The management of the DSL transceiver includes the ability to program the physical layer attributes on the DSL module, retrieve the status and statistics from the module, support firmware upgrade of the module, and reset the module. The following VDSL profiles are supported: 8a, 8b, 8c, 8d, 12a, 12b, 17a, 3and 0a.

Supported platforms: FG-80F, FG-81F, FG-80F-BP, FGR-60F, and FGR-60F_3G4G.

The FortiNAC tags connector under Security Fabric > Fabric Connectors is deprecated. For upgrade support, the FSSO FortiNAC user type can still be configured from the CLI.

A new View Vulnerability link in the header is visible for global administrators, and a new tooltip for the critical vulnerability label on the System > Fabric Management page both link to the Security Rating page and highlight the critical vulnerability. On the Security Rating page, the search bar supports using the PSIRT keyword to filter for PSIRT vulnerabilities, and the security panel provides a link to the System > Fabric Management page when a PSIRT vulnerability is selected.

config system global
    set internet-service-database {mini | standard | full}
end

config firewall access-proxy
    edit <name>
        set add-vhost/domain-to-dnsdb {enable | disable}
    next
end

config vpn certificate setting
    set cert-expire-warning <integer>
end

Where <integer> is the certificate log expiring warning threshold, in days (0 – 100, default = 14).

The local certificate expiry trigger can be used with an email notification action, for example, to remind an administrator to re-sign or load a new local certificate to avoid any service interruptions.

In the GUI of a FortiGate not in a Security Fabric or on the root FortiGate of a Security Fabric, IPAM pools can be defined under Network > IPAM > IPAM Settings, and IPAM rules can be defined under Network > IPAM > IPAM Rules.

In the CLI of a FortiGate not in a Security Fabric or on the root FortiGate of a Security Fabric, IPAM pools can be defined as follows where a.b.c.d/x is the IP/netmask of the subnet:

config system ipam
    config pools
        edit <name>
            set subnet <a.b.c.d/x>
        next
    end
end

In the CLI of a FortiGate not in a Security Fabric or on the root FortiGate of a Security Fabric, IPAM rules can be defined as follows (device and interface fields accept * wildcard inputs):

config system ipam
    config rules
        edit <rule_name>
            set device {<FortiGate_serial_number> | *}
            set interface {<name> | *}
            set pool <pool_name>
        next
    end
end

• BGP AS
• BGP neighbour/neighbour group local AS
• BGP neighbour/neighbour group remote AS
• Route map set AS path

get router info bgp summary and other BGP router commands still display the AS numbers in asplain format.

config system central-management
    config server-list
        edit 1
            set server-type {iot-query iot-collect}
        next
    end
end

config firewall policy
    edit <id>
        set diffserv-copy {enable | disable}
    next
end

1. When the session synchronization filter is applied on FGSP, the filter will only affect sessions synchronized between the FGSP peers.
2. When virtual clustering is used, sessions synchronized between each virtual cluster can also be synchronized to FGSP peers. The peers’ syncvd must all be in the same HA vcluster.

1. Embed spokes’ SLA information (latency, jitter, packet loss) into the ICMP probes that the spokes send to the hub. In turn, the hub will read the embedded ICMP probes to gather SLA information on each overlay from each spoke.
2. Allow SD-WAN to change the IKE route’s priority according to SLA status (within SLA or out of SLA) on IPsec overlays.
3. Allow a recursively resolved BGP route to inherit the priority from its parent.

By passing SLA information to the hub, the hub can route traffic to the spoke symmetrically based on the overlay that is in SLA on the spoke.

config system accprofile
    edit <name>
        set system-execute-ssh {enable | disable}
        set system-execute-telnet {enable | disable}
    next
end

config vpn ipsec phase1-interface
    edit <name>
        set link-cost <0 - 255>
    next
end

config system automation-action
    edit <name>
        set action-type system-actions
        set system-action {reboot | shutdown | backup-config}
    next
end

config system automation-trigger
    edit <name>
        set trigger-type scheduled
        set trigger-frequency once
        set trigger-datetime <YYYY-MM-DD HH:MM:SS>
    next
end

config wireless-controller vap
    edit <name>
        set ssid <ssid>
        set security wpa3-sae
        set sae-h2e-only {enable | disable}
    next
end

config wireless-controller vap
    edit <name>
        set ssid <ssid>
        set security wpa3-sae
        set sae-pk {enable | disable}
        set sae-private-key <private_key>
    next
end

Previously, ZTNA SaaS access control was possible using the TCP forwarding access proxy configuration on FortiGate and FortiClient:

• On the FortiGate, users would need to search all hostnames used by a SaaS application, configure these hostnames as FQDN addresses, and configure these addresses as part of the ZTNA TCP forwarding settings.
• In FortiClient, users would need to manually add all the hostnames as destinations for ZTNA connection rules or use FortiClient EMS to push those rules to FortiClient.

With this enhancement and service, users can configure the ZTNA access proxy with a new SaaS proxy access type and conveniently specify SaaS application destinations by application name or by application group name without needing to manually search for and enter FQDNs specific to each SaaS application. Currently, CLI commands must be used for the configuration. Users can configure the SaaS application destination by adding support for SaaS in config firewall proxy-address, which can be used in config firewall proxy-policy. The FortiGate traffic log has been enhanced with a new log field, saasname.

Support for this feature will be available in a future version of FortiClient and FortiClient EMS

When a SAML user has been configured on the FortiGate, a user group containing this SAML user can be applied to a captive portal in a wireless tunnel mode SSID. When configured with both a captive portal exempt firewall policy to allow wireless clients to contact the SAML IdP and a firewall policy with the SAML user group applied to allow authenticated traffic, upon connecting to this SSID, wireless clients will be redirected to a login page for wireless authentication using SAML.

config user ldap
    edit <name>
        set dn <string> 
        set two-factor {disable | fortitoken-cloud}
        set two-factor-filter <string> 
    next
end

• Update config endpoint-control fctems to predefine five FortiClient EMS Fabric connectors that are referred to using numerical IDs from 1 to 5. Administrators can configure the status and name settings, and to display the tenant ID retrieved from FortiClient EMS sites with Manage Multiple Customer Sites enabled.A single tenant EMS server or the default site on a multitenant EMS server has a tenant ID consisting of all zeros (00000000000000000000000000000000).
• Update the FortiClient EMS Fabric connector to retrieve specific ZTNA tags from each configured FortiClient EMS site.
• Update diagnose endpoint record list to return the EMS tenant id field retrieved from each respective FortiClient EMS server.
• Update ZTNA and EMS debug commands to accept the EMS serial number and tenant ID as parameters.

  # diagnose endpoint lls-comm send ztna find-uid <uid> <EMS_serial_number> <EMS_tenant_id>

  # diagnose wad dev query-by uid <uid> <EMS_serial_number> <EMS_tenant_id>

config system fortiguard
    set auto-firmware-upgrade {enable | disable}
    set auto-firmware-upgrade-day {sunday monday tuesday wednesday thursday friday saturday}
    set auto-firmware-upgrade-start-hour <integer>
    set auto-firmware-upgrade-end-hour <integer>
end

Upon the failure of the FGSP member that is the primary gateway for a tunnel, the upstream router will fail over the tunnel traffic to another FGSP member. The other FGSP member will move from standby to the primary gateway for that tunnel and continue to forward traffic.

config vpn ipsec phase1-interface
    edit <name>
        set fgsp-sync {enable | disable}
    next
end

config vpn ssl setting
    set ztna-trusted-client {enable | disable}
end

# diagnose sys ha checksum show-nonsync [global | vdom_name]

config switch-controller switch-profile
    edit <name>
        set revision-backup-on-logout {enable | disable}
        set revision-backup-on-upgrade {enable | disable}
    next
end

 config system ha
    set vcluster-status enable
    config vcluster
        edit <id>
            ...
        next
    end
end

config firewall global
    set banned-ip-persistency {disabled | permanent-only | all}
end

The diagnose user quarantine <parameter> command has changed to diagnose user banned-ip <parameter>.

Old syntax:

config system cluster-sync
    edit <id>
        set peervd <VDOM>
        set peerip <address>
        set syncvd <VDOM>
        config session-sync-filter
            ...
        end
    next
end

New syntax:

config system standalone-cluster
    config cluster-peer
        edit <id>
            set peervd <VDOM>
            set peerip <address>
            set syncvd <VDOM>
            config session-sync-filter
                ...
            end
        next
    end
end

config system netflow
    set collector-ip <IPv4/IPv6_adddress>
    set source-ip <IPv4/IPv6_adddress>
end

config firewall ippool
    edit <name>
        set pba-timeout <integer>
    next
end

For CGNAT cases, extending the PBA timeout allows PBA logs to be generated less frequently on the FortiGate.

config system automation-action
    edit <name>
        set action-type {webhook | aws-lambda | azure-function | google-cloud-function | alicloud-function}
        config http-headers
            edit 1
                set key <string>
                set value <string>
            next
            edit 2
                set key <string>
                set value <string>
            next
        end
    next
end

• Logs sourced from FortiAnalyzer and FortiCloud have the same time frame selection options as FortiView.
• Logs sourced from disk have options to select 5 minutes, 1 hour, 24 hours, 7 days, or None.

• Add navigation entries under the WiFi & Switch Controller menu:
  • Operation Profiles: includes tabs to configure FortiAP, QoS, and FortiAP configuration profiles
  • Connectivity Profiles: includes tabs to configure MPSK and bonjour profiles
  • Protection Profiles: includes tabs to configure WIDS and L3 firewall (also known as L3 access control list configurations for FortiAPs) profiles
• Additional advanced options for wireless features under the SSIDs and WiFi Settings entries.

• Add two charts for displaying Status and Mode.
• Update Status column with Online, Offline, and Waiting For Authorization states.
• Add default Details column populated with the data used by the modem/SIM card when FortiExtender is in WAN extension mode, or the connected IPsec tunnel used with the FortiGate when FortiExtender is in LAN extension mode.
• When FortiExtender is in WAN extension mode, display modem information by left-clicking or hovering the mouse over the FortiExtender name to show a tooltip then clicking Diagnostics and Tools.
• Make the Serial # column optional (previously this was a default column).

Enhance the Profile tab on the Network > FortiExtenders page with two charts for displaying Status and Mode.

• Rename the Details tab to Logs tab.
• Update the filters used in the log viewer to adjust the log filters and the Log Details pane.
• Update the time frame settings for each Log & Report page so they are independent of each other.

This page is only viewable on a FortiGate that is not in a Security Fabric, or on the root FortiGate in a Security Fabric. In a Security Fabric, downstream FortiGates will receive a notification to view the root FortiGate.

This new page replaces the IPAM dashboard widget and IPAM connector card within Security Fabric > Fabric Connectors, which have been removed.

When viewing the IPAM interfaces tab, IP conflict markers are displayed to notify an administrator of IPAM pool IP conflicts with manually configured IPs and prompts administrators to use the Edit Interface dialog to manually resolve the conflict by changing the interfaces’ IP/netmask settings.

Limitations of the evaluation VM license include:

• There is only support for low encryption operation, except for GUI management access and FortiManager communications.
• There is a maximum of one CPU and 2 GB of memory.
• There is a maximum of three interfaces, firewall policies, and routes.
• There is no FortiCare support.

The evaluation VM license is applicable to all private cloud (VMware ESXi, KVM, and so on) and all BYOL public cloud instances.

Workaround: rename the custom section to unique name between IPv4 and IPv6 policies.

Workaround: use the CLI to configure policies.