Producent oprogramowania udostępnił najnowszą aktualizację dla produktu FortiManager w wersji 7.4.6, która wprowadza istotne poprawki. Rozwiązano problem z wyświetlaniem nieprawidłowego komunikatu ostrzegawczego w interfejsie graficznym podczas aktualizacji systemu z wersji Feature do Mature. Dodatkowo usunięto opcję włączania „match-vip” w regułach „allow” w pakietach zasad, która była dostępna w FortiManager, choć nie jest już wspierana przez urządzenia FortiGate. Aktualizacja zapewnia lepszą zgodność i stabilność działania systemu.
Rozwiązane problemy:
AP Manager
| Bug ID | Description |
|---|---|
| 1076200 | Policy install fails due to FortiManager installs unexpected changes related to „<wifi_intf> address”. |
| 1081136 | FortiManager is trying to delete and create ssid interface subnet address after upgrade. |
Device Manager
| Bug ID | Description |
|---|---|
| 952422 | IPsec templates created by SDWAN Overlay does not create tunnels for all the underlay interfaces. |
| 1039591 | The Link Status entries are blank under the Interfaces >>> Network. |
| 1041440 | Some FortiGate platforms (FGT-40F & FGT-60F) do not support the „ip-managed-by-fortiipam” and FortiGate refuses to take the configuration from FortiManager; hence users will be experiencing the install error. |
| 1053194 | If the „system interface speed” attribute is changed from the FortiManager, it may potentially cause an installation failure. Modifying the „system interface speed” is not currently supported on the FortiManager and must be done on the FortiGate side. |
| 1063635 | FortiManager does not support the „FortiWiFi-80F-2R-3G4G-DSL”. |
| 1063835 | FortiManager ZTP installation to FortiGate versions 7.2.8 and lower may fail due to differing default „ssh-kex-algo” settings between FortiManager and FortiGate. |
| 1074717 | An error might be observed when the SD-WAN template health check name contains a space, displaying the following message: „Bad health check name…”. |
| 1075052 | Occasionally, installations may fail on FortiGates in HA mode due to a „Serial number does NOT match” error. This can happen if the HA device’s serial number on FortiManager does not immediately update after a failover. |
| 1075281 | Unable to add FortiAnalyzer to FortiManager when „fgfm-peercert-withoutsn” is enabled. |
| 1075747 | SD-WAN Monitor does not display the members under the SD-WAN Rules (Map View or Table View). This issue is most likely to occur when „priority-zone” is configured. |
| 1080414 | CSV import fails to set metadata variables due to old header format („name”). |
| 1099824 | FortiManager may push the ICAP and WAF profile configurations to low-end FortiGate models that do not support these features, potentially causing installation failures. |
FortiSwitch Manager
| Bug ID | Description |
|---|---|
| 1075021 | Users with the „admin profile” rights cannot access the FortiSwitch Manager. |
Others
| Bug ID | Description |
|---|---|
| 998198 | When upgrading ADOM, the upgrade process fails with the following error: „invalid value – can not find import template 'XYZ’ „. |
| 1003711 | During the FortiGate HA upgrade, both the primary and secondary FortiGates may reboot simultaneously, which can disrupt the network. This issue is more likely to occur in FortiGates that require disk checks, leading to longer boot times. |
| 1058185 | FortiProxy policies not imported if the policies have either internet service or IPv6 used in the source or destination. |
| 1078947 | Repeatedly testing the URL rating on FortiManager (diagnose fmupdate test fgd-url-rating…) may cause the „fgdsvr daemon” to crash. |
Policy and Objects
| Bug ID | Description |
|---|---|
| 978136 | Occasionally, installation may fail due to an error message, „Waiting for another session”, which prevents policies from being installed from FortiManager. During this issue, the following message may also appear: „Blocked by session id(XYZ) username(n/a)”. This issue may be caused by a signal loss between the child and parent security console processes, leading the parent process to continue waiting for a copy result. |
| 986256 | When creating the application list on the FortiManager, if the Category ID is set to 33 or 34, the installation does not display any errors. However, these invalid categories cannot be set on the FortiGate. Consequently, the assigned application list entry will be created without a specific category and will default to the „block” action. This behavior may cause network interruptions. |
| 991720 | FortiManager still has an option to enable the „match-vip” through the policy package for „allow” policies. However, this is not supported anymore on the FortiGates. |
| 1029921 | Under the „Web Application Firewall” security profiles, users are unable to disable the signatures through the GUI. |
| 1071226 | Policy Lookup is not showing result as highlighted when the sections are not expended. |
| 1074686 | FortiManager fails to import NAC policies. |
| 1076659 | When policy package configured with policy block, installation to multiple devices may have copy fail errors if combined length of the Policy Block name and Policy name is greater than 35 characters and if the total number of such policies exceeds 1000. |
| 1077964 | After ZTNA server real server address type changes from FQDN to IP, the policy installation may fail; FortiManager pushes ZTNA server config with wrong order. |
| 1079678 | FortiManager does not provide any warning when there is a „deny all” policy in the middle of a Policy Package. This can be still seen on the „task monitor”. |
System Settings
| Bug ID | Description |
|---|---|
| 1047252 | Incorrect warning message displayed in FortiManager GUI during upgrade from Feature build to Mature build. |
Notatki producenta: FortiManager 7.4.6 Release Notes
Pozdrawiamy,
Zespół B&B
Bezpieczeństwo w biznesie