP7 can stop forwarding traffic after reassembling a large packet in DFR.

TCP over VXLAN may be affected when both UTM and `auto-asic-offload` are enabled. Workaround: disable `auto-asic-offload` on the affected policy.

A prior `5000auto` setting may not behave like the newer `auto` mode after upgrading to 7.4.9. Workaround: manually set port speed to `auto`.

A VLAN over a physical interface or LAG may lose its configured MTU after reboot.

After upgrading FortiGate from 7.4.5 GA to 7.4.6 GA, FortiExtender may be offline. Workaround: reboot FortiExtender manually.

Chrome clients cannot use NTLM authentication in the affected configuration.

Searching more than 100,000 LDAP users through the GUI may cause `httpsd` to consume excessive memory and freeze the appliance. Workaround: use the CLI; recovery may require killing `httpsd` or rebooting.

Additional Microsoft restrictions on remote Event Log reading can prevent agentless FSSO operation with Windows Server 2025.

In a GWLB setup, SYN-ACK packets can contain a zero-length GENEVE VNI, causing retransmissions.

With more than 500 FortiAPs and 5,000 clients, Managed FortiAP and FortiAP Status pages can load slowly; operation is unaffected.

Offline station records may not be cleaned up over time, increasing memory use.

Mapped drives using a FortiGate ZTNA access proxy with FQDN destinations can become inaccessible after reboot.

The release's general Special notices page contains no additional notice text; model-specific proxy and chassis notices are captured separately.