config wireless-controller wtp-profile
    edit [ FAPU421EV-default | FAPU422EV-default | FAPU423EV-default ]
        config radio-2
            set band 802.11ac
            set channel-bonding 160MHz
        end
    next
end

config wireless-controller wids-profile
    edit <WIDS-profile-name>
        set ap-scan enable
        set ap-scan-threshold "-80"
    next
end

The range of ap-scan-threshold, in dBm, is -95 to -20 (default = -90).

CLI changes:

• Add proxy-after-tcp-handshake option in protocol option and SSL-SSH profile.

• Tri-radio support
• Radio mode 11ax support
• Dual 5G and single 5G mode support
• HE (high efficiency)/160 MHz bandwidth/TWT support

• Added CMDB attribute fortinet-one-cloud-authentication to FortiClient EMS table.
• Added curl verbose diagnosis debugs to FortiClient NAC daemon for debug images.
• Added fortiems-cloud option to type attribute in user.fsso table.

Added CLI command to push ip-source-guard static entries to FortiSwitch.

• This feature enables source guard entries to be set for physical switches as well as trunk ports.
• The source guard IP needs to be unique for every source guard entry across all ports.
• The binding entry is a second level table (switch_id being the base) with port_name as the parent key. Deleted events work at a switch level, but the with second level tables, there is a need to store grandparent context as well. An opaque data field has been created in the queue node and the corresponding flcfg_add_event_queue and flcfg_delete_sw_event_queue have been modified accordingly.
• Any calls to the flcfg_add_event_queue have been modified.
• There are two kinds of events that will be generated with this command: FLCFG_MSW_CMF_SOURCE_GUARD_UPDATE for port level info change and FLCFG_MSW_CMF_SOURCE_GUARD_ENTRY_UPDATE for binding entry level info change.

CLI changes:

• Add command to show FSSO dynamic address from authd daemon:

  diagnose debug authd fsso show-address

• Make diagnose firewall dynamic commands to accept one optional parameter as address name:

  diagnose firewall dynamic list

  diagnose firewall dynamic address

• Add FSSO subtype for firewall address:

  config firewall address
      edit <name>
          set sub-type fsso
      next
  end

GUI changes:

• Address dialog page
  • New subtype field to select between FSSO and Fabric Connector
  • New FSSO group field to select address group
• Address list page
• Tooltip for new FSSO dynamic address supports resolved address
• Detail column shows the address groups for the address

CLI changes:

• Add new CLI setting for SAML user:

  config user saml
      edit *
      set ?
          cert Certificate to sign SAML messages.
          *entity-id SP entity ID.
          *single-sign-on-url SP single sign-on URL.
          single-logout-url SP single logout URL.
          *idp-entity-id IDP entity ID.
          *idp-single-sign-on-url IDP single sign-on URL.
          idp-single-logout-url IDP single logout url.
          *idp-cert IDP Certificate name.
          user-name User name in assertion statement.
          group-name Group name in assertion statement.
      next
  end

• Added Hit Count and Last Used columns for Routing Monitor > Policy, Policy Route List, and SD-WAN Rules pages.

SD-WAN interfaces:

• SD-WAN in navigation bar renamed SD-WAN Interfaces.
• SD-WAN Interfaces list converted to a full page list with pie charts at the top.
• Added Sessions, Upload, Download (bandwidth), Bytes Sent, and Bytes Received columns to the table.
• The Edit dialog is no longer a slide in so it is consistent with other full page lists.

SD-WAN rules:

• Added a checkmark next to interface that is currently selected by SD-WAN.
• Checkmark has Member is selected tooltip. A reason (has best measured performances/meets most SLAs) is further stated for Best Performance (priority) and SLA (SLA/load-balance) strategies.
• If multiple members are selected at the same time, GUI only marks the highest ranked member, unless mode is load-balance.
• Added health check/SLA statistics tables for SD-WAN member omni select tooltip.
• In the Edit dialog, the Strategies field changed to cards to allow a brief description of each strategy.
• Added gutter to the Edit dialog. The gutter contains Last used and Hit count of the rule.
• The gutter also contains a table showing statistics of currently selected members for SLA.
• Added support for multiple members being selected in manual mode.

Performance SLA:

• Added support for IPv4 DNS protocol.
• Added support for using system DNS. GUI will display the system DNS server in this case.
• Support set members 0, which means all SD-WAN members participate in a health check.

In an Azure HA scenario, EIP and route tables failover are specified in the SDN connector configuration. A new attribute, resource-group, was added, which allows a user to specifying the resource group that an EIP or route table is from. This new attribute can be empty so upgrade code is not required.

If the resource-group of an EIP or route table is not provided, it is assumed the resource comes from the same resource group setting in the SDN connector (if there is no setting, it assumes the same resource group as the FortiGate itself by getting it from the instance metadata).

CLI changes:

• Add resource-group attribute.

CLI changes:

• Default FortiAnalyzer Cloud filters set to enable

  config log fortianalyzer-cloud filter

Most options within config log fortianalyzer-cloud filter defaulted to disable and could not be changed. Now, they default to enable and can be changed. License-based restrictions still apply, but the configuration can be used to refine the logs being sent to FortiAnalyzer Cloud.

The exception is the dlp-archive option, which is still set to disable and cannot be changed.

The extension improves the quality of GUI bug reports. The extension communicates with FortiOS and allows users to perform a capture. The capture includes (but is not limited to) the following:

• Screen recording
• Device metadata
• Client (browser) metadata
• HTTP network logs
• JavaScript console logs
• Various daemon logs
• Client memory and CPU usage
• Device memory and CPU usage

config firewall ssl-ssh-profile
    edit "custom-deep-inspection"
        set comment "Customizable deep inspection profile."
        config ssl
            set inspect-all disable
        end
        config https
            set ports 443
            set status deep-inspection
            set proxy-after-tcp-handshake disable
            set client-certificate bypass
            set unsupported-ssl-cipher allow       <==added
            set unsupported-ssl-negotiation allow  <==added
            set expired-server-cert block          <==added
            set revoked-server-cert block          <==added
            set untrusted-server-cert allow
            set cert-validation-timeout allow      <==added
            set cert-validation-failure block      <==added
            set sni-server-cert-check enable
        end
    next
end

config system interface
    edit wan1
        set mode dhcp
        ....
        config client-options
            edit 1
                set code 60
                set type {hex | string | ip | fqdn}
                set value|ip "xxxxxx"
            next
        end
    next
end

In the past, 802.1Q specification allowed a single VLAN header to be inserted into an Ethernet frame. This new feature allows one more VLAN tag to be inserted into a single frame.

This solution provides hole punching support for RFC 4787 compliant NATs that use endpoint independent mapping. For a given source IP/port, the NAT mapping observed by the hub does not change when communicating with other endpoints, such as spoke-to-spoke shortcuts.

With this enhancement, SD-WAN can monitor link quality of the shortcut VPN between spoke-to-spoke. The SD-WAN service rules among spokes can accurately rely on SLA performance to determine which link to use.

CLI changes:

• Add a configurable probe count as number of most recent probes to calculate latency and jitter.
• This new option is under config system virtual-wan-link > config health-check > edit a health-check.

Workaround: Create a new firewall policy from scratch and the default application control can be applied again.

Workaround: You can configure MMS profiles from the CLI using the config firewall mms-profile command.

emailfilter permission.

• Added default automation rules (after factory reset). All are disabled by default, except for the FEXP push notification.
• Added new incoming webhook trigger for automation.
• Removed Email Alert Settings page.
• Added new API for POST /api/v2/monitor/system/automation-stitch/webhook/<trigger mkey>.

Workaround: Users with 6.0.x should upgrade to remove the sync-error or disable vlan-optimization. On a network with switch-controller.global.vlan-all-mode all configured, the setting will revert to the default value of defined. Users who wish to maintain the vlan-all-mode all behavior may restore it after upgrading.

default.

Affected models include: FG-60E, FG-60E-POE, FG-61E, FG-80E, FG-80E-POE, FG-81E, FG-81E-POE, FG-100E, FG-100EF, FG-101E, FG-140E, FWF-60E, FWF-61E.

Workaround: Edit wtp-profile of FAP-U431F and FAP-U433F in the CLI.