TABLE OF CONTENTS

Change Log                                                                                                                           5

 

 

Change Log

Date	Change Description
2019-10-09	Initial release.
2019-10-10	Added 551119 to Resolved Issues. Added commands to the Previous releases column in Changes in CLI defaults SSH and SSL VPN sections.

 

Introduction and supported models

This guide provides release information for FortiOS 6.2.2 build 1010.

For FortiOS documentation, see the Fortinet Document Library.

Supported models

FortiOS 6.2.2 supports the following models.

FortiGate	FG-30E, FG-30E_3G4G_INTL, FG-30E_3G4G_NAM, FG-50E, FG-51E, FG-52E, FG-60E, FG-60E-POE, FG-61E, FG-80D, FG-80E, FG-80E-POE, FG-81E, FG-81E-POE, FG-90E, FG-92D, FG-100D, FG-100E, FG-100EF, FG-101E, FG-140D, FG-140D-POE, FG-140E, FG-140E-POE, FG-200E, FG-201E, FG-300D, FG-300E, FG-301E, FG-400D, FG-400E, FG-401E, FG-500D, FG-500E, FG-501E, FG-600D, FG-600E, FG-601E, FG-800D, FG-900D, FG-1000D, FG-1200D, FG-1500D, FG-1500DT, FG-2000E, FG-2500E, FG3000D, FG-3100D, FG-3200D, FG-3400E, FG-3401E, FG-3600E, FG-3601E, FG-3700D, FG-3800D, FG-3810D, FG-3815D, FG-5001D, FG-3960E, FG-3980E, FG-5001E, FG-5001E1
FortiWiFi	FWF-30E, FWF-30E_3G4G_INTL, FWF-30E_3G4G_NAM, FWF-50E, FWF-50E-2R, FWF-51E, FWF-60E, FWF-61E
FortiGate Rugged	FGR-30D, FGR-35D
FortiGate VM	FG-SVM, FG-VM64, FG-VM64-ALI, FG-VM64-ALIONDEMAND, FG-VM64-AWS, FG-VM64-AWSONDEMAND, FG-VM64-AZURE, FG-VM64-AZUREONDEMAND, FG-VM64-GCP, FG-VM64-GCPONDEMAND, FG-VM64-HV, FG-VM64-KVM, FG-VM64-OPC, FG-VM64-RAXONDEMAND, FG-VMX, FG-VM64-XEN
Pay-as-you-go images	FOS-VM64, FOS-VM64-KVM, FOS-VM64-XEN
FortiOS Carrier	FortiOS Carrier 6.2.2 images are delivered on request and are not available on the Beta portal.

Special branch supported models

The following models are released on a special branch of FortiOS 6.2.2. To confirm that you are running the correct build, run the CLI command get system status and check that the Branch point field shows 1010.

FGR-90D

is released on build 5335.

Special notices

• Common vulnerabilities and exposures l New Fortinet cloud services l FortiGuard Security Rating Service l FortiGate hardware limitation l CAPWAP traffic offloading
• FortiClient (Mac OS X) SSL VPN requirements l Use of dedicated management interfaces (mgmt1 and mgmt2) l NP4lite platforms l Tags option removed from GUI l Mobile token authentication

Common vulnerabilities and exposures

FortiOS 6.2.1 is no longer vulnerable to the issue described in the following link – https://fortiguard.com/psirt/FG-IR-19144.

New Fortinet cloud services

FortiOS 6.2.0 introduced several new cloud-based services listed below. The new services require updates to FortiCare and Fortinet’s FortinetOne single sign-on (SSO) service. These updates will be available by mid-Q2 2019.

• Overlay Controller VPN
• FortiGuard Cloud-Assist SD-WAN Interface Bandwidth Monitoring l FortiManager Cloud l FortiAnalyzer Cloud

FortiGuard Security Rating Service

Not all FortiGate models can support running the FortiGuard Security Rating Service as a Fabric “root” device. The following FortiGate platforms can run the FortiGuard Security Rating Service when added to an existing Fortinet Security Fabric managed by a supported FortiGate model: l FGR-30D l FGR-35D l FGT-30E l FGT-30E-MI

Special notices                                                                                                                                                          8

l FGT-30E-MN l FGT-50E l FGT-51E l FGT-52E l FWF-30E l FWF-30E-MI l FWF-30E-MN l FWF-50E l FWF-50E-2R l FWF-51E

FortiGate hardware limitation

FortiOS 5.4.0 reported an issue with the FG-92D model in the Special Notices > FG-92D High Availability in Interface Mode section of the release notes. Those issues, which were related to the use of port 1 through 14, include:

• PPPoE failing, HA failing to form. l IPv6 packets being dropped. l FortiSwitch devices failing to be discovered. l Spanning tree loops may result depending on the network topology.

FG-92D does not support STP. These issues have been improved in FortiOS 5.4.1, but with some side effects with the introduction of a new command, which is enabled by default:

config global set hw-switch-ether-filter <enable | disable>

When the command is enabled:

• ARP (0x0806), IPv4 (0x0800), and VLAN (0x8100) packets are allowed. l BPDUs are dropped and therefore no STP loop results. l PPPoE packets are dropped. l IPv6 packets are dropped. l FortiSwitch devices are not discovered. l HA may fail to form depending the network topology.

When the command is disabled:

• All packet types are allowed, but depending on the network topology, an STP loop may result.

 

Special notices

CAPWAP traffic offloading

CAPWAP traffic will not offload if the ingress and egress traffic ports are on different NP6 chips. It will only offload if both ingress and egress ports belong to the same NP6 chip. The following models are affected: l FG-900D l FG-1000D l FG-2000E l FG-2500E

FortiClient (Mac OS X) SSL VPN requirements

When using SSL VPN on Mac OS X 10.8, you must enable SSLv3 in FortiOS.

Use of dedicated management interfaces (mgmt1 and mgmt2)

For optimum stability, use management ports (mgmt1 and mgmt2) for management traffic only. Do not use management ports for general user traffic.

NP4lite platforms

FortiOS 6.2 and later does not support NP4lite platforms.

Tags option removed from GUI

The Tags option is removed from the GUI. This includes the following:

l The System > Tags page is removed. l The Tags section is removed from all pages that had a Tags section. l The Tags column is removed from all column selections.

Mobile token authentication

Mobile token authentication does not work for SSL VPN on SOC3 platforms.

Affected models include FG-60E, FG-60E-POE, FG-61E, FG-80E, FG-80E-POE, FG-81E, FG-81E-POE, FG-100E, FG100EF, FG-101E, FG-140E, FWF-60E, FWF-61E.

Changes in default behavior

AntiVirus

l In previous releases, the scan mode controls which features are displayed based on their compatibility with proxy and flow’s [quick | full] mode (now [default | legacy]).

This release disregards this behavior, making antivirus profile scan-mode agnostic. This means that all AV options are displayed regardless of the AV profile’s scan-mode setting. Enforcement is handled by the kernel based on the firewall policy using AV. Unsupported AV features do not take effect if inspection mode is proxy or flow. l In this release, AntiVirus can do SSH inspection.

FOC

apn option under apn-shaper now accepts multiple apn or apngroup.

Previous releases	6.2.2 release
config gtp apn edit “apn1” set apn “internet” next edit “apn2” set apn “intranet” next end config gtp apngrp edit “apngrp1” set member “apn1” next end config gtp apn-shaper edit 1 next end	config gtp apn edit “apn1” set apn “internet” next edit “apn2” set apn “intranet” next end config gtp apngrp edit “apngrp1” set member “apn1” next end config gtp apn-shaper edit 1 set apn “apn2” “apngrp1” <==changed next end

FortiSwitch Controller

• FortiLink interface is on by default on FortiGate E series platform.
• On FG-100E and higher, create an empty FortiLink aggregate interface (fortilink) by default. If aggregate interface is not supported, create a hardware switch interface instead.
• For FortiGate models below FG-100E, create an empty FortiLink hardware switch interface (fortilink) by default. If hardware switch interface is not supported, create aggregate interface instead.
• When the FortiLink interface is enabled, CLI displays an error message when trying to change the FortiGate to TP mode.

default behavior

Firewall

• Only IP and Protocol are matched and source port is ignored when ISDB is applied as source in policy. l Internet-service-addition will overwrite default ports of internet-service ID if protocols are the same. l Firewall policy supports wildcard-fqdn object with FQDN type.
• This release supports srcaddr/dstaddr/internet-service/internet-service-src negate in consolidated policy.
• All attributes for FABRIC_DEVICE object, except for IP address and type, can be modified from CLI but not from GUI.

Log & Report

l In previous releases, FortiGate only sends event log to FAZ-Cloud. In this release, FortiGate sends both event log and UTM log to FAZ-Cloud.

Switch l Add VLAN switch feature to FG-300E and FG-301E.

System

• API user must have at least one trust host IP Address. l Only show diagnose sys nmi-watchdog command on platforms that have “nmi” button.
• With mgmt interface set to dedicated to management, added three kinds of cases. l When no trust host is set, all IPv4 and IPv6 addresses have access. l When only IPv4 addresses are set to trust host, IPv6 address cannot log in.
• When only IPv6 addresses are set to trust host, IPv4 address cannot log in.
• There is no mgmt option in GRE tunnel interface when it is set to dedicated to management. l Allow VDOM admin to create loopback interface if no physical interface in VDOM.
• The trust-ip option in config system interface always override trusthost option in config system admin.

 

Changes in CLI defaults

AntiVirus

Add SSH inspection. This is only compatible with proxy inspection.

Previous releases	6.2.2 release
config antivirus profile edit “profile_name” next end	config antivirus profile edit “profile_name” config ssh                         <==added set options scan                <==added unset archive-block             <==added unset archive-log                <==added set emulator enable             <==added set outbreak-prevention disabled <==added end next end

Endpoint Control

Add fortiems-cloud option under FSSO user.

Previous releases	6.2.2 release
config user fsso edit <name> next end	config user fsso edit <name> set type fortiems-cloud <==added next end

Add attribute fortinetone-cloud-authentication to endpoint control fctems.

Previous releases	6.2.2 release
config endpoint-control fctems edit <name> next end	config endpoint-control fctems edit <name> set fortinetone-cloud-authentication [enable | disable] <==added next end

Add sub-second-sampling under GTP.

Previous releases	6.2.2 release
config firewall gtp edit “gtpp” next end	config firewall gtp edit “gtpp” set sub-second-sampling enable <==added set sub-second-interval 0.1   <==added next end

Firewall

Add HTTPS as a type of health check for VIP load-balance monitor.

Previous releases	6.2.2 release
config firewall ldb-monitor edit [Monitor Name] set type ? ping   PING health monitor. tcp       TCP-connect health monitor. http HTTP-GET health monitor.	config firewall ldb-monitor edit [Monitor Name] set type ? ping   PING health monitor. tcp       TCP-connect health monitor. http   HTTP-GET health monitor. https   HTTP-GET health monitor with SSL. <==added

Remove set type wildcard-fqdn and set wildcard-fqdn <string> from firewall address.

Previous releases	6.2.2 release
config firewall address edit [Address] set type wildcard-fqdn    <==removed set wildcard-fqdn <string> <==removed next end	config firewall address edit [Address] next end

Add CLI commands to support address and service negate in consolidated policy.

Previous releases	6.2.2 release
config firewall consolidated policy edit [Policy ID] next end	config firewall consoli edit [Policy ID] set srcaddr-negate set dstaddr-negate	dated policy [enable | disable]   <==added [enable | disable]   <==added
	set service-negate	[enable | disable]   <==added
Previous releases	6.2.2 release
	set internet-service-negate [enable | disable]       <==added set internet-service-src-negate [enable | disable] <==added next end

Proxy

Previous releases	6.2.2 release
	config firewall traffic-class  <==added edit [Class-ID]             <==added end                            <==added

In protocol option profile, add ssl-offloaded command under each protocol.

Previous releases		6.2.2 release
config firewall edit “”de config end config end config end config end config end next end	profile-protocol-options fault-clone”” http ftp imap pop3 smtp	config firewall edit “”de config set end config set end config set end config set end	profile-pr fault-clone”” http ssl-offloaded ftp ssl-offloaded imap ssl-offloaded pop3 ssl-offloaded	oto no no no no	col-options <==added <==added <==added <==added
		config	smtp
		set end next end	ssl-offloaded	no	<==added

Traffic Shaping

Add a new global CLI table to define traffic classes. This is ‘s a mapping between class-ID and naming. class-ID from shaping-policy, shaping-profile, and traffic-shaper need to be data-sourced from this CLI table.

Log & Report

Add CLI allowing user to configure socket priority and maximum log rate per remote log device.

Similar setting apply to config log fortiguard setting and config log syslogd setting.

Previous releases	6.2.2 release
config log fortianalyzer setting end config log fortianalyzer overridesetting end	config set set end config	log fortianalyzer priority [default max-log-rate [Log log fortianalyzer	setting | low]             <==added Rate, unit is MBps] <==added override-setting
	set	priority [default	| low]             <==added
	set end	max-log-rate [Log	Rate, unit is MBps] <==added

Add the test command option in CLI.

Previous releases	6.2.2 release
diag test application miglogd	diag test application miglogd 40 <==added option “40”

SSH

Add file transfer scan over SSH (SCP and SFTP).

Previous releases	6.2.2 release
config ssh-filter profile edit [Profile Name] set default-command-log disable next end	config ssh-filter profile edit [Profile Name] set block x11 shell exec port-forward tun- forward sftp scp unknown <==added scp set log x11 shell exec port-forward tun- forward sftp scp unknown  <==added scp set default-command-log disable config file-filter                 <==added set status enable               <==added set log enable                  <==added set scan-archive-contents enable <==added config entries                  <==added edit [Entry]                 <==added set comment ”            <==added set action block          <==added
	set direction any	<==added
	set password-protected any	<==added
	set file-type “msoffice”	<==added
Previous releases	6.2.2 release
	next end end next end

SSL VPN

Remove citrix and portforward from apptype in the three entries in SSL VPN web bookmark.

Previous releases	6.2.2 release
conf vpn ssl web user-bookmark edit [Name] config bookmarks edit [Boormark Name] set apptype ? citrix Citrix.           <==removed ftp FTP. portforward Port Forward. <==removed rdp RDP. sftp SFTP. smb SMB/CIFS. ssh SSH. telnet Telnet. vnc VNC. web HTTP/HTTPS. next end next end conf vpn ssl web user-group-bookmark edit [Name] config bookmarks edit [Boormark Name] set apptype ? citrix Citrix.          <==removed ftp FTP. portforward Port Forward. <==removed rdp RDP. sftp SFTP. smb SMB/CIFS. ssh SSH.	conf vpn ssl web user-bookmark edit [Name] config bookmarks edit [Boormark Name] set apptype ? ftp FTP. rdp RDP. sftp SFTP. smb SMB/CIFS. ssh SSH. telnet Telnet. vnc VNC. web HTTP/HTTPS. next end next end conf vpn ssl web user-group-bookmark edit [Name] config bookmarks edit [Boormark Name] set apptype ? ftp FTP. rdp RDP. sftp SFTP. smb SMB/CIFS. ssh SSH. telnet Telnet. vnc VNC. web HTTP/HTTPS. next end
Previous releases	6.2.2 release
telnet Telnet. vnc VNC. web HTTP/HTTPS. next end next end conf vpn ssl web portal edit [Name] config bookmarks edit [Boormark Name] set apptype ? citrix Citrix.          <==removed ftp FTP. portforward Port Forward. <==removed rdp RDP. sftp SFTP. smb SMB/CIFS. ssh SSH. telnet Telnet. vnc VNC. web HTTP/HTTPS. next end next end	next end conf vpn ssl web portal edit [Name] config bookmarks edit [Boormark Name] set apptype ? ftp FTP. rdp RDP. sftp SFTP. smb SMB/CIFS. ssh SSH. telnet Telnet. vnc VNC. web HTTP/HTTPS. next end next end

System

Add description in system security zones.

Previous releases	6.2.2 release
config system zone edit [Zone Name] next end	config system zone edit [Zone Name] set description “” <==added next end

Increase the maximum number of DNS servers supported in DHCP server from 3 to 4.

Previous releases	6.2.2 release
config system dhcp server edit [Server ID] set dns-server1 1.1.1.1 set dns-server2 2.2.2.2 set dns-server3 3.3.3.3 next end	config system dhcp server edit [Server ID] set dns-server1 1.1.1.1 set dns-server2 2.2.2.2 set dns-server3 3.3.3.3 set dns-server4 4.4.4.4 <==added next end

VM

Remove vdom-modemulti-vdom option for cloud-based ondemand FGT-VM.

Previous releases	6.2.2 release
config sys global set vdom-mode ? no-vdom Disable split/multiple VDOMs mode. split-vdom Enable split VDOMs mode. multi-vdom Enable multiple VDOMs mode. <==removed end	config sys global set vdom-mode ? no-vdom Disable split/multiple VDOMs mode. split-vdom Enable split VDOMs mode. end

Remove security rating from FGT_VMX and FGT_SVM.

Previous releases	6.2.2 release
diagnose security-rating version <==removed

Enable CPU hot plug in kernel configuration.

Previous releases	6.2.2 release
	execute cpu show <==added Active CPU number: 1 Total CPU number: 8 execute cpu add 1 <==added Active CPU number: 2 Total CPU number: 8

Collect EIP from cloud-VMS (Azure, AWS, GCP, AliCloud, and OCI).

Previous releases	6.2.2 release
pcui-cloudinit-test # execute <?> config sys interface edit [Name] next end conf sys global set sslvpn-cipher-hardware-acceleration <==removed end	pcui-cloudinit-test # execute <?> update-eip Update external IP. <==added config sys interface edit [Name] set eip                 <==added next end conf sys global end

WiFi Controller

Add portal-type external-auth when captive-portal is enabled on local-bridge VAP.

Previous releases	6.2.2 release
config wireless-controller vap edit “wifi.fap.02” set ssid “bridge-captive” set local-bridging enable set security captive-portal set external-web “170.00.00.000/portal/index.php” set radius-server “peap” next end	config wireless-controller vap edit “wifi.fap.02” set ssid “bridge-captive” set local-bridging enable set security captive-portal set portal-type external-auth set external-web “170.00.00.000/portal/index.php” set radius-server “peap” next end	<==added

Move darrp-optimize and darrp-optimize-schedules configurations from Global level to VDOM level.

Previous releases	6.2.2 release
### Global ### config wireless-controller timers set darrp-optimize 86400 <==removed set darrp-optimize-schedules “default- darrp-optimize” <==removed end	### VDOM ### config wireless-controller setting set darrp-optimize 86400 <==added set darrp-optimize-schedules “default- darrp-optimize” <==added end

Add external-web-format setting under captive-portal VAP when external portal is selected.

Previous releases	6.2.2 release
config wireless-controller vap edit guestwifi set ssid “GuestWiFi” set security captive-portal set external-web “http://170.00.00.000/portal/index.php” set selected-usergroups “Guest-group” set intra-vap-privacy enable set schedule “always” next end	config wireless-controller vap edit guestwifi set ssid “GuestWiFi” set security captive-portal set external-web “http://170.00.00.000/portal/index.php” set selected-usergroups “Guest-group” set intra-vap-privacy enable set schedule “always” set external-web-format auto-detect <==added next end

Add new WTP profiles FAPU431F-default and FAPU433F-default.

Previous releases		6.2.2 release
config wireless-controller edit [FAPU431F-default | config platform end	wtp-profile FAPU433F-default]	config wireless-controller edit [FAPU431F-default config platform set type [U431F | set mode [dual-5G end	wtp-profile | FAPU433F-default] U433F]      <==added | single-5G] <==added
config wireless-controller edit [FAPU431F-default default] next end	wtp-profile | FAPU433F-	config wireless-controller wtp-profile edit [FAPU431F-default | FAPU433F- default] config radio-1             <==added set band 802.11ax-5G   <==added end config radio-2             <==added set band 802.11ax-5G   <==added end config radio-3             <==added set band 802.11n,g-only <==added end next end
config wireless-controller edit [SSID name] next end	vap	config wireless-controller vap edit [SSID name] set high-efficiency enable <==added set target-wake-time enable <==added next end

For DFS approved countries, add 160 MHz channel bonding support for FortiAP U421EV/U422EV/U423EV models.

Previous releases	6.2.2 release
config wireless-controller wtp-profile edit [ FAPU421EV-default | FAPU422EV-default | FAPU423EV-default ] config radio-2 set band 802.11ac end next end	config wireless-controller wtp-profile edit [ FAPU421EV-default | FAPU422EV-default | FAPU423EV-default ] config radio-2 set band 802.11ac set channel-bonding 160MHz <==added end next end

Add MPSK schedule that allows setting valid period for MPSK.

Previous releases	6.2.2 release
config wireless-controller vap edit [SSID Interface Name] set mpsk enable config mpsk-key edit [MPSK Entry Name] set passphrase 11111111 next end next end	config wireless-controller vap edit [SSID Interface Name] set mpsk enable config mpsk-key edit [MPSK Entry Name] set passphrase 11111111 set mpsk-schedules “always” <==added next end next end

Add GRE&L2TP support in WiFi.

Previous releases	6.2.2 release
config wireless-controller vap edit “80e_gre” set ssid “FOS-QA_Bruce_80e_gre” set local-bridging enable set vlanid 3135 next end	config wireless-controller wag-profile <==added edit [Profile Name]               <==added end config wireless-controller vap edit “80e_gre” set ssid “FOS-QA_Bruce_80e_gre” set local-bridging enable set vlanid 3135 set primary-wag-profile “tunnel” <==added set secondary-wag-profile “l2tp” <==added next end

 

Changes in default values

AntiVirus

Change AV scan mode from [quick | full] to [default | legacy]. The default value is set to default.

Previous releases	6.2.2 release
config antivirus profile edit “profile_name” set scan-mode [quick | full] next end	config antivirus profile edit “profile_name” set scan-mode [default | legacy] <==changed next end

Log & Report

Change default value from disable to enable for some configuration options under fortianalyzer-cloud filter.

Previous releases	6.2.2 release
config log fortianalyzer-cloud filter set severity information set forward-traffic disable set local-traffic disable set multicast-traffic disable set sniffer-traffic disable set anomaly disable set voip disable set dlp-archive disable set filter ” set filter-type include end	config log fortianalyzer-cloud filter set severity information set forward-traffic enable  <==changed set local-traffic enable    <==changed set multicast-traffic enable <==changed set sniffer-traffic enable  <==changed set anomaly enable          <==changed set voip enable             <==changed set dlp-archive disable set filter ” set filter-type include end

Changes in default values

System

After creating a new VDOM, add default certificates for ssl-cert and ssl-ca-cert under web-proxy setting.

Previous releases	6.2.2 release
show web-proxy global config web-proxy global set ssl-cert ” set ssl-ca-cert ” set proxy-fqdn “default.fqdn” end	show web-proxy global config web-proxy global set ssl-cert ‘Fortinet_Factory’  <==changed set ssl-ca-cert ‘Fortinet_CA_SSL’ <==changed set proxy-fqdn “default.fqdn” end

WiFi Controller

Change default LLDP setting in wtp-profile from disable to enable.

Previous releases	6.2.2 release
config wireless-controller wtp-profile edit [FAP-Profile] set lldp disable end end	config wireless-controller wtp-profile edit [FAP-Profile] set lldp enable <==changed end end

The default channel-utilization setting in wtp-profile is changed from disable to enable.

Previous releases		6.2.2 release
config wire edit [FAP config set end config set end next end	less-controller wtp-profile Profile Name] radio-1 channel-utilization disable radio-2 channel-utilization disable	config wire edit [FAP config set end config set end next end	less-controller wtp-profile Profile Name] radio-1 channel-utilization enable <==changed radio-2 channel-utilization enable <==changed

Increase normal WTP capacity on high end FortiGates from 1024 to 2048.

Previous releases	6.2.2 release
FGT( 1000, end ) = 1024 -> 2048	FGT( 1000, end ) = 1024 -> 2048

Upgrade Information

Supported upgrade path information is available on the Fortinet Customer Service & Support site.

To view supported upgrade path information:

1. Go to https://support.fortinet.com.
2. From the Download menu, select Firmware Images.
3. Check that Select Product is FortiGate.
4. Click the Upgrade Path tab and select the following:

l Current Product l Current FortiOS Version l Upgrade To FortiOS Version

5. Click Go.

Device detection changes

In FortiOS 6.0.x, the device detection feature contains multiple sub-components, which are independent:

• Visibility – Detected information is available for topology visibility and logging.
• FortiClient endpoint compliance – Information learned from FortiClient can be used to enforce compliance of those endpoints.
• Mac-address-based device policies – Detected devices can be defined as custom devices, and then used in devicebased policies.

In 6.2, these functionalities have changed:

• Visibility – Configuration of the feature remains the same as FortiOS 6.0, including FortiClient information. l FortiClient endpoint compliance – A new fabric connector replaces this, and aligns it with all other endpoint connectors for dynamic policies. For more information, see Dynamic Policy – FortiClient EMS (Connector) in the FortiOS 6.2.0 New Features Guide.
• Mac-address-based policies – A new address type is introduced (Mac Address Range), which can be used in regular policies. The previous device policy feature can be achieved by manually defining MAC addresses, and then adding them to regular policy table in 6.2. For more information, see MAC Addressed-Based Policies in the FortiOS 6.2.0 New Features Guide.

If you were using device policies in 6.0.x, you will need to migrate these policies to the regular policy table manually after upgrade. After upgrading to 6.2.0:

1. Create MAC-based firewall addresses for each device.
2. Apply the addresses to regular IPv4 policy table.

 

FortiClient Endpoint Telemetry license

Starting with FortiOS 6.2.0, the FortiClient Endpoint Telemetry license is deprecated. The FortiClient Compliance profile under the Security Profiles menu has been removed as has the Enforce FortiClient Compliance Check option under each interface configuration page. Endpoints running FortiClient 6.2.0 now register only with FortiClient EMS 6.2.0 and compliance is accomplished through the use of Compliance Verification Rules configured on FortiClient EMS 6.2.0 and enforced through the use of firewall policies. As a result, there are two upgrade scenarios:

• Customers using only a FortiGate device in FortiOS 6.0 to enforce compliance must install FortiClient EMS 6.2.0 and purchase a FortiClient Security Fabric Agent License for their FortiClient EMS installation.
• Customers using both a FortiGate device in FortiOS 6.0 and FortiClient EMS running 6.0 for compliance enforcement, must upgrade the FortiGate device to FortiOS 6.2.0, FortiClient to 6.2.0, and FortiClient EMS to 6.2.0.

The FortiClient 6.2.0 for MS Windows standard installer and zip package containing FortiClient.msi and language transforms and the FortiClient 6.2.0 for macOS standard installer are included with FortiClient EMS 6.2.0.

Fortinet Security Fabric upgrade

FortiOS 6.2.2 greatly increases the interoperability between other Fortinet products. This includes:

l FortiAnalyzer 6.2.0 l FortiClient EMS 6.2.0 l FortiClient 6.2.0 l FortiAP 5.4.4 and later l FortiSwitch 3.6.9 and later

Upgrade the firmware of each product in the correct order. This maintains network connectivity without the need to use manual steps.

If Security Fabric is enabled, then all FortiGate devices must be upgraded to 6.2.2. When Security Fabric is enabled in FortiOS 6.2.2, all FortiGate devices must be running FortiOS 6.2.2.

Minimum version of TLS services automatically changed

For improved security, FortiOS 6.2.2 uses the ssl-min-proto-version option (under config system global) to control the minimum SSL protocol version used in communication between FortiGate and third-party SSL and TLS services.

When you upgrade to FortiOS 6.2.2 and later, the default ssl-min-proto-version option is TLS v1.2. The following SSL and TLS services inherit global settings to use TLS v1.2 as the default. You can override these settings.

• Email server (config system email-server) l Certificate (config vpn certificate setting) l FortiSandbox (config system fortisandbox)
• FortiGuard (config log fortiguard setting) l FortiAnalyzer (config log fortianalyzer setting) l LDAP server (config user ldap) l POP3 server (config user pop3)

Downgrading to previous firmware versions

Downgrading to previous firmware versions results in configuration loss on all models. Only the following settings are retained:

l operation mode l interface IP/management IP l static route table l DNS settings l admin user account l session helpers l system access profiles

Amazon AWS enhanced networking compatibility issue

With this enhancement, there is a compatibility issue with older AWS VM versions. After downgrading a 6.2.2 image to an older version, network connectivity is lost. Since AWS does not provide console access, you cannot recover the downgraded image.

When downgrading from 6.2.2 to older versions, running the enhanced nic driver is not allowed. The following AWS instances are affected:

• C3 l C4 l R3
• I2 l M4 l D2

FortiLink access-profile setting

The new FortiLink local-access profile controls access to the physical interface of a FortiSwitch that is managed by FortiGate.

After upgrading FortiGate to 6.2.2, the interface allowaccess configuration on all managed FortiSwitches are overwritten by the default FortiGate local-access profile. You must manually add your protocols to the localaccess profile after upgrading to 6.2.2.

To configure local-access profile:

config switch-controller security-policy local-access edit [Policy Name] set mgmt-allowaccess https ping ssh set internal-allowaccess https ping ssh

next

end

To apply local-access profile to managed FortiSwitch:

config switch-controller managed-switch edit [FortiSwitch Serial Number] set switch-profile [Policy Name] set access-profile [Policy Name]

next

end

FortiGate VM with V-license

This version allows FortiGate VM with V-License to enable split-vdom.

To enable split-vdom:

config system global set vdom-mode [no-vdom | split vdom]

end

FortiGate VM firmware

Fortinet provides FortiGate VM firmware images for the following virtual environments:

Citrix XenServer and Open Source XenServer

• .out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
• .out.OpenXen.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains the QCOW2 file for Open Source XenServer.
• .out.CitrixXen.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains the Citrix XenServer Virtual Appliance (XVA), Virtual Hard Disk (VHD), and OVF files.

Linux KVM

• .out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
• .out.kvm.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains QCOW2 that can be used by qemu.

Microsoft Hyper-V

• .out: Download the 64-bit firmware image to upgrade your existing FortiGate VM installation.
• .out.hyperv.zip: Download the 64-bit package for a new FortiGate VM installation. This package contains three folders that can be imported by Hyper-V Manager on Hyper-V 2012. It also contains the file vhd in the Virtual Hard Disks folder that can be manually added to the Hyper-V Manager.

VMware ESX and ESXi

• .out: Download either the 64-bit firmware image to upgrade your existing FortiGate VM installation.
• .ovf.zip: Download either the 64-bit package for a new FortiGate VM installation. This package contains Open Virtualization Format (OVF) files for VMware and two Virtual Machine Disk Format (VMDK) files used by the OVF file during deployment.

Firmware image checksums

The MD5 checksums for all Fortinet software and firmware releases are available at the Customer Service & Support portal, https://support.fortinet.com. After logging in select Download > Firmware Image Checksums, enter the image file name including the extension, and select Get Checksum Code.

FortiGuard update-server-location setting

The FortiGuard update-server-location default setting is different between hardware platforms and VMs. On hardware platforms, the default is any. On VMs, the default is usa.

On VMs, after upgrading from 5.6.3 or earlier to 5.6.4 or later (including 6.0.0 or later), update-server-location is set to usa.

If necessary, set update-server-location to use the nearest or low-latency FDS servers.

To set FortiGuard update-server-location:

config system fortiguard set update-server-location [usa|any]

end

FortiView widgets

FortiView widgets have been rewritten in 6.2.2. FortiView widgets created in previous versions are deleted in the upgrade.

 

Product integration and support

The following table lists FortiOS 6.2.2 product integration and support information:

Web Browsers	l Microsoft Edge 41 l Mozilla Firefox version 59 l Google Chrome version 65 Other web browsers may function correctly, but are not supported by Fortinet.
Explicit Web Proxy Browser	l Microsoft Edge 41 l Mozilla Firefox version 59 l Google Chrome version 65 Other web browsers may function correctly, but are not supported by Fortinet.
FortiManager	See important compatibility information in Fortinet Security Fabric upgrade on page 25. For the latest information, see FortiManager compatibility with FortiOS in the Fortinet Document Library. Upgrade FortiManager before upgrading FortiGate.
FortiAnalyzer	See important compatibility information in Fortinet Security Fabric upgrade on page 25. For the latest information, see FortiAnalyzer compatibility with FortiOS in the Fortinet Document Library. Upgrade FortiAnalyzer before upgrading FortiGate.
FortiClient: l Microsoft Windows l Mac OS X l Linux	l 6.2.0 See important compatibility information in FortiClient Endpoint Telemetry license on page 25 and Fortinet Security Fabric upgrade on page 25. FortiClient for Linux is supported on Ubuntu 16.04 and later, Red Hat 7.4 and later, and CentOS 7.4 and later. If you are using FortiClient only for IPsec VPN or SSL VPN, FortiClient version 5.6.0 and later are supported.
FortiClient iOS	l 6.2.0 and later
FortiClient Android and FortiClient VPN Android	l 6.2.0 and later
FortiAP	l 5.4.2 and later l 5.6.0 and later
FortiAP-S	l 5.4.3 and later l 5.6.0 and later
FortiAP-U	l 5.4.5 and later
FortiAP-W2	l 5.6.0 and later

 

FortiSwitch OS (FortiLink support)	l 3.6.9 and later
FortiController	l 5.2.5 and later Supported models: FCTL-5103B, FCTL-5903C, FCTL-5913C
FortiSandbox	l 2.3.3 and later
Fortinet Single Sign-On (FSSO)	l 5.0 build 0282 and later (needed for FSSO agent support OU in group filters) l Windows Server 2016 Datacenter l Windows Server 2016 Standard l Windows Server 2016 Core l Windows Server 2012 Standard l Windows Server 2012 R2 Standard l Windows Server 2012 Core l Windows Server 2008 (32-bit and 64-bit) l Windows Server 2008 R2 64-bit l Windows Server 2008 Core l Novell eDirectory 8.8
FortiExtender	l 3.2.1
AV Engine	l 6.00132
IPS Engine	l 5.00035
Virtualization Environments
Citrix	l XenServer version 5.6 Service Pack 2 l XenServer version 6.0 and later
Linux KVM	l RHEL 7.1/Ubuntu 12.04 and later l CentOS 6.4 (qemu 0.12.1) and later
Microsoft	l Hyper-V Server 2008 R2, 2012, 2012 R2, and 2016
Open Source	l XenServer version 3.4.3 l XenServer version 4.1 and later
VMware	l  ESX versions 4.0 and 4.1 l  ESXi versions 4.0, 4.1, 5.0, 5.1, 5.5, 6.0, 6.5, and 6.7
VM Series – SR-IOV	The following NIC chipset cards are supported: l Intel 82599 l Intel X540 l Intel X710/XL710

Language support

The following table lists language support information.

Language support

Language	GUI
English	✔
Chinese (Simplified)	✔
Chinese (Traditional)	✔
French	✔
Japanese	✔
Korean	✔
Portuguese (Brazil)	✔
Spanish	✔

SSL VPN support

SSL VPN standalone client

The following table lists SSL VPN tunnel client standalone installer for the following operating systems.

Operating system and installers

Operating System	Installer
Linux CentOS 6.5 / 7 (32-bit & 64-bit) Linux Ubuntu 16.04 / 18.04 (32-bit & 64-bit)	2336. Download from the Fortinet Developer Network: https://fndn.fortinet.net.

Other operating systems may function correctly, but are not supported by Fortinet.

SSL VPN web mode

The following table lists the operating systems and web browsers supported by SSL VPN web mode.

Supported operating systems and web browsers

Operating System	Web Browser
Microsoft Windows 7 SP1 (32-bit & 64-bit)	Mozilla Firefox version 61 Google Chrome version 68
Microsoft Windows 10 (64-bit)	Microsoft Edge Mozilla Firefox version 61 Google Chrome version 68
Linux CentOS 6.5 / 7 (32-bit & 64-bit)	Mozilla Firefox version 54
OS X El Capitan 10.11.1	Apple Safari version 11 Mozilla Firefox version 61 Google Chrome version 68
iOS	Apple Safari Mozilla Firefox Google Chrome
Android	Mozilla Firefox Google Chrome

Other operating systems and web browsers may function correctly, but are not supported by Fortinet.

SSL VPN host compatibility list

The following table lists the antivirus and firewall client software packages that are supported.

Supported Microsoft Windows XP antivirus and firewall software

Product	Antivirus		Firewall
Symantec Endpoint Protection 11	✔		✔
Kaspersky Antivirus 2009	✔
McAfee Security Center 8.1	✔		✔
Trend Micro Internet Security Pro	✔		✔
F-Secure Internet Security 2009	✔		✔

Supported Microsoft Windows 7 32-bit antivirus and firewall software

Product	Antivirus	Firewall
CA Internet Security Suite Plus Software	✔	✔
AVG Internet Security 2011
F-Secure Internet Security 2011	✔	✔
Kaspersky Internet Security 2011	✔	✔
McAfee Internet Security 2011	✔	✔
Norton 360™ Version 4.0	✔	✔
Norton™ Internet Security 2011	✔	✔
Panda Internet Security 2011	✔	✔
Sophos Security Suite	✔	✔
Trend Micro Titanium Internet Security	✔	✔
ZoneAlarm Security Suite	✔	✔
Symantec Endpoint Protection Small Business Edition 12.0	✔	✔

 

Resolved issues

The following issues have been fixed in version 6.2.2. For inquires about a particular bug, please contact Customer Service & Support.

New features or enhancements

Bug ID	Description
457153	Support for SSL VPN sign on using certificate and remote (LDAP or RADIUS) username/password authentication.
538760	Monitor API to check SLBC cluster checksum status. New API added – monitor/system/configsync/status.
544704	FortiOS support for 802.11ax FortiAP-U431F/U433F.
550912	Support for link aggregation LACP on entry level FortiGate is extended to all two-digit entry level box for the following models: FGR-30D, FGR-35D, FG-30E, FG-30E-MI, FG-30E-MN, FG-50E, FG-51E, FG-52E, FG-60E, FG-60E-POE, FG-61E, FG-80D, FG-80E, FG-80E-POE, FG-81E, FG-81E-POE, FG-90E, FG-91E, FG-92D, FWF-30E, FWF-30E-MI, FWF-30E-MN, FWF-50E, FWF-50E-2R, FWF-51E, FWF-60E, FWF-61E
554965	IPv6 is supported in communication between the following: l Collector agent and FortiGate l Collector agent and DC_agent l Collector agent and terminal server agent

AntiSpam

Bug ID	Description
559802	Spam mail can’t be checked by antispam filter on SMTP protocol.

AntiVirus

Bug ID	Description
545381	When proxy-av is configured for firewall policy, FTP file upload is stopped.
553143	Redundant logs and alert emails sent when file is sent to FortiSandbox Cloud via Suspicious Files Only.
561524	Cannot send an email with PDF attachment when FortiSandbox Cloud Inspection is enabled.
562037	CDR does not disarm files when they are sent over HTTP-POST even though despite AV logs show file has been disarmed.
Bug ID		Description
575177		Advanced Threat Protection Statistics widget clean file count is incorrect.
580212		Policy in flow mode blocking Adobe creative cloud desktop application.

Application Control

Bug ID	Description
558380	AppCtl does not detect application with webproxy-forward-server.

DNS Filter

Bug ID	Description
567172	Enforcing Safe Search in 6.0.5 blocks access to Google domains which makes Safe Search not work.
578267	DNS request to a second DNS server with same Transaction ID is discarded when DNS Filter is enabled on a policy.
581778	Cannot re-order DNS domain filter list.

Data Leak Prevention

Bug ID	Description
522472	DLP logs have a wrong reference link to archived file.
540317	DLP cannot detect attached zip files when receiving emails via MAPI over HTTP.
570379	DLP only detects the first word of filename.

Explicit Proxy

Bug ID	Description
543794	High CPU due to WAD process.
552334	Website does not work with SSL Deep inspection due to OCSP validation process.
557265	Browser redirect loop after re-authentication when using proxy-re-authentication-mode absolute.
561843	AppCtl unscans the traffic to forwarding to upstream proxy.
564582	Explicit proxy policy treats domain.tld in FQDN firewall address object as wildcard.
567029	WAD crashes at crypto_kxp_xform_block_enc when WAD is restarted while visiting a website after an authentication.
571034	Using disclaimer causes incorrect redirection.
Bug ID	Description
572220	Unable to match the expected firewall proxy-policy when dstint is set to Zone where Zone member has PPPoE interface.
577372	WAD has signal 11 crash at wad_ssl_cert_get_auth_status.

Firewall

Bug ID	Description
539421	Load Balance monitor stats reset after mode change.
540949	Health status of standby server in server load balance not available in GUI or CLI.
545056	Firewall should not be evaluated when an interface bandwidth widget is added to the dashboard.
552329	NP6 sessions dropped after any change in GUI.
554329	Schedule policy is not activated on time.
558689	Traffic dropped by anti replay in ECMP with IPS.
558690	Session timer left at half-open value once established in an ECMP with IPS context.
563471	HTTP load balancing doesn’t work after rebooting in Transparent mode.
563928	SFTP connection failure when SSH DPI and app-ctrl are enabled.
564990	Captive-portal-exempt is not supported in consolidated policy.
566951	Unexpected reverse path check failure on IPv6.
570468	FortiGate randomly not processing some NAT64 packets.
570507	Application control causing NAT hairpin traffic to be dropped. Workaround: Create a new firewall policy from scratch and the default application control can be applied again.
571022	SNAT before encryption in policy-based VPN for local traffic after upgrade from 5.6.8 to 6.0.5.
571832	Provide different protocol/port list when the same ISDB object is used as source/destination.
577752	Policy with a VIP with a destination interface of a zone is dropping packets.

FortiView

Bug ID	Description
527540	Cannot click the Quarantine Host option on a registered device.
537819	FortiView All Sessions page: tooltip of geography IP show ‘undefined’.
553627	FortiView pages cannot load with Failed to retrieve FortiView data.

GUI

Bug ID	Description
445074	The MMS profiles pages have been removed from the FortiOS Carrier GUI. Workaround: You can configure MMS profiles from the CLI using the config firewall mms-profile command.
479692	GUI shows error Image file doesn’t match platform even when the user is uploading correct image.
486230	GUI on FGT3800D with 5.6.3 is very slow – configuration with numerous policies.
493704	While accessing the FortiGate page, PC browser memory usage keeps spiking and finally PC hangs.
502740	Remove GUI instructions for Dialup-FortiClient VPN.
504829	GUI should not log out if there is 401 error on downstream device.
513157	Cannot filter on hit count “0” for policy match.
523403	GUI Protocol Port Mapping configuration should be rejected when an invalid port number such as -1 is entered.
526254	Interface page keep loading when VDOM admin have netgrp permission.
528649	vpngrp read or read-write access profile doesn’t work properly.
540056	Error message enhancement while creating packet capture in GUI with filter set to high port range.
540737	Should show warning and block user to use no-inspection SSL-SSH profile when any UTM profile is used.
543487	Collected Email Monitor page cannot list the wireless client if connected from captive-portal+emailcollection.
543637	Not able to filter the policy by multiple ID.
544313	GUI SD-WAN Monitor page keep loading.
548653	SSO_admin (super_admin) can’t open CLI window from GUI. Error says too many concurrent connection.
552552	Personal Privacy in FortiGuard category based filter mistranslated.
555121	Context menu of AP Group has unsupported actions enabled after change view on Managed FortiAPs page.
559799	Webhook automation host header incorrect.
560430	Some app-category cannot be listed on security policy editing page and get JS error.
561334	GUI SSID main passphrase and MPSK minimum length should be flexible according to new “wfacompatibility” setting.
563053	Warning message for third-party transceivers were removed for 6.2.1 to prevent excessive RMA or support tickets. 6.2.2 re-added the warning for third-party transceivers.
563445	Upgrade NGFW VDOM from v6.2.0, security policy should support virtual-wan-link interface.
Bug ID	Description
564201	After OSPF change via GUI, password for virtual-link will completely disappear and must be reentered.
564601	Remove the license requirement to upload FortiGuard packages through the GUI when in USG mode.
565109	Add Selected button does not appear under Application Control slide-in when VDOM is enabled.
566666	AP comments do not appear on the columns for Managed AP page.
568176	GUI response is very slow when accessing Route-Monitor page in GUI.
569080	SD-WAN rule GUI page doesn’t show red exclamation mark for DST-negate enabled, like firewall policy.
569259	Fabric SAML with FortiManager management. Downstream FortiGate login with SAML super admin only have read-only access on most pages.
571674	GUI config changes generate misleading config event logs.
571828	GUI admin password injected as PSK when adding phase2 configuration on Chrome.
572027	In Log View/FortiView, GUI cannot list logs from FortiAnalyzer on FGT/FWF boxes.
573070	Interface widget not loading fully (keeps spinning) when a VDOM “prof_admin” is used.
573869	Log search index files are never deleted when the logdisk is out of space.
574239	AWS/AWSONDEMAND missing dropdown selection box for HTTPS server and WiFi certificates in GUI.
575756	Port Link speed option is missing on the FortiGate GUI after upgrading the managed FortiSwitch to 6.2.1.
579259	Firewall User Monitor shows “Failed to retrieve info” and no entries if session-based proxy authentication is used.
583760	After adding few Web Rating Overrides via GUI to an already existing long list of URIs, Web Rating Overrides page is not loaded and keeps spinning.

HA

Bug ID	Description
543602	Unnecessary syncing process started during upgrade when it takes longer.
554187	HA slave gets FW Signature un-certified after upgrading image from the master.
555056	Enable 2-factor using vcluster in GUI gets overwritten (sync) by slave.
555998	Load balanced (A-A) slave-session doesn’t forward traffic after session is dirtied due to FortiManager policy install.
557277	FortiGate FGSP configured with standalone-config-sync will sync the FortinAlayzer source-IP configuration to the slave.
Bug ID	Description
557473	FGSP found checksum mismatch after replaced one of the units in the cluster.
559172	VLAN in VDOM in virtual cluster not showing virtual MAC for the vcluster.
560096	Restoring config fails on slave when using TACACS+ (master OK).
560107	Cluster upgrade from 5.6.7 build 1653 to SB 5.6.8 build 3667 takes longer than normal.
563551	HASYNC aborts on slave unit.
569629	HA A-A local FQDN not resolving on slave unit.
574564	In an HA configuration with HA uninterruptible upgrade enabled, some signature database files may fail to synchronize upon upgrading from 5.6.9 and earlier to 5.6.10.
575715	Unable the sync the Local-GW in FGSP.
576638	HA cluster GUI change does not send logs to the slave immediately.
577115	Master unit console keeps showing message [ha_auth_set_logon_msg:228] buffer overflow.
578475	FortiGate HA reports not synced if firewall policy of master and slave does not contain the same VIP.

Intrusion Prevention

Bug ID	Description
545823	Creating/editing a DoS-Policy takes a long time. GUI hangs or displays Error 500: Internal Server Error.
561623	IPS engine 5.009 crashes when updated new FFDB has different size from the old one.

IPsec VPN

Bug ID	Description
449212	New dialup IPsec tunnel in policy mode/mode-cfg overwrites previously established tunnel.
537450	Site-to-site VPN policy based with DDNS destination fail to connect.
553759	ESP packets are sent to the wrong MAC after a routing change when IPsec SA is offloaded.
558693	FW90D VPN becomes unresponsive after changing VPN DDNS/Monitor.
559180	The command include-local-lan gets disabled after firewall is rebooted.
560223	Add support for EdDSA certificates for proxy-based deep-inspection / virtual-server when using TLS 1.3. This is resolved by: 0560223, 0561319, 0561820, 0561821, 0561822, 0561823, 0564510.
564237	After configuring SD-WAN and creating SD-WAN rule based on bandwidth criteria, the bandwidth value for tunnel interface is not calculated correctly.
569586	IPsec certificate based IKEv2 VPNs fail to read out certificate subject as username if ECC certificate is involved.
Bug ID	Description
571209	Traffic over VLAN sub-interface pushed through the IPsec policy based VPN interface.
574115	PKI certificates with OU and/or DC as subject fail for PKI user filters.
575238	Redirected traffic on the same interface (ingress and egress interface are the same) is dropped.
575477	IKED memory leak.
577502	OCVPN cannot register – status ‘Undefined’.

Log & Report

Bug ID	Description
387294	Country flags in Botnet C&C table and Top Destinations by Bandwidth table are all missing.
545948	FortiGate periodically stops sending syslog messages.
551459	srcintf is unknown-0 in traffic log for service DNS when action is IP connection error.
556199	No logs are generated when using local-in policy on ha-mgmt interface.
558702	miglogd not working until sysctl killall miglogd. Reboot does not help.
565216	Memory of miglogd increase and enter conserve mode.
565505	miglogd high CPU utilization.
566843	No log generated when traffic is blocked by setting tunnel-non-http in webproxy.
568795	Specific traffic type is not logged on FAZ/Memory.
576024	Set sniffer policy to only log logtraffic=utm but many traffic log stats are still generated in disk or FortiAnalyzer.

Proxy

Bug ID	Description
457347	WAD crashes in wad_http_client_body_done when ICAP is enabled.
544414	WAD handles transparent FTP/FTPS traffic.
551119	Certificate blacklist not working correctly in proxy mode.
559166	In firmware 6.0.5, WAD CPU usage on all cores reaches 100% in each around 30s.
562610	FortiGate generates WAD crash wad_mem_malloc.
563154	Can’t open a particular web page via explicit proxy with deep inspection and webfilter profile enabled.
566859	In WAD conserve mode 5.6.8, max_blocks value is high on some workers.
567796	WAD constantly crashes every few seconds.
567942	FortiGate cannot block blacklist certificate against TLS 1.3 if the blacklist certificate server address
Bug ID	Description
	is exempt.
568905	WAD crashes due to RCX null.
572489	SSL handshake sometimes fail due to FortiGate replying back FIN to client.
573340	WAD causing memory leak.
573721	For FortiGate with client certificate inspect mode, traffic will trigger WAD crash.
573917	Certain web pages time out.
574171	Fail to connect https://drive.google.com by TLS 1.3.
574730	Wildcard URL filter stops working after upgrade.
576852	WAD process crashes in internet_svc_entry_cmp.
579400	High CPU with authd process caused by WAD paring multiple line content-encoding error and IPC broken between wad and authd.
581865	In Proxy inspection with Application control and certificate inspection, TLS error for certain web pages,in EDGE browser only.
582714	WAD might leak memory during SSL session ticket resumption.
583736	WAD application crashing in v6.2.1.

REST API

Bug ID	Description
566837	HTTPSD process crashes when using REST API.

Routing

Bug ID	Description
558979	ECMP-based session with auxiliary session and IPS is not offloaded in reply direction.
559645	Creating static route from GUI should set Dynamic Gateway disabled by default.
560633	OSPF route for AD-VPN tunnel interface flaps.
562159	ADVPN OSPF unable to ping over ADVPN linknet.
567497	FortiGate sends PIM register messages to RP for group 64.0.0.0 about nonexistent sources.
570686	FortiOS 6.2.1 introduces asymmetric return path on the HUB in SD-WAN after the link change due to SLA on the spoke.
571714	DHCPv6 relay shows no route to host when there are multiple paths to reach it.
573789	OSPF with virtual clustering not learning routes.
578623	Gradual memory increase with full BGP table.
581488	BGP confederation router sending incorrect AS to neighbor-group routers.

SSL VPN

Bug ID	Description
476377	SSL VPN FortiClient login with FAC user FTM two-factor fail because it times out too fast.
478957	SSL VPN web portal login history is not displayed if logs are stored in FortiAnalyzer.
481038	Web application is not loading through SSL VPN portal.
491733	When SSL VPN receives multiple HTTPS post requests under web filter, read_request_data_ f loops even when client is stopped, which causes the SSL VPN process to use 99% of CPU.
496584	SSL VPN bad password attempt causes excessive bind requests against LDAP and lockout of accounts.
515889	SSL VPN web mode has trouble loading internal web application.
525172	A web application accessed through SSL VPN web mode triggers Error 500 on Java server.
530509	Invalid HTTP Request when SMB via SSL VPN bookmark is executed with MS Server 2016, but works fine with MS server 2008R2.
531848	FortiSIEM WebGUI does not load on web portal.
537341	SSL bookmark is not loading SAP portal information.
545177	Web mode fails for SharePoint page.
549654	Citrix bookmarks should be disabled in SSL VPN portal.
549994	SSL VPN web mode logon page should not show Skip button for remote user with Force password change on next logon.
551695	Office365 applications through SSL VPN bookmarks.
555344	Downloading PDF file throigh SSL VPN portal.
555611	SSL VPN web mode web forward not working for video camera system after upgrade to 6.0.4.
556657	Internal website not working through SSL VPN web mode.
558076	In firmware 6.2.0, RDWeb (Windows Server 2016) via SSL web portal does not work.
558080	McAfee ESM 11 display issues in SSL VPN web portal.
558473	For FG-200E, after upgrading from 6.0.4 to 6.2.0, SSL VPN HTTPS bBookmark does not load (Secure Connection Failed).
559171	With SSL VPN web mode unable to get dropdown menu from internal web page.
559785	FortiMail login page with SSL VPN portal not displaying correctly.
560505	SharePoint 2019 page access fails using web mode.
560730	SSL VPN web mode SSO doesn’t work for some site like FAc login.
560747	The referer header is not correct, and some files are not loaded properly.
561585	SSL VPN doesn’t correctly show Windows Admin center application.

 

Bug ID	Description
563147	Connection to internal portal freezes when using SSL VPN web bookmark.
563798	Redirect in bookmark is not loading.
564850	Object from CARL source not showing through SSL VPN web mode.
564871	SSL VPN users create multiple connections.
567182	In SSL VPN web mode, videos on internal website won’t display.
567626	SSL VPN still allows password expired users to change password and get access.
567628	SSL VPN banned-cipher SHA256 not completely working.
567987	In SSL VPN web mode, RDP disconnects when copying long text from remote to local.
568481	Internal website using java is not accessed using SSL VPN web mode.
568838	Internal website not working through SSL VPN web mode.
569030	SSL VPN tunnel mode can only add split tunneling of user’s policy with groups and its users in different SSL VPN policies.
569711	Error for proxy ssh database through SSL VPN.
570445	CMAT application through SSL VPN not working properly.
570620	SSL VPN web mode does not work properly for the website using JavaScript.
571005	NextCloud through SSL VPN behaving strangely.
571479	Cannot access sub-menus from the internal main website through the bookmark when using SSL VPN web mode.
571721	Local portal adzh-srop-nidm02.intern.cube.ch needs more than 10 min. to load via SSL VPN bookmark.
572653	Unable to access Qlik Sense URL via SSL VPN web mode .
573527	SSL web portal CSP v3 compatibility issue.
573853	TX packet drops on ssl.root interface.
574551	Subpages on internal websites are not working via SSL VPN web mode (Tunnel mode is OK).
574724	SSL VPN conserve mode on FWF-30E when FortiGate unit enters memory less than 25%.
575248	Synology DSM login page is not displayed when accessed via SSL VPN bookmark or connection tool.
575259	SSL VPN connection is being dropped intermittently.
576013	The SSL VPN web mode webserver link is not rewritten correctly after login.
576288	VIP customer – FSSO groups set in rule with SSL VPN interface.
578581	SSL web mode VPN portal freezing when opening some websites using JavaScript.
580182	The EOASIS website is not displayed properly using SSL VPN web mode.
Bug ID	Description
580384	SSL VPN web mode not redirecting URL as expected after successful login.
581863	Accessing http://nlyte.ote.gr/nlyte/ configured with bookmark name ‘NLYTE’ not getting authentication page.
582115	Third-party (Ultimo) web app does not load over SSL VPN web portal.
582161	Internal web application is not accessable through web SSL VPN.

Switch Controller

Bug ID	Description
557280	Need to add FSW port information on Security Fabric and device inventory the same as before 6.0.4.
563939	802-1X timer reauth-period option 0 doesn’t work.

System

Bug ID	Description
423311	200E/201E software switch span function does not work.
470875	OID seems to be COUNTER32 instead of GAUGE32.
498599	Can’t create loopback interface by VDOM admin if there’s no physical interface in VDOM.
520283	Can’t show global setting when VDOM admin run exec tac report command.
531675	SFP ports do not link down when SFP cat5 interface status of FortiGate on the other side goes down.
539970	Kernel panic on HA pair of 301E.
540083	Partial traffic outage with softirq on 100%.
545449	IPinIP traffic over another IPinIP is dropped in NP6-Lite when offloading is enabled.
550206	Memory (SKB) which is no longer needed is not released in NP6 and NP6lite drivers (100E, 140E, 3600D, 3800D).
551281	process_tunnel_timeout_notify:377, send timeout notify message error -1 1 message printed in console.
556408	Aggregate link doesn’t work for LACP mode active for 60E internal ports but works for wan1 and wan2 combination.
557172	When there are many application-control based Internet-service entries in SD-WAN, system performance is affected by high CPU usage of softirq.
557527	FortiGate as L2TP client does not negotiate correctly.
557798	High memory utilization caused by authd and WAD processes.

 

Bug ID	Description
559467	Support four DNS records inside DHCP offer.
560411	3980E unresponsive with millions of sessions in TIME_WAIT.
560686	4x10G split-port does not work on FG-3700D rev 2.
561097	SD-WAN rule corrupted on reboot after ISDB update.
561234	FG-800D shows wrong HA, ALERM LED status.
561929	REST API cmdb/router/aspath-list is not inserting new values.
562049	TLS 1.3 resumption and Pre-Shared Key (PSK) fail if Hello Retry Request is received.
563232	Authorization fails when 0.0.0.0/0 is listed as the trusted host.
563497	The trust-ip-x feature on interface does not work.
564184	Split DNS not working. CNAME fails to resolve.
564579	Updated crash signal 14, object creation not allowed from cli errno=Resource temporarily unavailable.
564911	DHCPDISCOVERY NATed with TP management IP when sent to NAT VDOM .
565291	SD-WAN rule doesn’t work with nested firewall address group selected as source or destination.
565296	Wrong configuration transmitted by FOS to FortiManager under certain conditions.
565631	DHCP relay sessions are removed from the session table after applying any config change.
567487	CPU goes to 100% when modifying members of an addrgrp object.
567504	Speed test break the cluster.
568215	Kernel bug at net/core/skbuff.
569652	High memory utilization after FortiOS and IPSengine upgrade.
570227	FortiGate is not selecting an NTP server that has a clock time in the majority clique of other NTP servers.
570834	STP (Spanning Tree) flapping.
571207	DHCP with manual address does not provide subnetmask in DHCP ACK.
572411	Timezone for Canary Islands is missing.
572428	lldptx – Application Crashed – Signal 11 Segmentation Fault.
572707	Configuration is corrupted when restoring a VDOM.
572763	softirq causing high CPU when session increase in an acceptable way.
573177	GUI cannot save edits made on replacement messages in a VDOM. When using CLI, user gets logged out while editing.
574086	Kernel panic occurs after upgrading from 6.2.0 to 6.2.1.
574110	When adding admin down interface as a member of aggregate interface, it shows up and process
Bug ID	Description
	the traffic.
574327	FortiGate CSR traffic to SCEP srv generated from the root VDOM instead of the VDOM we create the CSR.
574991	FortiGate can’t extract the user principal name UPN from user certificate when certificate contains UPN and additional names.
576063	Crashlog keeps having cid could not load sigs after FortiGate is authed into FortiManager.
577047	FortiGate takes a long time to reboot when it has many firewall addresses used in many policies.
577302	Virtual WAN Link process (vwl) memory usage keeps increasing after upgrading to 6.2.1.
578531	forticldd deamon resolved mgrctrl1.fortinet.com to wrong IP address.
578746	FortiGate does not accept FortiManager created country code and causes address install fails.
579524	DHCP lease is not stable and dhcpd process crashes.
580185	authd4 crashes when deleting a VDOM or rebooting the FortiGate.
580883	DNS servers acquired via PPPoE in non-management VDOMs are used for DHCP DNS server option 6.
582547	fgfmsd crash makes connection to FortiManager go down.

Upgrade

Bug ID	Description
550410	Cannot edit addrgrp which includes wildcardfqdn object after upgrade from v5.6.x.
556002	Some firewall policies were deleted after upgrade from FOS 6.0.4 to FOS 6.2.0.
558995	L2 WCCP stops working after upgrade to FOS 6.0.3 or newer.
562444	The firewall policy with internet-service enabled was lost after upgrade from 6.0.5.
580450	Policies removed after an upgrade in NGFW Policy Mode: maximum number of entries has been reached.

User & Device

Bug ID	Description
547657	Disclaimer+Auth Guest portal RADIUS auth failing due to FAC trying to resolve 3rd party websites as access-points.
549394	fnbamd crashes frequently.
558332	CoA from FAC is not working for FortiGate wired interface based captive portal.
561289	User-based Kerberos Authentication not working in new VDOM.
Bug ID	Description
561610	src-vis process memory leak.
562185	Disclaimer redirection to IP instead of FQDN results in Certificate/SSL warning.
562861	RADIUS CoA (disconnect request) not working with use-management-vdom.
567990	Hard-timeout setting not working for captive portal.

Bug ID	Description
564290	FOS can’t collaborate web-cache with FortiProxy successfully.

VM

Bug ID	Description
524052	Application cloudinitd has signal 11 crash on FortiGate-VM64-GCP.
561083	VPN tunnels not coming up after HA failover in GCP.
561909	Azure SDN connector try querying invalid FQDN when using Azure Stack Integrated systems.
567137	VM in Oracle cloud has 100% CPU usage in system space.
570176	HA cluster multi AZ does not failover IPsec VPN in AWS with TGW.
571652	OCI SDN connector gets HTTP response err:500 when enabling use-metadata-iam.
573952	FGT-VM with network driver vmxnet3 has lots of fragments when testing throughput.
575400	In Azure SDN, the firewall address filter cannot fetch the secondary public and private IP addresses of the NICs.
578727	FGTVM_OPC unable to failover the route properly during failover.
578966	OpenStack PCI passthru sub interface VLAN cannot received traffic.
580738	In the Cluster setup, slave unit can have different fingerprint for the OCI SDN connector, which can cause unit to fail to connect to OCI metatdata server properly.
580911	EIP assigned to the secondary IP address on the OCI do not ‘t fail over during HA failover.
577856	Add missing AWS HA failover error log and set firewall.vip/vip46/vip6/vip64 not sync’ing when cross zone HA is configured.

VoIP

Bug ID	Description
570430	SIP ALG generates a VoIP session with wrong direction.
580588	SDP information fields are not being natted in Multipart Media Encapsulation traffic.

WanOpt Web Filter

Bug ID	Description
356487	When central-management is NONE, include-default-servers setting is not honored by rating.
549928	Block page images not loading for web sites protected by HSTS.
551956	Proxy web filtering blocks innocent sites due to urlsource=”FortiSandBox Block”.
565952	Proxy-based Webfilter breaks WCCP traffic.

WiFi Controller

Bug ID	Description
540027	FortiWiFi working as client mode cannot see and connect to the hotspot SSID from iOS devices.
569966	WPA2-Enterprise SSID authentication cannot utilize the source IP setting in RADIUS server configuration.
570745	FAPs detecting BSSIDs of others FAPs managed by the same WC as Fake-ap-on-air.
573024	FAP cannot be managed by FortiGate when admin trusthost is configured.

 

Known issues

The following issues have been identified in version 6.2.2. For inquires about a particular bug or to report a bug, please contact Customer Service & Support.

Data Leak Prevention

Bug ID	Description
586689	Downloading a file with FTP client in EPSV mode will hang.
DNS Filter
Bug ID	Description
586526	Unable to change DNS filter profile category action after upgrading from 6.0.5 to 6.2.0.
FortiView
Bug ID	Description
582341	Fortiview > policies: Consolidate policy without name and tooltips, Security policy with tooltips are not working.

GUI

Bug ID	Description
282160	GUI does not show byte info for aggregate and VLAN interface.
438298	When VDOM is enabled, the interface faceplate should only show data for interfaces managed by the admin.
480731	Interface filter get incorrect result (EMAC VLAN, VLAN ID, etc.) when entries are collapsed.
510685	Hardware Switch Row is shown, indicating a number of interfaces but without any interfaces below.
514632	Inconsistent Refcnt value in GUI when using ports in HA session-sync-dev.
537307	Gets “Fail to retrieve info” for ha-mgmt-interface on GUI > interface page.
540098	GUI does not display the status for VLAN and loopback under status column at Network > interfaces.
541042	Log viewer Forward Traffic cannot support double negate filter (client side issue).
542544	In Log & Report, filtering for blank values (None) always show no results.
553290	The tooltip of VLAN interface displays Failed to retrieve info on GUI.
Bug ID	Description
557786	GUI response is very slow when accessing IPSec-Monitor (api/v2/monitor/vpn/ipsec is taking a long time).
559866	When sending CSF proxied request, segfault happens (httpsd crashes) if FortiExplorer accesses root FortiGate via management tunnel.
565748	New interface pair consolidated policy added via CLI is not displayed on GUI policy page.
573456	FortiGate without disk Email Alert Settings page should remove Disk usage exceeds option.
574101	Empty firmware version in managed FortiSwitch from FortiGate GUI.
579711	An error occurs while running Security Rating.
583049	Internal Server Error while trying to create new interface.
584939	VPN event logs shows incorrectly when adding two action filters and if the filter action filter contains “-“.
586749	Enable/Disable Disarm and Reconstruction on GUI only takes effect on SMTP protocol in AV profile.

Bug ID	Description
573028	WAD crashes causing traffic interruption.
575224	WAD – high memory usage from worker process causing conserve mode and traffic issues.

HA

Bug ID	Description
479780	Slave fails to send and receive HA heartbeat on config cfg-revert setting on FGT2500E.
575020	HA failing config sync on VM01 with error (slave and master have different hdisk status) when master is pre-configured.
581906	HA slave sending out GARP packets in 16-20 seconds after HA monitored interface failed.
586004	Moving VDOM via GUI between virtual clusters causes cluster to go out of sync but VDOM state work/standby doesn’t change.

IPsec VPN

Bug ID	Description
582251	IKEv2 with eap auth peerid validation doesn’t work.

Proxy REST API

Bug ID	Description
584631	REST API admin with token unable to configure HA setting (via login session can work).

Security Fabric

Bug ID	Description
578268	Downstream device shows offline.
586587	Security Fabric widget keep loading when FortiSwitch is in a loop or two FortiSwitches are in mclag mode.
587758	Invalid CIDR format shows as valid by Security Fabric threat feed.

SSL VPN

Bug ID	Description
505986	On IE 11, SSL VPN web portal displays blank page title {{::data.portal.heading}} after authentication.
563022	SSL VPN LDAP group object matching only matches the first policy, isn’t ‘t consistent with normal firewall policy.
585754	An SSL VPN bookmark failed to load the GUI of proxmox GUI interface.

Switch Controller

Bug ID	Description
581370	FortiSwitch managed by FortiGate not updating RADIUS settings and user group in the FortiSwitch.
586299	Adding factory-reset device to HA fails with switch-controller.qos settings in root.

System

Bug ID	Description
464340	EHP drops for units with no NP_SERVICE_MODULE.
484749	TCP traffic with tcp_ecn tag cannot go through ipip IPv6 tunnel with NP6 offload enabled.
555616	TCP packets send wrong interface and high CPU.
562212	Management tunnel to devices goes down and cannot reclaim tunnel; so policy pushes get stuck.
570759	RX/TX counters for VLAN interfaces based on LACP interface are 0.
573973	ASIC offloading sessions sticking to interfaces after SD-WAN SLA interface selection.
Bug ID	Description
575013	Errors in the FortiGate’s CLI 8 debug, when FortiManager is obtaining the HA status and mgmtdata status, if ha-mgmt-status enabled.
581998	Session clash event log found on FG-6500F when passing a lot of same source IP ICMP traffic over Load balance VIP.

User & Device

Bug ID	Description
569062	fnbamd takes high CPU usage and user cannot authenticate.

VM

Bug ID	Description
579013	FortiGate HA failover fails in Azure stack due to invalid authentication token tenant.
579708	Should replace GUI option to register to FortiCare from AWS PAYG with link to portal for registration.
587180	FGTVM64_KVM is unable to boot up properly when doing a hard reboot with the host.
587757	FG-VM image unable to be deployed on AWS with additional disk of type HDD(st1).

WiFi Controller

Bug ID	Description
555659	When FAP is managed across VDOM links, WiFi client can’t join SSID when auto-asicoffload is enabled.

 

Limitations

Citrix XenServer limitations

The following limitations apply to Citrix XenServer installations:

• XenTools installation is not supported.
• FortiGate-VM can be imported or deployed in only the following three formats:
• XVA (recommended)
• VHD l OVF
• The XVA format comes pre-configured with default configurations for VM name, virtual CPU, memory, and virtual NIC. Other formats will require manual configuration before the first power on process.

Open source XenServer limitations

When using Linux Ubuntu version 11.10, XenServer version 4.1.0, and libvir version 0.9.2, importing issues may arise when using the QCOW2 format and existing HDA issues.