FortiOS 8.0.2 release notes

FortiOS no longer supports most proxy-related features on FortiGate models with 2 GB RAM or less. This affects the FortiGate 40F, 60F, and 50G series and their variants.

Security Rating is no longer supported on physical FortiGate devices with 2 GB RAM to improve device stability and reduce potential performance issues.

Security Fabric topology visibility is no longer supported on physical FortiGate devices with 2 GB RAM to improve stability and mitigate potential performance issues.

Select FortiGate/FortiOS, the product model, current version, and FortiOS 8.0.2 as the target in Fortinet's Upgrade Path Tool to obtain the supported upgrade sequence.

Individual FortiGate devices can be updated manually or automatically according to the FortiGuard upgrade path. Consult the FortiOS Administration Guide for the applicable procedure.

Multiple FortiGate devices in a Fortinet Security Fabric can be upgraded manually, immediately, or on a schedule according to the FortiGuard upgrade path.

Before upgrading a FortiGate 6000 or 7000, verify that all FIMs and FPMs are synchronized and operating normally. Repeat health checks after every step in a multi-step path and after the final upgrade.

In a FortiGate 6000 FGCP cluster, start the upgrade from the primary management board; the image is copied to all FPCs. In a FortiGate 7000 FGCP cluster, start it from the primary FIM in the primary chassis; the image is copied to the secondary FIM and all FPMs.

For FortiGate 6000/7000 FGCP clusters, enable graceful upgrade with `config system ha`, `set upgrade-mode uninterruptible`, `end`. The `uninterruptible` option is enabled by default. The secondary unit upgrades first, traffic fails over, and then the primary upgrades.

Enable session pickup with `config system ha`, `set session-pickup enable`, `end` to improve session synchronization during a graceful upgrade.

On FortiGate 7000F, session pickup requires `session-sync-dev`. Fortinet recommends a LAG formed from the M1 interfaces of the FIMs in slots 1 and 2, connected between chassis through a switch. Configure with `config system ha`, `set upgrade-mode uninterruptible`, `set session-syn-dev <lag>`, `set session-pickup enable`, `end`.

A standalone FortiGate 6000/7000, or an HA cluster using `upgrade-mode simultaneous`, upgrades all components in one step and may interrupt traffic for several minutes. Schedule it during a quiet period. Simultaneous mode is faster, while uninterruptible mode normally minimizes disruption; verify that the target release supports uninterruptible upgrades.

Local-in Virtual Patch fails to inspect traffic when using the HA-MGMT interface.

Eicar passes when the first security policy denies an application and the second enables AV scanning. Workaround: use wildcard policies to block AV reliably.

Traffic disruption occurs when WCCP is enabled. Workaround: direct all related traffic to the master FPC.

UESP packets are dropped when the VPN peer uses different source ports for IKE-NATT and UESP. Workaround: add a flow rule.

Traffic disruption occurs when kernel routes are not synchronized across the FPM. Workaround: run `diag test application chlbd 3` on the slot missing routes to trigger a manual route redownload.

The release notes list 6000F/7000F support for Multipath IPsec feature #1235059 as an existing known issue.

On 7121F-2 (FIM-7941), build b0245, a 100G FR transceiver link on 1-P4 fails when RS-FEC is enabled but works when FEC is disabled.

HA status on the Global Dashboard changes unexpectedly during a hard refresh.

The GUI shows the Fabric Connector as DOWN after failover on an Azure SDN Connector cluster. Workaround: log out of and back into the GUI.

Traffic logs cannot be viewed when Resolve unknown applications is enabled. Workaround: disable Resolve unknown applications in the global log settings.

The GUI becomes unresponsive when httpd is fully loaded on the forward traffic page. Workaround: disable Resolve unknown applications in the log settings.

Dynamic VLANs are not visible in the GUI when a port-security-policy is applied.

Incorrect HA status appears when switching to the mgmt-vdom VDOM on a FortiGate-6001F.

Connection loss occurs when web-svc-perf is enabled under log settings. Workaround: disable web-svc-perf under log settings.

A blank page is displayed when a vdom_admin logs in without root access.

FortiView widgets have display issues when FIPS-CC mode is enabled. Workaround: create another super-admin profile and assign it to the new administrator.

The GUI shows an incorrect traffic-log status when a firewall policy is configured through the CLI. Workaround: use `set logtraffic all` or `set logtraffic disable` instead of `unset logtraffic`.

Non-resolvable FQDN objects intermittently display a red box around their names when filtered by FQDN type under Policy & Objects.

The warning pop-up is not displayed on FGCP cluster members in clusters containing more than two members.

TCP session failover fails after an HA failover when NGFW policy-based mode is used.

SNAT uses the wrong IP address following HA failover. Workaround: manually delete and re-add the secondary IP configuration.

Configuration synchronization fails when standalone-config-sync is enabled.

Renaming an ippool in a FortiGate deployment with VDOMs causes unintended behavior affecting network traffic.

The hardware session synchronization device goes out of sync because of a LAG driver discrepancy between the primary and secondary units.

An IPsec connection cannot be established when FortiClient VPN for Android connects to FortiGate using IKEv1.

Filters are ignored when using the `/firewall/sessions` API call.

BFD packet transmission issues occur after a member port of an aggregate interface is shut down and restored on the switch side. Workaround: change bfd-detect-mult to 7 on both sides.

When upgrading to 8.0.1 GA.F, configurations whose names begin with `.` are lost. Workaround: rename all such configurations before upgrading.

LDAP authentication fails when the password is not sent in the bind request.

FortiOS 7.6.5 restored proxy-based inspection for SMTP(S), POP3(S), IMAP(S), and NNTP on 2 GB RAM models. Firewall policies can use proxy inspection when one or more of these services is selected.

FortiOS 8.0.2 includes AV Engine 8.0018 as its built-in antivirus engine.