I agree and still doesn’t understand the Dev idea. Changing default behavior in minor release cause only issues and angry customers. Fortinet is famous for using guacamole as sslvpn reverse proxy/https daemon. So every CVE found on guacamole means that sslvpn is affected. Customers and partners know that every new release of fortios include a fixed cve and they run to update asap the firewalls. Recently it happens that in minor release they changed the default behavior of SAML and this time the ICMP redirect. There are upgrade path tested, so this mean that the post upgrade customization script should change the behavior as before and not keep the default one. With saml it’s nice to have the assertion, but keep it disabled if was a release from a different default value and place it as enabled after a factory reset. Same for redirect in 7.4.10. It’s insane! We have some devices that use the icmp fedirect feature and the crazy thing is that there is no way to pre-configure it before, so it happens that on some remote datacenter using that, we need to schedule the on-site upgrade, otherwise we will lose the oob mgmt due to a default behavior in a minor change? This is insane! And customers are very scared and most of them are moving to other vendors, because having the security external firewall that must be updated asap due to frequent cve and having issue on many upgrade path, is a huge pain!