Ferritaas Incident Intelligence
Defect Intelligence Report Bug 0921405 Severity: Critical (P1)

FortiOS 7.4 Proxy-Mode Deprecation & Silent Policy Drop on 40F / 60F

Upgrading 2GB RAM desktop appliances (FG-40F, FG-60F, FG-61F) to FortiOS 7.4.0–7.4.4 causes the kernel policy compiler to silently reject firewall policies configured with proxy inspection mode, discarding corporate transit traffic into the implicit deny blackhole without generating alerts.

🚀 Open Full Runbook & Live Automation on Ferrite → Browse Known Issues Directory
⏱️ Est. Triage: 8–10 mins | Automated CLI Available

Technical Root Cause Analysis

To prevent pervasive conserve mode crashes caused by the memory-intensive Web Application Daemon (/bin/wad), Fortinet officially deprecated proxy inspection mode on 2GB RAM entry-level hardware starting in FortiOS 7.4.

However, in builds 7.4.0 through 7.4.4, the upgrade migration parser fails to automatically transform existing set inspection-mode proxy directives into flow mode. When the kernel configuration daemon (fcnfg) parses the policy table upon boot, fcnfg_policy_parse_inspection_mode() detects ram_size < 2048MB and aborts compilation for that policy with -EINVAL. Because the policy is never programmed into the kernel iprope rule tree, matching client packets fall through to the implicit deny rule (policy ID 0) and are dropped.

[fcnfg] parsing policy id 18: name 'Corporate-Internet-Access' [fcnfg] ERROR: fcnfg_policy_parse_inspection_mode: platform RAM (1984 MB) < 2048 MB requirement. [fcnfg] Proxy inspection-mode is deprecated and unsupported on this model. [fcnfg] WARNING: Policy id 18 rejected by kernel compiler! (err=-22: EINVAL) [iprope] failed to install policy 18 into forwarding kernel table. [kernel] iprope_lookup_policy: packet dropped by default implicit rule 0 (no installed match)

Affected Firmware & Blast Radius Matrix

Hardware Family Vulnerable Builds Confirmed Clean Build Status & Workaround
FortiGate 40F / 60F / 61F (2GB) 7.4.0 – 7.4.4 7.4.5 GA+ Convert policies to flow mode prior to upgrade
FortiGate 70F / 80F / 90G (4GB+) Not Affected 7.4.x Clean Proxy mode remains supported on ≥4GB RAM
FortiOS 7.2.x Branch Not Affected 7.2.x Clean Proxy mode supported on 2GB models in 7.2

Platform Impact: All FortiGate desktop appliances featuring 2GB of physical memory (FG-40F, FG-60F, FG-61F) undergoing upgrade to early FortiOS 7.4.x releases while maintaining proxy-mode security rules.

Step 01: Free Verification CLI (Safe Read-Only)

Execute these commands to confirm whether your FortiGate 40F/60F has uncompiled proxy-mode policies causing silent packet drops:

Diagnostic Commands

# 1. Check system configuration compilation checksum consistency
diagnose sys checkum fgt

# 2. Enumerate policies explicitly configured with proxy inspection mode
show firewall policy | grep "inspection-mode proxy"

# 3. Check for kernel iprope policy installation error counters
diagnose firewall iprope error

# 4. Verify whether policy IDs are active inside the kernel forwarding table
diagnose firewall iprope list 100004

Remediation & Workaround Steps (Teaser Preview)

Follow the complete step-by-step remediation guide in the Ferrite interactive platform:

Step 02: Audit Security Profiles Linked to Proxy Policies

Identify which policies require conversion from proxy-based UTM profiles to flow-based AV, web filtering, and SSL inspection profiles.

🔒 Interactive CLI Available in Ferrite Runbook #01

Step 03: Automated Policy Conversion to Flow Inspection Mode

Execute batch CLI transformation script to toggle inspection-mode from proxy to flow across all affected policy IDs.

🔒 Interactive CLI Available in Ferrite Runbook #01

Step 04: Trigger Kernel Policy Table Recompilation

Re-evaluate and compile all firewall policies into the hardware forwarding plane without dropping established sessions.

🔒 Interactive CLI Available in Ferrite Runbook #01
⚡ Ferrite Platform Superpowers

Execute the Complete Runbook with Live Browser Automation

Connect your FortiGate via browser console (Web Serial) or local SSH bridge, verify each command in real-time, generate ready-to-run Tera Term scripts, and export sanitized TAC dossiers.

⚡
Live Browser Automation Direct terminal connection with live step checkoff.
📟
1-Click Tera Term (.ttl) Generate scripts for air-gapped jumpboxes.
🛡️
Zero-Trust Scrubber Scrub serials and credentials in local browser RAM.
📄
TAC P1 Escalation Dossier Standardized evidence export with SHA-256 seal.

Frequently Asked Questions

Why are firewall policies silently dropped on FortiGate 40F and 60F in FortiOS 7.4?

Starting in FortiOS 7.4, proxy-mode inspection was deprecated on appliances with 2GB of physical RAM due to memory exhaustion risks. During firmware boot, the configuration compiler fcnfg encounters 'inspection-mode proxy' on 2GB platforms and skips installing the rule into the kernel iprope table without raising an administrative alarm, causing traffic to hit the implicit deny rule.

Does this issue happen if I upgrade from FortiOS 7.2?

Yes. If your FortiOS 7.2 configuration contained policies explicitly configured with 'set inspection-mode proxy', the upgrade migration script in 7.4.0–7.4.4 does not automatically convert them to flow mode on 2GB models, resulting in an immediate traffic outage upon upgrade completion.

Which FortiOS version addresses this migration trap?

FortiOS 7.4.5 GA introduces an automated preflight upgrade validator and configuration parser that automatically converts lingering proxy policies to flow mode during upgrade, preventing traffic blackholes.