FortiOS 7.4.8 release notes

The release is FortiOS 7.4.8 build 2795.

FG-40F, FG-40F-3G4G, FG-50G, FG-50G-5G, FG-50G-DSL, FG-50G-SFP, FG-50G-SFP-POE, FG-51G, FG-51G-5G, FG-51G-SFP-POE, FG-60E, FG-60E-DSL, FG-60E-DSLJ, FG-60E-POE, FG-60F, FG-61E, FG-61F, FG-70F, FG-71F, FG-80E, FG-80E-POE, FG-80F, FG-80F-BP, FG-80F-DSL, FG-80F-POE, FG-81E, FG-81E-POE, FG-81F, FG-81F-POE, FG-90E, FG-91E, FG-90G, FG-91G, FG-100F, FG-101F, FG-120G, FG-121G, FG-140E, FG-140E-POE, FG-200E, FG-200F, FG-201E, FG-201F, FG-200G, FG-201G, FG-300E, FG-301E, FG-400E, FG-400E-BP, FG-401E, FG-400F, FG-401F, FG-500E, FG-501E, FG-600E, FG-601E, FG-600F, FG-601F, FG-800D, FG-900D, FG-900G, FG-901G, FG-1000D, FG-1000F, FG-1001F, FG-1100E, FG-1101E, FG-1800F, FG-1801F, FG-2000E, FG-2200E, FG-2201E, FG-2500E, FG-2600F, FG-2601F, FG-3000D, FG-3000F, FG-3001F, FG-3100D, FG-3200D, FG-3200F, FG-3201F, FG-3300E, FG-3301E, FG-3400E, FG-3401E, FG-3500F, FG-3501F, FG-3600E, FG-3601E, FG-3700D, FG-3700F, FG-3701F, FG-3960E, FG-3980E, FG-4200F, FG-4201F, FG-4400F, FG-4401F, FG-4800F, FG-4801F, FG-5001E, FG-5001E1, FG-6000F, FG-7000E, and FG-7000F.

FWF-40F, FWF-40F-3G4G, FWF-50G, FWF-50G-5G, FWF-50G-DSL, FWF-50G-SFP, FWF-51G, FWF-60E, FWF-60E-DSL, FWF-60E-DSLJ, FWF-60F, FWF-61E, FWF-61F, FWF-80F-2R, FWF-80F-2R-3G4G-DSL, FWF-81F-2R, FWF-81F-2R-3G4G-DSL, FWF-81F-2R-POE, and FWF-81F-2R-3G4G-POE.

FGR-60F, FGR-60F-3G4G, FGR-70F, and FGR-70F-3G4G.

FFW-1801F, FFW-2600F, FFW-3001F, FFW-3501F, FFW-3980E, FFW-4200F, FFW-4400F, FFW-4401F, FFW-4801F, FFW-VM64, and FFW-VM64-KVM.

FG-ARM64-AWS, FG-ARM64-AZURE, FG-ARM64-GCP, FG-ARM64-KVM, FG-ARM64-OCI, FG-VM64, FG-VM64-ALI, FG-VM64-AWS, FG-VM64-AZURE, FG-VM64-GCP, FG-VM64-HV, FG-VM64-IBM, FG-VM64-KVM, FG-VM64-OPC, FG-VM64-RAXONDEMAND, and FG-VM64-XEN.

Special-branch models must report Branch point 2795. Run `get system status` and verify the Branch point field.

FG-30G, FG-31G, FWF-30G, and FWF-31G are released on build 5164.

FGR-50G-5G, FG-70G-POE, FGR-70G, FGR-70G-5G-DUAL, FG-71G, FG-71G-POE, FWF-70G, FWF-70G-POE, and FWF-71G are released on build 6345.

FGR-70G-5G is released on build 6402.

Supported models are FG-6001F, FG-6300F, FG-6301F, FG-6500F, and FG-6501F.

Supported models are FG-7030E, FG-7040E, and FG-7060E.

Supported models are FG-7081F and FG-7121F.

SSL certificates are misapplied when FortiGate processes requests with deny actions in proxy policies.

Improper dependency management can cause initialization ordering problems or missing dependencies in the WAD module.

The health check always uses an IP address as the host even when a full URL is configured in http-get.

On FortiGate 6000/7000, confsynchbd can fail to release a lock because of a file-permission issue, causing an FPM to hang after upgrade.

Repeated unresolved HA configuration merges can create duplicate interface entries, persistent synchronization failures, and redundant logs on FortiGate 6000/7000.

Counter values may not match totals and can overflow during continuous clearing on certain FortiGate models.

Configuration changes following enablement of `cfg-save revert` can produce unexpected behavior because of unresolved netdevice references in the NP7 driver.

An FPM may hang during login and remain out of sync after any chassis restart, including a firmware upgrade, because confsynchbd becomes stuck after a management heartbeat from the primary FIM. Workaround: place the active SMM and primary FIM in the same slot, such as FIM1 and SMM1; use the SMM `smm_switch` command to change the active SMM; then reboot all FPMs. This is not a permanent fix.

EMA Tag entries containing too many addresses may not be inserted correctly as dynamic address objects, causing traffic to miss the related firewall policy.

Adding or removing the Interface Bandwidth widget can cause multicast traffic to be dropped.

Erroneous memory allocation occurs when the Logical and Physical Topology pages are used.

Sessions are not synchronized correctly, leaving many sessions on the primary and causing the standby to enter conserve mode.

Port block allocation logs may be missing during an HA failover.

Renaming an IPsec phase1-interface in a cluster with many VDOMs can cause split brain.

FortiGate may fail to load factory-certificate private keys into fgfmd because they are classified incorrectly.

A certificate-related condition can cause HA synchronization failure.

With host logging (log2host) enabled, session counts may rise after several days and reduce throughput and CPS performance. Workaround: restart the FortiGate.

Changing an interface's VDOM can disrupt traffic. Workaround: replace default route 0.0.0.0/0 with static routes 0.0.0.0/1 and 128.0.0.0/1.

Race conditions during counter rollback can produce abnormal spikes in VPN sent-byte statistics.

Gateway switching can fail during IKE session resumption when moving from a FortiGate without Azure AD auto-connect enabled to one with it.

Attack-context logging can produce incomplete entries for attacks involving long user-agent strings.

The proxy user-device-store requires a limit based on a percentage of total system memory.

Under certain conditions, FortiGate may route SCTP traffic using outdated routes rather than the current optimal path.

IPv6 routes can become stuck in the kernel routing table.

The IPoE tunnel interface cannot be selected in the Interface Bandwidth widget.

Route maps can select an incorrect route during BGP redistribution because parent protocol distances are handled improperly.

SIP traffic can fail when TCP SYN-ACK packets use a different egress interface than SYN packets. Workaround: use UDP for SIP.

After an upgrade, SSL VPN web mode can display Access Denied on 2GB models.

Certain FortiGate models configured as VXLAN hubs in a hub-and-spoke topology may unexpectedly forward broadcasts between peers.

LACP/shared ports wan1 and wan2 may remain down after an upgrade or reboot because of hardware shared-port medium changes.

The dashboard Interface widget does not show graphs for some VLAN interfaces.

GUI and CLI data-structure differences can cause unexpected behavior while editing user exemption configurations.

Configuring the maximum number of sessions in global resources can return an "Input value is invalid." error.

NP7 may stop forwarding traffic after reassembling a large packet in DFR.

ASLR can cause memory-usage problems when upgrading from 7.4.7GA to 7.4.8GA. Workaround: disable proxy-inline-ips.

After an upgrade, the update daemon may attempt to update databases while CMDB is loading the JSON file, producing an error condition.

Captive-portal authentication can fail after FortiToken push approval during RADIUS authentication through FortiAuthenticator for remote groups.

A custom NAS-ID is not sent to the RADIUS server when connectivity is tested through the GUI.

FGT_VM_AZURE may fail to connect to other FortiGates in the Security Fabric tree.

The `set distance` option does not work on VM interfaces configured as DHCP clients.

The IPS engine may crash with DPDK enabled under stressed, fragmented IPsec traffic when `system affinity-packet-redistribution` is used.

IP address information on the WiFi Client GUI page may not match.

Adding an HTTPS/HTTP ZTNA server mapping through the GUI may fail with a duplicate-entry error; exiting after cancellation can alter URLs in existing entries.

Web pages do not load when `persistent-cookie` is disabled for session-cookie-based authentication with captive portal.

Creating or deleting a shaper on Policy & Objects > Traffic Shaping clears counters for other shapers.

With ASIC offload enabled, session counters are not updated and the GUI shows incorrect Bytes and Last Used values.

Address objects cannot be filtered correctly in the GUI using CIDR notation.

Source-port translation is not permitted for traffic to UDP port 7001.

IPv6 routes may not synchronize correctly among FIMs and FPMs.

After HA failover on FortiGate 6000/7000, the IPsec route may be absent from the kernel. Workaround: bring the tunnel down and then up.

On managed FortiGate 7000F virtual clusters, FortiManager can change management interfaces configured with `session-sync-dev` from mgmt-vdom to vsys_ha, stopping session synchronization. Workaround: reconfigure `session-sync-dev` on the cluster and retrieve the FortiGate configuration into FortiManager.

Fragmented IPv6 traffic may be dropped randomly.

Concurrent IP address management during VDOM migration can cause unexpected source-IP use on outbound connections and BGP flapping.

If the secondary takes several minutes to boot, the GUI may time out and display Image upgrade failed even though the HA upgrade can complete successfully.

If HA members are not registered to the same FortiCare account, the cluster cannot obtain contract information for all members from FortiGuard.

The secondary GUI has no upgrade button in local-only or secondary-only MVC upgrade mode. Workaround: upgrade the secondary through the command line.

Traffic over GRE over IPsec, or IPsec traffic with GRE encapsulation, is not offloaded on NP7-based units.

GRE over IPsec does not work in transport mode.

IPsec VPN over vdom-link or npu-vlink is unsupported on FortiGate 6000 and 7000 models.

After extended operation and multiple rekeys, incorrect vifid formation can leave tunnels stuck and cause ESP packet drops.

Proxy-based inspection behavior on 2GB RAM models may require recovery after an upgrade. Workaround: reboot the FortiGate after upgrading.

Since FortiOS 7.4.1, local-out traffic with ECMP routes may use a different route or port. For source-IP-sensitive traffic, use `interface-select-method` to specify an interface or SD-WAN path.

Editing a security profile whose name contains two forward slashes (//) can make the web page unresponsive.

An automation-stitch SFTP backup can fail on an HA FortiGate when Windows-style paths are used.

The device may become unresponsive when `default-qos-type` is set to `shaping`.

Packets may be dropped with auto-ASIC-offload and 802.1AD over LACP because QinQ LAG interfaces lack a MAC-address assignment.

Configuration loss can occur on FGT-60F when it enters extreme conserve mode.

Provisioning a certificate through ACME can leave FortiGate HA out of sync.

FortiExtender may show offline after upgrading FortiGate from 7.4.5 to 7.4.6. Workaround: reboot FortiExtender manually.

GUI LDAP searches against directories with more than 100000 users can consume excessive HTTPSD memory and impair operation. Recovery may require stopping HTTPSD or rebooting. Workaround: perform LDAP user searches through the CLI.

Agentless FSSO connector issues can occur because Windows 2025 adds restrictions to remote Event Log reading.

With over 500 managed FortiAPs and over 5000 WiFi clients, the Managed FortiAPs page and FortiAP Status widget can take a long time to load; FortiAP operation is unaffected.

Offline station entries may not be cleaned up automatically, causing high memory usage over time.

Mapped drives may become inaccessible after a laptop reboot when the FortiGate ZTNA access proxy uses FQDN destinations.