config system npu
    set lag-out-port-select {enable | disable}
end

Add a new algorithm in the NPU driver to the bond algorithm list (AGG_ALGORITHM_NPU).

config firewall ssl-ssh-profile
    edit <name>
        set supported-alpn {http1-1 | http2 | all | none}
    next
end

config system npu
    session-denied-offload {enable | disable}
end

config switch-controller managed-switch
    edit <serial number>
        config ports
            edit <name>
                set fec-state {disabled | cl74 | cl91}
            next
        end
    next
end

• Allow username and password field patterns to be fetched from FortiGuard.
• Add DNS support for domain controller IP fetching.
• Add support to specify a source IP or port for the fetching domain controller.
• Add LDAP server as a credential source.
• Block or log valid usernames regardless of password match.
• Add literal custom patterns type for username and password.

config log memory filter
    config free-style
        edit 1
           set category {event | virus | webfilter | attack | spam | anomaly | voip | dlp | app-ctrl | waf | gtp | dns | ssh | ssl | file-filter | icap}
           set filter <string>
           set filter-type include
        next
    end
end

The filter string can be a legal regular filter string. For example, ((srcip 172.16.1.1) or (dstip 172.16.1.2)) and (dstport 80 443 50-60).

• Prioritize established SAs.
• Offload groups 20 and 21 to CP9.
• Optimize the default embryonic limits for mid- and high-end platforms.

The IKE embryonic limit can now be configured in the CLI.

config system global
    set ike-embryonic-limit <integer>
end

config ips global
    config tls-active-probe
        set interface-selection-method {auto | sdwan | specify}
        set interface <interface>
        set vdom <VDOM>
        set source-ip <IPv4 address>
        set source-ip6 <IPv6 address>
    end
end

config monitoring npu-hpe
    set status {enable | disable}
    set interval <integer>
    set multiplers <m1>, <m2>, ... <m12>
end

The interval is set in seconds (1 – 60, default = 1). The multiplies are twelve integers ranging from 1 – 255, the default is 4, 4, 4, 4, 8, 8, 8, 8, 8, 8, 8, 8.

An event log is generated after every (interval × multiplier) seconds for any HPE type when drops occur for that HPE type. An attack log is generated after every (4 × multiplier) number of continuous event logs.

config system settings
    set ike-port <1024-65535>
    set ike-natt-port <1024-65535>
end

config nsxt setting
    set liveness {enable | disable}
    set service <service name>
end
config nsxt service-chain
    edit <ID>
        set name <chain name>
        config service-index
            edit <forward index>
                set reverse-index <value>
                set name <index name>
                set vd <VDOM>
            next
        end
    next
end

The default value for reverse-index is 1. The vd setting is required.

config application list
    edit <list>
        config entries
            edit 1
                set category <ID>
                set exclusion <signature ID> ... <signature ID>
            next
        end
    next
end

config system global
    set fortiipam-integration {enable | disable}
end

• If a FortiAnalyzer appliance is enabled, then the dialog will be for the FortiAnalyzer connector.
• If a FortiAnalyzer appliance is disabled but FortiAnalyzer Cloud is enabled, then the dialog will be for the Cloud Logging connector.
• If neither the FortiAnalyzer appliance or FortiAnalyzer Cloud are enabled:
  • If the device has a FAZC (standard FortiAnalyzer Cloud subscription) or AFAC (premium subscription) entitlement, then the dialog will be for the Cloud Logging connector.
  • If the device does not have a FAZC or AFAC entitlement, then the dialog will be for the FortiAnalyzer connector.
• When FortiAnalyzer Cloud is enabled and the FortiAnalyzer appliance is disabled, then the Cloud Logging connector will not let you switch to the FortiGate Cloud FortiAnalyzer.

• Simplify the conflict resolution procedure so a multi-step wizard is no longer required. All conflicts appear in one table for all FortiGates in the Fabric and supported tables.
• Add an object diff feature to display the difference between FortiGate objects that are in conflict.
• Add new CLI command for the root FortiGate:

  config system csf
      set fabric-object-unification {default | local}
  end

  When set to default, objects will be synchronized in the Security Fabric. On downstream FortiGates, if configuration-sync is set to local, the synchronized objects from the root to downstream FortiGates is not applied locally. However, the device will still send the configuration to lower FortiGates.

• The fabric-object {enable | disable} command was added to the following tables:
  • firewall.address
  • firewall.address6
  • firewall.addrgrp
  • firewall.addrgrp6
  • firewall.service.category
  • firewall.service.group
  • firewall.service.custom
  • firewall.schedule.group
  • firewall.schedule.onetime
  • firewall.schedule.recurring

  Enabling fabric-object on the root starts synchronizing this object as a Fabric object to downstream devices. Disabling fabric-object makes the object local to the device.

• Add setting to define how many task worker process are created to handle synchronizations (1 – 4, default = 2). The worker processes dies if there is no task to perform after 60 seconds.

  config system csf
      set fabric-workers <integer>
  end

# execute switch-controller switch-software cancel {all | sn | switch-group}

• It can be added to a dashboard to display bandwidth utilization for the top 50 applications.
• The favorites will be included even if they are not in the top 50.
• A firewall policy must have an application profile configured so the widget can capture information.
• A new CLI was added.

• [BCM57508] = { „Broadcom BCM57508 NetXtreme-E 10Gb/25Gb/50Gb/100Gb/200Gb Ethernet” }
• [BCM57504] = { „Broadcom BCM57504 NetXtreme-E 10Gb/25Gb/50Gb/100Gb/200Gb Ethernet” }
• [BCM57502] = { „Broadcom BCM57502 NetXtreme-E 10Gb/25Gb/50Gb Ethernet” }
• [BCM57508_NPAR] = { „Broadcom BCM57508 NetXtreme-E Ethernet Partition” }
• [BCM57504_NPAR] = { „Broadcom BCM57504 NetXtreme-E Ethernet Partition” }
• [BCM57502_NPAR] = { „Broadcom BCM57502 NetXtreme-E Ethernet Partition” }
• [BCM58812] = { „Broadcom BCM58812 NetXtreme-S 2x50G Ethernet” }
• [BCM58814] = { „Broadcom BCM58814 NetXtreme-S 2x100G Ethernet” }
• [BCM58818] = { „Broadcom BCM58818 NetXtreme-S 2x200G Ethernet” }
• [NETXTREME_E_P5_VF] = { „Broadcom BCM5750X NetXtreme-E Ethernet Virtual Function” }

diagnose user-device-store device memory list

diagnose user-device-store device memory query mac <value>

diagnose user-device-store device memory query ip <value>

diagnose user-device-store device disk list

diagnose user-device-store device disk query <SQL WHERE clause>

config router bgp
    set recursive-next-hop {enable | disable}
end

config system settings
    set location-id <IPv4 address>
end

config system automation-action
    edit <action name>
        set action-type microsoft-teams-notification
    next
end

config firewall ldb-monitor
    edit <name>
        set type dns
        set port <string>
        set dns-protocol {udp | tcp}
        set dns-request-domain <string>
        set dns-match-ip <class_ip>
    next
end

config system ddns
    edit <name>
        set ddns-server genericDDNS
        set server-type {ipv4 | ipv6}
        set ddns-server-addr <address>
        set addr-type ipv6 {ipv4 | ipv6}
        set monitor-interface <port>
    next
end

# diagnose debug traffic {interface | peek | history}

config vpn ocvpn
    ... 
    set sdwan enable
    set sdwan-zone {virtual-wan-link | <zone> | ...}
    ...
end

config system email-server
    set interface-select-method {auto | sdwan | specify}
    set interface <interface>
end

config log syslogd setting
    set format {default | csv | cef | RFC5424}
end

config antivirus profile
    edit <name>
        config http
            set av-scan {disable | block | monitor}
            set outbreak-prevention {disable | block | monitor}
            set external-blocklist {disable | block | monitor}
            set quarantine {enable | disable}
        end
        set outbreak-prevention-archive-scan {enable | disable}
        set external-blocklist-archive-scan {enable | disable}
        set external-blocklist-enable-all {enable | disable}
        set external-blocklist <source>
    next
end

Note that the external-blocklist <source> option is hidden if external-blocklist-enable-all is enabled.

config vpn ipsec phase1-interface
    edit <name> 
        set interface "loopback"
        set loopback-asymroute {enable | disable}
    next
end

config system link-monitor
    edit <id>
        set srcintf <interface>
        set server <server IP>
        set gateway-ip <gateway IP>
        set route <subnet 1> ... <subnet n>
    next
end

config system ha
    set unicast-status enable
    set unicast-gateway <address>
    config unicast-peers
        edit 1
            set peer-ip <address>
        next
    ...
    end
end

# diagnose sys sdwan sla-log <health check name> <sequence number> <child name>

• When selecting objects, the omni-select menu displays recently used items.
• Support nested object tooltips.

• Add EMS tag
• Update EMS tag
• Remove EMS tag

• Support 802.11k neighbor report dual band.
• Enhance 802.11v BSS transition management by adding bstm-disassociation-imminent option, disassociation timer for low RSSI, and disassociation timer for AP load-balancing.

config firewall ssl-ssh-profile
    edit "dot-deep"
        config dot
            set status deep-inspection
            set client-certificate bypass
            set unsupported-ssl-cipher allow
            set unsupported-ssl-negotiation allow
            set expired-server-cert block
            set revoked-server-cert block
            set untrusted-server-cert allow
            set cert-validation-timeout allow
            set cert-validation-failure block
        end
    next
end

config wireless-controller vap
    edit <name>
        set mac-username-delimiter {hyphen | single-hyphen | colon | none}
        set mac-password-delimiter {hyphen | single-hyphen | colon | none}
        set mac-calling-station-delimiter {hyphen | single-hyphen | colon | none}
        set mac-called-station-delimiter {hyphen | single-hyphen | colon | none}
        set mac-case MAC {uppercase | lowercase}
    next
end

config system sdwan
    config health-check
        edit <name>
            set detect-mode {active | passive | prefer-passive}
        next
    end
end

config firewall policy
    edit <id>
        set passive-wan-health-measurement {enable | disable}
    next
end

Affected pages/widgets: Compromised Hosts, FortiView Cloud Applications, FortiView VPN, FortiView Web Categories, Top Admin Logins, Top Endpoint Vulnerabilities, Top Failed Authentication, Top System Events, Top Threats, Top Threats – WAN, and Top Vulnerable Endpoint Devices.