config wireless-controller vap
    edit <name>
        set address-group <firewall_address_group>
        set address-group-policy {allow | deny}
    next
end

Previous wireless-controller address and wireless-controller addrgrp commands have been removed.

# execute ssh6-options {interface <outgoing_interface> | reset | source6 <source_IPv6_interface> | view-settings}

Add support for dynamic address filters based on project name and zones:

config system sdn-connector
    edit <name>
        set type gcp
        config gcp-project-list
            edit <name>
                set gcp-zone-list <name_1> <name_2> ... <name_n>
            next
        end
    next
end

GUI changes:

• Add buttons to switch between Simple and Advanced project configurations. The simple configuration displays a single text field to add one project to the GCP SDN connector.
• The advanced configuration displays a mutable table for users to add multiple projects to the GCP SDN connectors. Adding projects displays a slide-out pane to specify the project name and zones.
• A confirmation slide-out pane appears when switching from advanced to simple to warn about projects being deleted from the GCP SDN connector.
• A tooltip on the GCP SDN connector card shows the list of projects, and the filter list of GCP dynamic addresses shows the project and zones.

config system ha
    set uninterruptible-primary-wait <integer>
end

# execute restore manual-license {ftp | tftp} <license_file> <server> [args]

config system acme
    set source-ip <class_ip>
    set source-ip6 <IPv6_address>
end

config dpdk global
    set ipsec-offload {enable | disable}
end

config system settings
    set default-app-port-as-service {enable | disable}
end

New installations have this setting enabled by default. Upgrades will have this setting disabled to maintain previous post-application-match default port enforcement behavior.

config wireless-controller vap
    edit <name>
        set security captive-portal
        set auth-cert <HTTPS_server_certificate>
        set auth-portal-addr <portal_address>
    next
end

config system interface
    edit <name>
        set security-mode captive-portal
        set auth-cert <HTTPS_server_certificate>
        set auth-portal-addr <portal_address>
    next
end

• Add FortiView ZTNA Servers monitor, which includes options to drill down by Sources, Rules, Real Servers, and Sessions.
• Add context menu shortcuts on the ZTNA Rules and ZTNA Servers tabs to redirect to the FortiView and log view pages.
• Replace Log & Report > ZTNA page with Log & Report > ZTNA Traffic page. ZTNA logs now have a traffic type and ZTNA subtype.
• Add fields to ZTNA traffic logs.

config router ospf6
    set restart-mode {none | graceful-restart}
    set restart-period <1 - 3600>
    set restart-on-topology-change {enable | disable}
end

config router ospf
    set restart-on-topology-change {enable | disable}
end

config system fortisandbox
    set inline-scan {enable | disable}
end

In the antivirus profile, the ftgd-analytics option is renamed to fortisandbox-mode. There are new options to set FortiSandbox inline scan error and timeout actions.

config antivirus profile
    edit <name>
        set fortisandbox-mode {inline | analytics-suspicious | analytics-everything}
        set fortisandbox-error-action {ignore | log-only | block}  
        set fortisandbox-timeout-action {ignore | log-only | block}
        set fortisandbox-max-upload <integer>
        config {http | ftp | imap | pop3 | smtp | mapi | cifs | ssh}
            set av-scan {disable | block | monitor}
            set fortisandbox {disable | block | monitor}
        end	
    next
end

config endpoint fctems
    edit <name>
        set out-of-sync-threshold <integer>
    next
end

config vpn ipsec phase1-interface
    edit <phase1-interface_name>
        set mode-cfg-allow-client-selector {enable | disable}
    next
end

• IPS logs
• Anomaly logs
• Virus logs
• SSH logs
• Traffic violations
• Web filter violations

When multi-VDOM mode is enabled, individual VDOMs can be specified so that the trigger is only applied to the specified VDOMs.

config switch-controller managed-switch
    edit <id>
        set fsw-wan1-peer <interface>
        set fsw-wan1-admin enable
        set firmware-provision-latest {once | disable}
    next
end

config switch-controller global
    set firmware-provision-on-authorization {enable | disable}
end

If firmware-provision-on-authorization is set to enable, firmware-provision-latest will be set to once automatically when the FortiSwitch administrative status (fsw-wan1-admin) is enabled.

When the FortiSwitch connection status becomes authorized or up, a one-time upgrade to the latest compatible firmware version starts if firmware-provision-latest is set to once.

A FortiSwitch can connect to multiple VDOMs, and it will be upgraded through any VDOM that it is authorized in.

config wireless-controller timers
    set client-idle-rehome-timeout <integer>
end

config wireless-controller vap
    edit <name>
        set l3-roaming {enable | disable}
    next
end

config wireless-controller inter-controller
    set l3-roaming {enable | disable}
end

When the condition-type is exist:

• If the conditional route map matches, then advertised route map will apply.
• If the conditional route map does not match, then the advertised route map will not apply.

When the condition-type is non-exist:

• If the conditional route map matches, then the advertised route map will not apply.
• If the conditional route map not matches, then advertised route map will apply.

• Display NAC segment and LAN segment VLANs as parent and child on the Network > Interface page.
• Add a VLAN segment toggle to apply VLAN segmentation to a switch VLAN interface.
• Add a NAC Settings dialog to the NAC Policies page to enable NAC VLANs and modify the primary, onboarding, and segment VLANs.

config firewall vip
    edit "access-proxy"
        set type access-proxy
        set ssl-accept-ffdhe-groups {enable | disable}
    next
    edit "server-load-balance"
        set server-load-balance
        set ssl-accept-ffdhe-groups {enable | disable}
    next
end

config system link-monitor
    edit <name>
        set server-type {static | dynamic}
    next
end

# diagnose sys link-monitor tunnel {name | all} <tunnel_name>

• Supporting the CSF REST API via a FortiGate Cloud (FGC) tunnel from the root to downstream devices and vice-versa.
• Restricting create, edit, and delete permissions when accessing devices without a subscription from the FortiGate Cloud portal.
• Adding the ability to re-run notifications when switching via the CSF FortiGate chooser dropdown.
• Showing read-only access notifications when users switch to a downstream device without a paid subscription from the FortiGate Cloud portal.

config router bgp
    set tag-resolve-mode {disable | preferred | merge}
end

The preferred option uses a tag match if a BGP route resolution with another route containing the same tag is successful

The merge option merges the tag match with best match if they are using different routes. The results excludes the next hops of tag matches whose interfaces have appeared in best match.

config system automation-action
    edit <name>
        set output-size <integer>
        set timeout <integer>
    next
end

Add maximum concurrent stitch setting in config automation setting that limits how many stitches can run at same time.

config automation setting
    set max-concurrent-stitches <integer>
end

Extend api/v2/monitor/system/resource/usage to include new maximum, minimum, and average fields for each resource.

config system sdn-connector
    edit "aws1"
        config external-account-list
            edit "arn:aws:iam::6*******5494:role/CrossAccountSTS"
                set region-list "us-west-1" "us-west-2"
            next
            edit "arn:aws:iam::9*******1167:role/CrossAccountSTS"
                set region-list "us-west-1" "us-west-2"
            next
        end
    next
end

# execute vm-license <token> http://user:pass@proxyip:proxyport

config firewall security-policy
    edit <id>
        set url-category {g<group_value> <category_value>}
    next
end

config system sdwan
    config service
        edit <id>
            set internet-service enable
            set internet-service-app-ctrl-category <id_1> <id_2> ... <id_n> 
        next
    end
end

Enhance the Diagnostics and Tools slide-in pane by adding the fan and PSU status to the general health status, and a Clients tab to view clients for the specific FortiSwitch.

If there is a match, a DNS request is made and the destination of the request is the DNSed IP. If there is no match, a DNS request is made and the DNSed IP is matched with the configured real server’s IP.

config emailfilter block-allow-list
    edit 1
        set name "bal list"
        config entries
            edit 1
                set type email-to
                set pattern "test@fortinet.com"
            next
            edit 2
                set type subject
                set pattern "Spam!"
            next
        end
    next
end

The Email Regular Expression and Email Wildcard types have been replaced with Sender Address, Recipient Address, and Subject. Add Pattern Type selector with two values, Wildcard and Regular Expression for each type.

config dlp data-type
    edit <name>
        set pattern <regex_pattern>
        set verify <regex_pattern>
        set look-back <integer>
        set look-ahead <integer>
        set transform <string>
        set verify-transformed-pattern {enable | disable}
        set comment <string>
    next
end

config dlp dictionary
    edit <name>
        set match-type {match-all | match-any}
        set comment <string>
        config entries
            edit <id>
                set type {credit-card | hex | keyword | regex | ssn-us}
                set pattern <string>
                set ignore-case {enable | disable}
                set repeat {enable | disable}
                set status {enable | disable}
                set comment <string>
            next
        end
    next
end

config dlp sensor
    edit <name>
        set match-type {match-all | match-any | match-eval}
        set eval <string>
        set comment <string>
        config entries
            edit <id>
                set dictionary <dlp_dictionary>
                set count <integer>
                set status {enable | disable}
            next
        end
    next
end

config dlp profile
    edit <name>
        set feature-set proxy
        config rule
            edit <id>
                set proto <protocol> <protocol> ...
                set sensor <dlp_sensor>
                set action {allow | log-only | block | quarantine-ip}
            next
        end
    next
end

In config firewall policy and config firewall proxy-policy, the dlp-sensor option is renamed to dlp-profile.

config system global
    set ssl-min-proto-version {SSLv3 | TLSv1 | TLSv1-1 | TLSv1-2 | TLSv1-3}
    set ssl-static-key-ciphers {enable | disable}
    set strong-crypto {enable | disable}
end

Operating systems no longer supported by FortiClient were removed.

config user ldap
    set client-cert-auth {enable | disable}
    set client-cert <source>
end

The client certificate source comes from config vpn certificate local, and is filtered by client authentication key usage.

config ips sensor
    edit <name>
        config entries
            edit <id>
                set last-modified {before <date> | after <date> | between <start-date> <end-date>}
                set vuln-type <id_1> ... <id_n>
                set default-action {all | pass | drop}
                set default-status {all | enable | disable}
            next
        end
    next
end

Enhancements have been made to the FortiGate Support Tool Chrome extension, including: backend capture support, CSF support, more daemon logging, pre-process CPU and memory charts, crash log support, REST API profiling, organized node logging, and WebSocket messages.

For a current SD-WAN neighbor plus route-map-out-preferable design, only one member can be defined in the SD-WAN neighbor configuration for one BGP neighbor. If the member is in SLA, the preferable route map will be applied on the BGP neighbor; otherwise, the default route map will be applied.

In the case of one BGP neighbor over multiple SD-WAN members, the current SD-WAN neighbor plus route-map-out-preferable mechanism is enhanced to allow defining multiple members in the SD-WAN neighbor configuration for one BGP neighbor. The new minimum-sla-meet-members option can flexibly trigger a route map change based on a minimum threshold of in-SLA members.

config global
    config system fortiguard
        set vdom <vdom>
    end
end

config system global
    set gui-cdn-usage {enable | disable}
end

config system sdwan
    config duplication
        edit <id>
            set service-id <rule_id>
            set packet-duplication on-demand
            set sla-match-service {enable | disable}
        next
    end
end

config system interface
    edit <interface>
        set eap-supplicant {enable | disable}
        set eap-method {peap | tls}
        set eap-identity <identity>
        set eap-password <password>
        set eap-ca-cert <CA_cert>
        set eap-user-cert <user_cert>
    next
end

• Add field for HTTP method (httpmethod).
• Change URL rating method field (method) to ratemethod.
• Extend user agent field (agent) to save the whole User-Agent header.
• Remove referrer from rawdata field and insert it into the referralurl field.

config switch-controller switch-profile
    edit "default"
        set login {enable | disable}
    next
end

• In config router multicast, multicast-routing is enabled (and multicast routing is properly configured).
• In config firewall shaper traffic-shaper, per-policy is disabled (default setting). Per-policy enabled shapers are not supported.
• In config firewall multicast-policy, auto-asic-offload is disabled.

config firewall multicast-policy
    edit <id>
        set traffic-shaper <string>
    next
end

Running diagnose sys mcast-session list displays traffic shaper information for each path.

config firewall proxy-policy
   edit <id>
      set type access-proxy
      set poolname <ip_pool>
      set transparent {enable | disable}
   next
end

# execute backup yaml-config {ftp | tftp} <filename> <server> [username] [password]

# execute restore yaml-config {ftp | tftp} <filename> <server> [username] [password]