Producent rozwiązań Fortinet udostępnił wersję FortiOS 7.4.13, która koncentruje się na poprawie stabilności systemu oraz niezawodności połączeń sieciowych. Aktualizacja eliminuje między innymi problem z utratą konfiguracji przy skrajnie niskim poziomie dostępnej pamięci, błąd powodujący przerwy w ruchu podczas restartu urządzenia zapasowego w klastrze HA oraz nieprawidłowości w przesyłaniu danych przez tunele IPsec VPN z włączoną akceleracją sprzętową NPU. Poprawki zwiększają stabilność urządzeń i ograniczają ryzyko zakłóceń w dostępie do zasobów sieciowych.
Rozwiązane problemy:
Data Leak Prevention
| Bug ID | Description |
|---|---|
| 1301589 | DLP fails to filter documents when the MIP label is located in an ole xml stream or an unencrypted msofficex file. |
DNS Filter
| Bug ID | Description |
|---|---|
| 1295373 | SRV records are redirected to the mgmt interface instead of the VWP interface when a DNS filter profile is applied in the policy |
| 1298350 | DNS over TLS server appears unreachable |
Explicit Proxy
| Bug ID | Description |
|---|---|
| 1253730 | Intermittent HTTPS request timeouts occur when proxy-based UTM inspection is enabled on a Virtual Server VIP. |
| 1292536 | PAC file data is cleared when deleting a VDOM named 'root’ |
Firewall
| Bug ID | Description |
|---|---|
| 1157283 | High priority traffic drops when bursty traffic is present on low priority queues. |
| 1212625 | Fragmented packets are dropped when egress shaping-profile is configured on a VLAN interface |
| 1217396 | Default-qos-type changes to policing-enhanced after reboot |
| 1222166 | Traffic shaping fails when SD-WAN load balancing is enabled after reboot. |
| 1232145 | Traffic is blocked when auto-asic-offload is enabled on firewall policy with back-to-back EMAC VLAN and Inter-VDOM Link topology. |
| 1234453 | VXLAN traffic fails when offloading is enabled |
| 1270575 | Traffic fragmentation issues occur when passing through multiple VDOMs on FortiGate |
| 1271340 | L2TPv3 packets are discarded when protocol 115 is not included as a known protocol on FortiGate |
| 1277509 | Unexpected behavior related to the QTM module when egress-shaping-profile is configured on the parent interface of a VLAN interface. |
| 1279396 | TLS_AES_256_GCM_SHA384 cipher suite is not advertised when using an EC384 certificate on a VIP |
| 1280836 | Installation failure occurs when setting a large number of address objects in firewall policy |
| 1283427 | Traffic disruption occurs when offloading is enabled in the firewall policy |
| 1307143 | Traffic is incorrectly shaped when memory optimization settings are applied. |
FortiGate 6000/7000 Platform
| Bug ID | Description |
|---|---|
| 1283535 | fragmented IKE packet drop |
| 1314590 | FGCP HA is not supported for HA between an AC powered and a DC powered FortiGate 6000F, FortiGate 7000E or FortiGate 7000F chassis. |
GUI
| Bug ID | Description |
|---|---|
| 1167631 | Internet traffic disruption occurs when an error condition in httpsd happens after firmware upgrade to 7.4.8 |
| 1212624 | Memory usage issues caused by the V8 JavaScript engine |
| 1225806 | Memory usage issues caused by V8 ExternalPointerTable leak |
| 1247676 | SSH deep scan toggle does not save when enabled on low-end models. |
| 1260292 | Print button is not visible when using prof_admin profile after FortiOS upgrade |
| 1282417 | License information page load delay occurs when FortiToken Cloud is unreachable |
HA
| Bug ID | Description |
|---|---|
| 1009939 | When bandwidth is low, tftp backup command on slave fails when it should be able to reach the server. |
| 1233776 | FSSO user list disappearance occurs when HA failover happens twice. |
| 1258325 | FortiToken Mobile push fails when private-data-encryption is enabled after a full HA cluster shutdown |
| 1260236 | Unexpected power off events occur in FortiGate 70G when configured in HA Active/Passive mode with wireless traffic. |
| 1267616 | FGSP session synchronization issues occur when FGSP links experience high latency. |
| 1268268 | DHCP server offers use physical MAC instead of VMAC when HA is formed after reboot or upgrade |
| 1269523 | Rebooting the secondary FortiGate in HA active-passive mode causes traffic loss due to split-brain and unintended ARP broadcasts from the secondary FortiGate. |
| 1270605 | HA cluster sync fails when adding a new VDOM in HA primary |
| 1285215 | TCP/135 traffic fails when DCE-RPC session helper is enabled with asymmetric traffic in FGSP-transparent mode |
| 1286934 | Authentication issues occur in FortiCloud SSO during HA failover due to serial mismatch |
| 1296784 | Session synchronization issues occur when FGSP is configured over FGCP cluster environment. |
| 1323497 | An IKE NAT port change blocks traffic after HA failover. |
HyperScale
| Bug ID | Description |
|---|---|
| 1288505 | Traffic disruption occurs when session sync between FGCP peers uses layer2 RLT packet |
| 1290329 | Packet loopback occurs when flapping a member of a LAG as hardware session sync device |
Intrusion Prevention
| Bug ID | Description |
|---|---|
| 1182611 | An error condition in IPS Engine occurs when stress testing with traffic load on FortiGate-200E |
| 1224669 | An error condition in IPS engine occurs when Thread Protection is enabled |
| 1231590 | An error condition in IPS engine occurs when FortiSandbox is enabled |
| 1244350 | MCDB update issues occur when FortiGate is configured with NGFW policy mode |
| 1267456 | A ClientHello packet larger than the MSS generates an SSL error when retransmitted to the server. |
| 1328306 | Local-in Virtual Patch fails to inspect traffic when using the HA-MGMT interface. |
IPsec VPN
| Bug ID | Description |
|---|---|
| 1091195 | Traffic drop occurs when npu-offload is enabled at IPsec-phase1-interface |
| 1113625 | Traffic disruption occurs when FortiExtender or LAN Extension sessions are offloaded on the FortiGate side. |
| 1137576 | IPSEC tunnel failure occurs when IKE Diffie-Hellman processing fails |
| 1217216 | DHCP requests fail when FortiGate sends the full DN instead of the CN in Option 61 during IKEv2 |
| 1245740 | MTU reduction occurs when using IPsec with GCM on 9xG and 12xG devices |
| 1246587 | Traffic forwarding issues occur when NPU offload is enabled for IPSEC VPN |
| 1252546 | Negotiation timeout occurs when entering OTP within 120 seconds validity period |
| 1254266 | IPsec dial-up VPN connection fails when username case sensitivity does not match for RADIUS users. |
| 1273969 | High memory usage occurs when VWL triggers shortcut-offer for existing shortcut tunnels in SD-WAN ADVPN deployment on FortiGate-40F and FortiGate-60F. |
| 1278940 | Unexpected behavior occurs in the system when receiving IPsec VPN traffic with large ICMP packets and NPU offload enabled |
| 1293470 | Data transmission issues occur in IPsec VPN tunnels when npu-offload is enabled on FortiGate. |
| 1318272 | Enabling system.settings.ike-policy-route after IPsec tunnel configuration blocks ESP traffic from reaching the egress interface. |
Log and Report
| Bug ID | Description |
|---|---|
| 1198455 | When running ITS test occasionally the wrong link status reading is logged |
| 1237774 | Log field information loss occurs when the URL or Referrer header exceeds a certain character limit |
| 1241256 | Failure to send OT information to FortiAnalyzer occurs when a large number of IoT/OT vulnerabilities are generated. |
| 1269067 | Synchronization fails when generating a large number of IoT/OT vulnerabilities |
| 1269332 | FortiGate loses FortiAnalyzer serial number during failover from primary to secondary FAZ |
Proxy
| Bug ID | Description |
|---|---|
| 1224454 | SSL deep inspection blocks or bypasses traffic when the first ClientHello TCP segment payload is 1024B or less. |
| 1224915 | Intermittent page could not be reached issue occurs when authentication is required by QUIC |
| 1233324 | High memory usage occurs when inline IPS is enabled with long-lived connections and IPS DB updates. |
| 1244955 | An error condition occurs in WAD during peer port validation. |
| 1323515 | An FSSO identity lookup that returns no user and matches no proxy-policy stops WAD from responding. |
Routing
| Bug ID | Description |
|---|---|
| 1272281 | VRRP failure occurs when using hardware-switch on FortiGate |
| 1277718 | Routing tables are incorrectly assigned to VRF 0 when restoring VDOM configuration |
SD-WAN
| Bug ID | Description |
|---|---|
| 1118705 | Speed test failure occurs when using BGP over loopback design |
| 1273960 | Packet loss occurs when upgrading from 7.0.14 to 7.2.10 |
Security Fabric
| Bug ID | Description |
|---|---|
| 1269373 | High CPU usage occurs when SFTP backup automation is configured on the FortiGate |
| 1296597 | An error condition in Autod occurs when deleting deprecated triggers during upgrade to 7.4.12 |
SSL-VPN
| Bug ID | Description |
|---|---|
| 1309910 | Security vulnerability occurs when connecting to a malicious SSH server with crafted packets. |
Switch Controller
| Bug ID | Description |
|---|---|
| 1195908 | Virtual VLAN switch forwarding issues occur when STP is enabled in HA setups with multiple members on FortiGate-600F. |
| 1269995 | An error condition in fltund occurs during upgrade to 7.6.6 |
System
| Bug ID | Description |
|---|---|
| 1046171 | System hang occurs when attempting to delete a VDOM with IPV6 traffic is still present. |
| 1116876 | VDSL connection failure occurs when configured on FortiGate 50G-DSL |
| 1144387 | FortiGate 50G DSL fails to acquire an IP address from a DSL modem |
| 1161211 | Memory usage issues caused by polling FGT memory usage |
| 1166455 | TCP packet drop occurs when sending traffic over VLAN+redundant port |
| 1193085 | Proxy-arp configuration failure occurs when the proxy-arp address group exceeds 256 entries |
| 1208271 | Downloading the full Malicious Certificate Database (MCDB) on every update consumes significant network bandwidth. |
| 1222654 | FortiGate-40F fails to display LAN A SPEED and WAN SPEED amber LEDs during the diag hardware test led nic-led. |
| 1227167 | Memory usage issues caused by the node process |
| 1231510 | IP address assignment issues occur on DSL interfaces configured with static IP after reboot or at irregular intervals |
| 1245329 | Configuration loss occurs when FortiGate enters extreme low memory mode |
| 1248631 | Intermittent reboot issues occur in FortiWiFi-50G when WiFi clients connect via RADIUS or ax bands |
| 1259458 | Intermittent reboot of FortiGate-71G caused by an error condition in the IPS engine. |
| 1262639 | Bandwidth distribution issue occurs when using LACP after upgrade to 7.4 |
| 1264805 | Unexpected behavior in the system occurs when upgrading to 7.4.9 |
| 1265816 | SPEED LED blinking occurs when upgrading to FortiOS 7.4.10 on FortiGate FG-40F |
| 1268808 | Packet drops occur when querying SNMP OID 1.3.6.1.4.1.12356.101.4.4.2.1.8 for Processor 13 |
| 1273362 | Port LEDs remain solid green when transmitting or receiving data on FortiGate 80F after upgrade to 7.4.11 |
| 1275047 | Port LEDs fail to illuminate when connected at 100Mbps with auto speed setting |
| 1282021 | Error condition in GUI occurs when deleting a VDOM |
| 1283008 | [B2867] bmr-hostname is not updated while vne tunnel is established. |
| 1283972 | Reboot occurs when FortiSentry triggers a reboot for suspicious cases. |
| 1289434 | LED activity lights do not blink when FortiGate is upgraded to version 7.4.x |
| 1290942 | FortiGate-70G, FortiGate-71G, FortiWiFi-70G, and FortiWiFi-71G WAN interface SPEED LED remains lit after reboot when configured as admin-down with no Ethernet cable connected. |
| 1299330 | Third-party CAPWAP fragments are dropped when they pass through NP7 or NP7Lite FortiGate. |
| 1308703 | Third-party CAPWAP fragments are dropped when they pass through NP7 or NP7Lite FortiGate. |
| 1309281 | Third-party CAPWAP fragments are dropped when they pass through NP7 or NP7Lite FortiGate. |
| 1314404 | UWDB delta updates fail when delta update files contain only the header with no body. |
| 1316514 | IPGO delta update generates „Failed to bspatch /tmp/delta/upd.0.delta, code=65280” during a delta update. |
| 1324928 | Off-network .lic files generated on Windows generate „FortiGate Manual License is invalid” during manual license upload via TFTP. |
Upgrade
| Bug ID | Description |
|---|---|
| 1269764 | Private data encryption wipes IPsec PSKs on platforms with TPM during upgrade from FortiOS 7.2.13 to 7.4.11. |
| 1277454 | Upgrading from 7.6.6 to 7.6.7 may result in the loss of specific config system global settings (e.g., hostname, timezone, admin-scp, vdom-mode). |
| 1282918 | Using „execute restore secondary-image” prevents FortiGate from booting when the system reboots into the secondary partition. |
| 1283569 | FGT force-upg is not automatically cancelled after manually upgrading to a new major.minior |
| 1316497 | Upgrading to FortiOS 7.4 generates incorrect obsolete Internet Service logs during initialization. |
User and Authentication
| Bug ID | Description |
|---|---|
| 1211983 | Certificate chain issues occur when firewall encounters a certificate renewal issue while using EST simplereenroll process |
| 1233862 | Certificate renewal through EST protocol fails when DNS lookup fails |
| 1236839 | An error condition in fnbamd occurs when referencing two peer users during certificate authentication |
| 1250279 | ACME protocol violation occurs when order validation exceeds 30 seconds |
| 1263865 | Connection failure occurs when maximum session limit is reached with EAP enabled in IKE config and TFA for users. |
| 1271821 | Token verification fails when username case sensitivity does not match for LDAP users with 2FA enabled. |
| 1325322 | Changing authentication configuration during a SAML authentication loop stops WAD from responding. |
VM
| Bug ID | Description |
|---|---|
| 1294311 | SDN connector fails to manage Azure vWAN when deployed in GermanyWestCentral location |
| 1311756 | Instance token refresh fails when certificate file size exceeds the fixed buffer size in FortiGate VM. |
| 1324904 | Live Migration on Azure VMs wipes RPS settings in config system affinity-packet-redistribution. |
Web Filter
| Bug ID | Description |
|---|---|
| 1300576 | FortiGate 121G displays an incorrect webfilter.profile tablesize of 32 instead of 512. |
WiFi Controller
| Bug ID | Description |
|---|---|
| 1242199 | SSID interface is missing in routing table after FMG pushed the configuration to FGT |
| 1243404 | Wi-Fi client’s FT Roaming failed due to invalid PMKID when 802.11r is enabled on WPA2-Enterprise SSID. |
| 1243456 | Wi-Fi client’s FT reassociation is rejected when 802.11r is enabled on WPA2-Enterprise SSID. |
Common Vulnerabilities and Exposures
Visit https://fortiguard.com/psirt for more information.
| Bug ID | CVE references |
|---|---|
| 1179021 | FortiOS 7.4.13 is no longer vulnerable to the following CVE Reference:
|
Notatki producenta: FortiOS 7.4.13 Release Notes
Pozdrawiamy,
Zespół B&B
Bezpieczeństwo w biznesie