Release Notes

FortiSwitchOS 7.4.0
FORTINET DOCUMENT LIBRARY
https://docs.fortinet.com

FORTINET VIDEO GUIDE

https://video.fortinet.com

FORTINET BLOG
https://blog.fortinet.com

CUSTOMER SERVICE & SUPPORT

https://support.fortinet.com

FORTINET TRAINING & CERTIFICATION PROGRAM

https://www.fortinet.com/training-certification

NSE INSTITUTE
https://training.fortinet.com

FORTIGUARD CENTER
https://www.fortiguard.com

END USER LICENSE AGREEMENT

https://www.fortinet.com/doc/legal/EULA.pdf

FEEDBACK
Email: [email protected]

December 12, 2023

FortiSwitchOS 7.4.0 Release Notes
11-740-882418-20231212
 TABLE OF CONTENTS

Change log 4
Introduction 5
Supported models 5
What’s new in FortiSwitchOS 7.4.0 6
GUI changes 6
CLI changes 6
GUI and CLI changes 7
REST API changes 8
Special notices 10
Zero-touch management 10
By default, auto-network is enabled in FortiSwitchOS 7.2.0 and later 10
Downgrading FortiSwitchOS 7.0.0 and later to versions earlier than 6.2.6 or 6.4.4 is not
supported 10
Downgrading your FortiSwitchOS version requires converting the admin password
format first 10
Connecting multiple FSR-112D-POE switches 11
Upgrade information 12
Product integration and support 13
FortiSwitchOS 7.4.0 support 13
Resolved issues 14
Known issues 16

FortiSwitchOS 7.4.0 Release Notes 3

Fortinet Inc.
Change log

Change log

Date Change Description

June 2, 2023 Initial release for FortiSwitchOS 7.4.0

June 14, 2023 Added bug 903001.

July 20, 2023 Added another new feature (additional weaker ciphers algorithms are now removed).

December 12, 2023 Removed bug 673433.

FortiSwitchOS 7.4.0 Release Notes 4

Fortinet Inc.
 Introduction

Introduction

This document provides the following information for FortiSwitchOS 7.4.0 build 0767.
l Supported models on page 5
l Special notices on page 10
l Upgrade information on page 12
l Product integration and support on page 13
l Resolved issues on page 14
l Known issues on page 16
See the Fortinet Document Library for FortiSwitchOS documentation.

Supported models

FortiSwitchOS 7.4.0 supports the following models:

FortiSwitch 1xx FS-108E, FS-108E-POE, FS-108E-FPOE, FS-108F, FS-108F-POE, FS-108F-FPOE, FS-

124E, FS-124E-POE, FS-124E-FPOE, FS-124F, FS-124F-POE, FS-124F-FPOE, FS-148E,
FS-148E-POE, FS-148F, FS-148F-POE, FS-148F-FPOE

FortiSwitch 2xx FS-224D-FPOE, FS-224E, FS-224E-POE, FS-248D, FS-248E-POE, FS-248E-FPOE

FortiSwitch 4xx FS-424E, FS-424E-POE, FS-424E-FPOE, FS-424E-Fiber, FS-M426E-FPOE, FS-448E, FS-

448E-POE, FS-448E-FPOE

FortiSwitch 5xx FS-524D, FS-524D-FPOE, FS-548D, FS-548D-FPOE

FortiSwitch 1xxx FS-1024D, FS-1024E, FS-1048E, FS-T1024E

FortiSwitch 3xxx FS-3032E

FortiSwitch Rugged FSR-112D-POE, FSR-124D, FSR-424F-POE

FortiSwitchOS 7.4.0 Release Notes 5

Fortinet Inc.
 Introduction

What’s new in FortiSwitchOS 7.4.0

Release 7.4.0 provides the following new features.

GUI changes

l The System > Dashboard page has been reorganized to focus on the operational status of the FortiSwitch unit. In
addition, there are now graphs for both the last day and last week of the switchʼs CPU usage, RAM usage, and
temperature.
l The charts for port and interface traffic and packet losses have been enhanced.
l The Route Monitor (Router > Monitor > Routing) and IPv6 Route Monitor (Router > Monitor > IPv6 Routing) now
display the routes graphically, as well as in a table. When you hover your cursor over a route, the route is
highlighted, and the destination and interface of the route are displayed.
l You can now add a peer user in the GUI.
l The Switch > Monitor > 802.1x Status page is now the Switch > Monitor > 802.1x > Interfaces page.
l There is now a separate Switch > Monitor > 802.1x > Sessions page that displays the 802.1x MAC authenticated
sessions. In the Sessions page, you can search for partial or complete MAC addresses. You can also select one or
more MAC addresses and de-authorize the clients at those MAC addresses.
l The GUI now provides OS image signature verification.
l If you upload an unverified firmware image, the GUI displays a “WARNING: This firmware failed signature
validation.” message.
l If you log in to a FortiSwitch unit running an unverified firmware image, the GUI displays an “Unverified Image
Detected” message.
l After you log in to a FortiSwitch unit running an unverified firmware image, the GUI displays a triangle with a red
exclamation mark in the title bar.

CLI changes

l You can now use the Border Gateway Protocol (BGP) Ethernet Virtual Private Network (EVPN) with Virtual
Extensible LAN (VXLAN).
l ARP/ND suppression is now supported for BGP EVPN.
l The FSR-112D-POE, FSR-124D, FS-1xxE, and FS-1xxF models now support IPv6 router advertisement (RA)
guard.
l You can now back up the FortiSwitch configuration or logs to a Secure File Transfer Protocol (SFTP) server. You
can also restore the FortiSwitch configuration or firmware from an SFTP server. You can use an IPv4 address, IPv6
address, or fully qualified domain name (FQDN) to specify the SFTP server.
l You can now specify in the CLI that the access control list (ACL) prelookup policy applies to all ingress interfaces.
Previously, you could specify only a single interface.
l The Message-Authenticator attribute is now used for authentication in MAC authentication bypass (MAB) Access-
Request messages.
l The new get system interface vlan command lists information about the VLAN interfaces.
l The new get system interface vxlan command lists information about the VXLAN interfaces.

FortiSwitchOS 7.4.0 Release Notes 6

Fortinet Inc.
 Introduction

l As part of the existing support for RFC 2233, the following counters have been added:
l ifInOctets
l ifInUcastPkts

l ifInErrors

l ifInDiscards

l ifOutOctets

l ifOutUcastPkts

l ifOutErrors

l ifOutDiscards

NOTE: The link status and duplex status are available on all platforms. Some statistics are not tracked
(.dot3StatsLateCollisions, .dot3StatsExcessiveCollisions, and .dot3StatsSymbolErrors). Some statistics
(.dot3StatsFCSErrors, .dot3StatsDeferredTransmissions, and .dot3StatsFrameTooLongs) are supported only on
the following switch models: FSR-124D, FSR-424F-POE, 200 Series, FS-4xxE, 500 Series, FS-1xxxD, and FS-
1xxxE.
l EAP-FAST is now supported.
l LACP fallback mode is now supported in the CLI. LACP fallback mode allows a selected port to stay up so that a
device not running LACP can still connect to the network.
l The commands for applying a Media Access Control security (MACsec) profile to a port have moved from under
config switch interface to under config switch physical-port. In addition, the execute macsec
clearstat interface, execute macsec reset interface, and execute macsec toggle
interface commands are now the execute macsec clearstat physical-port, execute macsec
reset physical-port, and execute macsec toggle physical-port commands.
l A new CLI command allows you to specify which hash algorithm is used to encode passwords for new administrator
accounts. You can select the PBKDF2, SHA1, or SHA256 hash algorithm. By default, the SHA256 hash algorithm is
used.
l The execute system admin account-convert command has been changed to execute system admin
account-convert-sha1 and execute system admin account-convert-sha256:
l Before downgrading to a FortiSwitchOS version earlier than 7.0.0, you need to ensure that the administrator
password is in SHA1 format. Use the execute system admin account-convert-sha1 command to
convert the administrator password to SHA1 encryption.
l Before downgrading to FortiSwitchOS 7.0.0 or later, you need to ensure that the administrator password is in
SHA1 or SHA256 format. Use the execute system admin account-convert-sha1 command to
convert the administrator password to SHA1 encryption. Use the execute system admin account-
convert-sha256 command to convert the password for a system administrator account to SHA256
encryption.
l The new set wildcard-fallback command allows FortiSwitchOS to try to match a login name with wildcard
system administrator names if FortiSwitchOS cannot match the exact login name.
l You can now split ports on the FS-T1024E and FS-1024E models. You can enable the maximum speed (100G) of
ports 25 and 26; each split port has a maximum speed of 25G.

GUI and CLI changes

l FS-1xx and FS-2xx models now support configuring a DHCP server.

l You can now add multiple administrators with wildcards in their names.
l To increase the security of strong cryptography, additional weaker ciphers algorithms are now removed. When you
enable strong cryptography (set strong-crypto enable under config system global), the following

FortiSwitchOS 7.4.0 Release Notes 7

Fortinet Inc.
 Introduction

ciphers and algorithms are currently supported:

l Ciphers (encryption algorithms):
l [email protected]
l aes128-ctr
l aes192-ctr
l aes256-ctr
l [email protected]
l [email protected]
l Key-exchange algorithms:
l [email protected]
l diffie-hellman-group-exchange-sha256
l Host-key algorithm:
l ssh-ed25519
l Message authentication code algorithms:
l [email protected]
l [email protected]
l [email protected]

REST API changes

The following REST API endpoint is new:

l The new execute/backup/config endpoint allows you to back up the switchʼs configuration.
The following REST API endpoint was removed:
l execute/backup/standalone-config

The following REST API schema changes were made for this release:
l In the cmdb/router/static endpoint, there is a new gw-l2-switch parameter to enable or disable the layer-2
gateway on the FortiSwitch unit.
l In the cmdb/switch/global endpoint, the auto-fortilink-discovery parameter was removed.
l In the cmdb/switch/interface endpoint, the auto-discovery-fortilink parameter was removed.
l In the cmdb/switch/physical-port endpoint, you can now specify 2500full for the speed parameter.
l In the monitor/switch/port-speed endpoint, you can now specify 2500full for the supported_speeds
parameter.
l In the cmdb/switch.lldp/profile endpoint, the auto-isl-auth, auto-isl-auth-encrypt, auto-isl-
auth-user, auto-isl-auth-identity, and auto-isl-auth-reauth parameters were added.
l In the cmdb/switch/trunk endpoint, there is a new fallback-port parameter for specifying the LACP
fallback port.
l In the cmdb/switch.acl/prelookup endpoint, the new interface-all parameter allows you to select all
interfaces.
l In the cmdb/system/admin endpoint, there is a new wildcard-fallback parameter to enable or disable
attempting authentication against wildcard accounts if authenticating the current account fails.
l In the cmdb/system.certificate/ca endpoint, there is a new Info parameter for information about the CA
certificate name.

FortiSwitchOS 7.4.0 Release Notes 8

Fortinet Inc.
Introduction

l In the cmdb/system.certifiate/local endpoint, there is a new Info parameter for information about the
local certificate name.
l In the cmdb/system/global endpoint, there is a new admin-password-hash parameter for selecting which
hash algorithm to use to encode the administrator password. The fortilink-auto-discovery and auto-isl
parameters were removed.
Refer to the FortiSwitch feature matrix for details about the features supported by each FortiSwitch model.

FortiSwitchOS 7.4.0 Release Notes 9

Fortinet Inc.
Special notices

Special notices

Zero-touch management

When a new FortiSwitch unit is started, by default, it will connect to the available manager, which can be a FortiGate
device, FortiLAN Cloud, or FortiSwitch Manager. All ports are enabled for auto discovery. The “internal” interface is the
DHCP client in all FortiSwitch models. If you do not want your FortiSwitch unit to be managed, you must disable the
features that you do not want active.

By default, auto-network is enabled in FortiSwitchOS 7.2.0 and later

After an execute factoryreset command is executed on a FortiSwitch unit in standalone mode, the auto-network
configuration is enabled by default. If you are not using auto-network, you must manually disable it:
config switch auto-network
set status disable
end

Downgrading FortiSwitchOS 7.0.0 and later to versions earlier than

6.2.6 or 6.4.4 is not supported

Downgrading FortiSwitchOS 7.0.0 and later to FortiSwitchOS 6.2.6 and later 6.2 versions is supported. Downgrading
FortiSwitchOS 7.0.0 and later to FortiSwitchOS 6.4.4 and later 6.4 versions is supported. Downgrading FortiSwitchOS
7.0.0 to versions earlier than FortiSwitchOS 6.2.6 or 6.4.4 is not supported.

Downgrading your FortiSwitchOS version requires converting the

admin password format first

Before downgrading to a FortiSwitchOS version earlier than 7.0.0, you need to ensure that the administrator password is
in SHA1 format. Use the execute system admin account-convert-sha1 command to convert the administrator
password to SHA1 encryption.
Before downgrading to FortiSwitchOS 7.0.0 or later, you need to ensure that the administrator password is in SHA1 or
SHA256 format.
l Use the execute system admin account-convert-sha1 command to convert the administrator password
to SHA1 encryption.
l Use the execute system admin account-convert-sha256 command to convert the password for a system
administrator account to SHA256 encryption.

FortiSwitchOS 7.4.0 Release Notes 10

Fortinet Inc.
Special notices

If you do not convert the admin password before downgrading, the admin password will not
work after the switch reboots with the earlier FortiSwitchOS version.

To convert the format of the admin password to SHA1 format:

1. Enter the following CLI command to convert the admin password to SHA1 encryption:

execute system admin account-convert-sha1 <admin_name>

2. Downgrade your firmware.

To convert the format of the admin password to SHA256 format:

1. Enter the following CLI command to convert the admin password to SHA256 encryption:

execute system admin account-convert-sha256 <admin_name>

2. Downgrade your firmware.

Connecting multiple FSR-112D-POE switches

The FSR-112D-POE switch does not support interconnectivity to other FSR-112D-POE switches using the PoE ports.
Fortinet recommends using the SFP ports to interconnect switches.

FortiSwitchOS 7.4.0 Release Notes 11

Fortinet Inc.
Upgrade information

Upgrade information

FortiSwitchOS 7.4.0 supports upgrading from FortiSwitchOS 3.5.0 and later.

For the FS-424E, FS-424E-POE, FS-424E-FPOE, FS-424E-Fiber, and FS-M426-FPOE models, there is a two-step
upgrade process if you are upgrading from FortiSwitchOS 6.0.x or 6.2.x to 7.2.x:
1. Upgrade from FortiSwitchOS 6.0.x or 6.2.x to FortiSwitchOS 6.4.12 or later.
2. Upgrade from FortiSwitchOS 6.4.12 or later to 7.2.x.

If you do not follow the two-step upgrade process, the FortiSwitch unit will not start
after the upgrade, and you will need to use the serial console to conclude the upgrade
(BIOS and OS).

For FortiSwitch units managed by FortiGate units, refer to the FortiLink Release Notes for upgrade information.

FortiSwitchOS 7.4.0 Release Notes 12

Fortinet Inc.
Product integration and support

Product integration and support

FortiSwitchOS 7.4.0 support

The following table lists FortiSwitchOS 7.4.0 product integration and support information.

Web browser l Mozilla Firefox version 52

l Google Chrome version 56
Other web browsers may function correctly, but are not supported by Fortinet.

FortiOS (FortiLink Refer to the FortiLink Compatibility table to find which FortiSwitchOS versions support which
Support) FortiOS versions.

FortiSwitchOS 7.4.0 Release Notes 13

Fortinet Inc.
Resolved issues

Resolved issues

The following issues have been fixed in FortiSwitchOS 7.4.0. For inquiries about a particular bug, please contact
Customer Service & Support.

Bug ID Description

829804 Changed which CLI commands are available, depending on whether the user has the enhanced
debugging license.

833450 Do not use multicast IP addresses in the ranges of 224-239.0.0.x and 224-239.128.0.x on the FS-
2xxD, FS-2xxE, FS-4xxD, and FS-4xxE models.

848619 When connecting FS-124F-POE to FS-148F-POE with the FTLF8519P3BNLFTN, the SFP module
port does not come up on the FS-148F-POE when auto-module is configured.

856123 When the network-monitor settings are enabled, there are multiple “CPU_SENSOR (78.0%)
cleared warning threshold of (85.0%)” messages in the log.

859563 When the admin password contains a space and is set in the GUI, the user cannot log in using the
GUI.

866288 ACLs should work correctly on the FS-3032E model.

867758 FortiSwitch units using IPv6 do not respond to SNMPv3 requests.

868358 It should optional to specify the Certificate Authority (CA) name when downloading the CA certificate
using the Simple Certificate Enrollment Protocol (SCEP).

868886, The GUI for the FS-224E-POE, FS-248E-POE, FS-448E-POE, FS-248E-FPOE, and FS-M426E-
869843 FPOE models shows the ports in brown and the message, “This port is unavailable under the current
configuration.”

869616 The FortiAnalyzer and FortiSwitch logs have multiple entries about the fan tray being detected or
undetected on an FS-1048E switch, although the fan status is good.

872727 After upgrading FortiSwitchOS, the status of PSU2 is wrongly reported as “Not inserted.”

874684 Some layer-2 managed FortiSwitch units are flagged as being layer-3 switches in the output for the
execute switch-controller get-conn-status command.

876134 The Switch > Interfaces page indicates that more than one security group can be selected, although
only one is supported.

877360 Using one of the mac-move commands on FX-1xxE and FS-1xxF models causes protocol packets to
be dropped when allowing an 802.1X client to move between ports that are not directly connected to
the FortiSwitch unit without having to delete the 802.1X session.

878762 A VLAN interface labeled mgmt causes the GUI to crash frequently.

879156 Creating a new LLDP-MED profile in the GUI results in an Internal Server Error.

885609 The Web console only works with the super_admin profile.

FortiSwitchOS 7.4.0 Release Notes 14

Fortinet Inc.
Resolved issues

Bug ID Description

891323 Going to the Router > Config > OSPF > Areas page results in an Internal Server Error.

892788 After the switch is rebooted, the fortilink-auto-discovery setting changes from disabled to
enabled.

896010 Some switches will assign two split ports with the same physical MAC address.

896288 For VXLAN interfaces, the static MAC addresses on the VLAN need to be added to the VXLAN MAC
address table instead of the VLAN MAC address table.

898637 The set poe-pre-standard-detect enable command does not work on the FS-124F-FPOE
and FS-148F-FPOE models.

902910 The 2048 key size generated certificate file shows the wrong key size in the CSR decoder.

905384 The IGMP-snooping daemon crashes on the FS-148F model.

906594 The GUI needs to support static IP/32.

FortiSwitchOS 7.4.0 Release Notes 15

Fortinet Inc.
Known issues

Known issues

The following known issues have been identified with FortiSwitchOS 7.4.0. For inquiries about a particular bug or to
report a bug, please contact Fortinet Customer Service & Support.

Bug ID Description

382518, 417024, DHCP snooping and dynamic ARP inspection (DAI) do not work with private VLANs
417073, 417099, (PVLANs).
438441

414972 IGMP snooping might not work correctly when used with 802.1x Dynamic VLAN
functionality.

480605 When DHCP snooping is enabled on the FSR-112D-POE, the switched virtual interface
(SVI) cannot get the IP address from the DHCP server.

Workarounds:
—Use a static IP address in the SVI when DHCP snooping is enabled on that VLAN.
—Temporarily disable dhcp-snooping on vlan, issue the execute interface
dhcpclient-renew <interface> command to renew the IP address. After the SVI gets
the IP address from the DHCP server, you can enable DHCP snooping.

510943 The time-domain reflectometer (TDR) function (cable diagnostics feature) reports
unexpected values.

Workaround: When using the cable diagnostics feature on a port (with the diagnose
switch physical-ports cable-diag <physical port name> CLI command),
ensure that the physical link on its neighbor port is down. You can disable the neighbor ports
or physically remove the cables.

542031 For the 5xx switches, the diagnose switch physical-ports led-flash command
flashes only the SFP port LEDs, instead of all the port LEDs.

548783 Some models support setting the mirror destination to “internal.” This is intended only for
debugging purposes and might prevent critical protocols from operating on ports being used
as mirror sources.

572052 Backup files from FortiSwitchOS 3.x that have 16-character-long passwords fail when
restored on FortiSwitchOS 6.x. In FortiSwitchOS 6.x, file backups fail with passwords longer
than 15 characters.

Workaround: Use passwords with a maximum of 15 characters for FortiSwitchOS 3.x and
6.x.

585550 When packet sampling is enabled on an interface, packets that should be dropped by uRPF
will be forwarded.

FortiSwitchOS 7.4.0 Release Notes 16

Fortinet Inc.
Known issues

Bug ID Description

606044/610149 The results are inaccurate when running cable diagnostics on the FS-108E, FS-124E, FS-
108E-POE, FS-108E-FPOE, FS-124E-POE, FS-124E-FPOE, FS-148E, and FS-148E-POE
models.

609375 The FortiSwitchOS supports four priority levels (critical, high, medium, and low); however,
The SNMP Power Ethernet MIB only supports three levels. To support the MIB, a power
priority of medium is returned as low for the PoE MIB.

659487 The FS-108E, FS-108E-POE, FS-108E-FPOE, FS-108F, FS-108F-POE, FS-108F-FPOE,

FS-124E, FS-124E-POE, FS-124E-FPOE, FS-124F, FS-124F-POE, and FS-124F-FPOE,
FS-148E, and FS-148E-POE models support ACL packet counters but not byte counters.
The get switch acl counters commands always show the number of bytes as 0.

667079 For the FSR-112D-POE model:

l If you have enabled IGMP snooping or MLD snooping, the FortiSwitch unit does not

support IPv6 features and cannot pass IPv6 protocol packets transparently.
l If you want to use IGMP snooping or MLD snooping with IPv6 features, you need to
enable set flood-unknown-multicast under the config switch global
command.

748210 The MAC authentication bypass (MAB) sometimes does not work on the FS-424E when a
third-party hub is disconnected and then reconnected.

784585 When a dynamic LACP trunk has formed between switches in an MRP ring, the MRP ring
cannot be closed. Deleting the dynamic LACP trunk does not fix this issue. MRP supports
only physical ports and static trunks; MRP does not support dynamic LACP trunks.
Workaround: Disable MRP and then re-enable MRP.

793145 VXLAN does not work with the following:

l log-mac-event

l DHCP snooping
l LLDP-assigned VLANs
l NAC
l Block intra-VLAN traffic

828603 The oids.html file is not accurate.

829807 eBGP does not advertise routes to its peer by default unless the set ebgp-requires-
policy disable command is explicitly configured or inbound/outbound policies are
configured.

867108 Depending on your browser type/version, web UI access might fail when using TLS 1.3 and
client certificate authentication.
Workaround: Use TLS 1.2.

903001 Do not use mgmt as the name of a switch virtual interface (SVI). mgmt is reserved for the
physical management switch port.

916405 FortiSwitchOS should not allow MACsec and 802.1X authentication to be configured on the
same port.

FortiSwitchOS 7.4.0 Release Notes 17

Fortinet Inc.
Known issues

Bug ID Description

919990 The GUI displays a warning message of “Unverified Image Detected” when the user logs in
to FortiSwitchOS 7.4.0 build 0767, even though the image is verified.

FortiSwitchOS 7.4.0 Release Notes 18

Fortinet Inc.
 www.fortinet.com

Copyright© 2023 Fortinet, Inc. All rights reserved. Fortinet®, FortiGate®, FortiCare® and FortiGuard®, and certain other marks are registered trademarks of Fortinet, Inc., and other Fortinet names herein
may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were
attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance
results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract,
signed by Fortinet’s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only
the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal
conditions as in Fortinet’s internal lab tests. Fortinet disclaims in full any covenants, representations, and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change,
modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.