config system npu
    set prp-port-in <port>
    set prp-port-out <port>
end

config system npu
    set lag-out-port-select {enable | disable}
end

Add algorithm in NPU driver for distribution, AGG_ALGORITHM_NPU.

VDOM level:

config switch-controller global
    set dhcp-server-access-list {enable | disable}
end

FortiSwitch level:

config switch-controller managed-switch 
    edit <switch>
        set dhcp-server-access-list {global | enable | disable}
    next
end

Interface:

config system interface 
    edit <interface>
        config dhcp-snooping-server-list
            edit <list>
                set server-ip <class_ip>
            next
        end
    next
end

/api/v2/monitor/switch-controller/managed-switch/models

# diagnose switch-controller switch-info port-properties S548DF**********
Switch: S548DF**********
Port: port1
PoE           : 802.3af/at,30.0W
Connector     : RJ45
Speed         : 10Mhalf/10Mfull/100Mhalf/100Mfull/1Gauto/auto

config system snmp sysinfo
    set engine-id-type {text | hex | mac}
    set engine-id <string, maximum 27 characters>
end

config router bgp
    config neighbor
        edit <name>
            config conditional-advertise6
                edit <name>
                    set condition-routemap <string>
                    set condition-type {exist | non-exist}
                next
            end
        next
    end
end

• Allow upload speed tests to be run from the hub to spokes for dial-up IPsec tunnels.
• Allow an SD-WAN member on a spoke to switch routes when speed test is being run from the hub to spokes.
• Allow speed test result to be applied dynamically on dial-up IPsec tunnel interface for egress traffic shaping.
• Allow traffic shaping profile to be applied on dial-up IPsec tunnel interface on the hub.
• Add the ability to apply class ID and percentage based QoS settings to individual child tunnels using a traffic shaping policy and profile.

• Add ZTNA log subtype to UTM logs.
• Six scenarios will generate allow and deny logs in the new ZTNA category.
• Add traffic log ID for ZTNA related traffic.

1. Network > SD-WAN > Performance SLA tab: probe mode options are Active, Passive, or Prefer Passive. The disabled option can only be configured in the CLI.
2. In a Firewall Policy where the destination is a SD-WAN zone, the passive health check option is available. By enabling Passive Health Check in a policy, the TCP traffic for that policy will be used in health check measurements.

config router key-chain
    edit <name>
        config key
            edit <id>
                set algorithm {md5 | hmac-sha1 | hmac-sha256 | hmac-sha384 | hmac-sha512}
            next
        end
    next
end

• LDAP Server Identity Check: ensures certificate validation takes place against LDAP server.

• Disable Username Case-Sensitivity Check: ensures users cannot bypass two-factor authentication by using a different case than configured in the user object.

1. Use the SD-WAN zone in IPv4 and IPv6 static routes.
2. Use the SD-WAN zone in SD-WAN service rules.
3. Add a pre-defined SD-WAN zone called SASE.

config vpn ssl settings
    set saml-redirect-port <port>
end

config system fips-cc
    set status fips-ciphers
end

To enable this feature, all VPNs must be removed.

config wireless-controller wtp-profile
    edit <profile>
        set console-login {enable | disable}
    next
end

All managed APs using this profile will be rebooted and changes will be applied.

config user fsso
    edit <name>
        set logon-timeout <integer>
    next
end

The logon-timeout is measured in minutes (1 – 2880, default = 5).

Workaround: manually re-run the security rating report from the Security Fabric > Security Rating page.

Workaround: do not use the HA interface as a heartbeat interface.