FortiGate 40F/60F IPsec Traffic Stops on FortiOS 7.6.4

For a FortiGate 4xF/6xF running FortiOS 7.6.4, an up tunnel that intermittently stops carrying traffic can match known issue 1206506. Confirm the model/build and collect evidence during the failure before attributing it to that issue. The symptom also has ordinary routing, policy and peer-side causes.

Applies to: The official KB specifically covers FortiGate 4xF/6xF with FortiOS 7.6.4. Resolution entries were checked in FortiOS 7.4.10 and 7.6.5 release notes. This does not establish every affected earlier release or every model, and it is not a recommendation to downgrade from another branch.

Validation: documentation-checked on 12 September 2026. No device or lab test is claimed. Version references identify the documentation checked, not a firmware upgrade recommendation.

Check whether the reported conditions fit

The official issue KB describes both forwarded user traffic and local-out traffic, such as BGP or SD-WAN probes, failing across the tunnel. It associates the failure with IPsec hardware acceleration. A brief recovery after rekey can support investigation, but repeatedly flushing a tunnel is not a diagnosis or a maintenance strategy.

Evidence to retain privately	Why it matters
Exact model and FortiOS build	Limits comparison to the documented scope
Time of failure and application flow	Allows both peers’ observations to be correlated
IKE/Child SA state and selected tunnel counters	Separates negotiation state from data forwarding
Routes, policy and peer response during failure	Rules out a missing network or remote application failure
Whether local-out and client traffic both fail	Compares the observed pattern with the KB

The KB’s deeper NP6XLite collection uses privileged, model-specific commands and can expose sensitive material. Use its original collection instructions with authorized support when needed; do not apply them indiscriminately to another NPU or post the outputs publicly.

Distinguish fixed-release evidence from an upgrade plan

Bug 1206506 is listed as resolved in both FortiOS 7.4.10 and FortiOS 7.6.5. Those entries support a specific fix claim; they do not select the best current maintenance release for every device. Check the supported upgrade path, the target’s current known issues and all relevant behavior changes before scheduling an upgrade.

For a move to 7.6.5, also review the DH-default change discussed in the proposal guide below. Resolving a data-path issue does not remove the need to verify peer compatibility after a firmware change.

Use the documented workaround only when its tradeoff is acceptable

If the issue is confirmed or strongly matched and an approved upgrade cannot be completed immediately, the KB documents disabling NPU offload on the affected existing tunnel. This flushes that tunnel and briefly interrupts its traffic. Retain independent management, record the old setting, evaluate CPU capacity and coordinate the window before applying:

Configuration change • scoped workaround with tunnel interruption

config vpn ipsec phase1-interface
    edit "<affected-existing-tunnel>"
        set npu-offload disable
    next
end

Do not apply this to every tunnel or use it as a first test for an unrelated model. The workaround changes packet processing and may reduce throughput. A temporary improvement does not by itself prove the bug ID.

Verify workload and restore acceleration deliberately

Verify the original application and any affected local-out probes under the relevant load, watching CPU and tunnel stability over the failure interval. Test unrelated tunnels as well. If the workaround is unsuitable, restore the exact recorded npu-offload setting during a coordinated window and be prepared for another tunnel interruption.

After a verified supported fix is deployed, review restoring the original offload configuration and repeat the same application/load checks. Stop any temporary debug and retain a private, redacted timeline. Do not reset all tunnels or leave recurring automated flushes behind.

Rule out selector and route problems · FortiOS 7.6.5 DH-default migration checks

Technical references

Found an issue? Send a correction with a reproducible example.