• Clicking a link takes the user to the related questions and answer page on the FortiAnswers website.
• The number of answers, votes, and views is displayed for each question.
• Clicking the See more link takes the user to the related topic page on FortiAnswers.

The existing documentation related links have been renamed:

• The Documentation section header is renamed to Online Guides.
• The Online Help link is renamed to Relevant Documentation.

The Security Fabric > Security Rating > Security Posture report includes FortiGuard IoT Detection Subscription and FortiGuard IoT Vulnerability checks. The FortiGuard IoT Detection Subscription rating check will pass if the System > FortiGuard page shows that the IoT Detection Service is licensed. The FortiGuard IoT Vulnerability rating check will fail if any IoT vulnerabilities are found.

To detect IoT vulnerabilities, the FortiGate must have a valid IoT Detection Service license, device detection must be configured on a LAN interface used by IoT devices, and a firewall policy with an application control sensor must be configured.

Changes include:

• Improve the Security Fabric configuration settings to select the Security Fabric role.
• Merge relevant connectors into Core Network Security Connectors and Security Fabric Connectors sections.
  • The Core Network Security Connectors section includes the Security Fabric Setup, LAN Edge Devices, Logging & Analytics, and FortiClient EMS cards.
  • The Security Fabric Connectors section includes the Central Management, Sandbox, and Supported Connectors cards.

config vpn ssl client
    edit <name>
        set ipv4-subnets <subnets>
        set ipv6-subnets <subnets>
    next
end

config vpn ssl web portal
    edit <name>
        set client-src-range {enable | disable}
		set ip-mode {range | user-group | dhcp | no-ip}
    next
end

config system sdwan
    config health-check
        edit <name>
            set detect-mode agent-based
        next
    end
    config service
        edit <id>
            set agent-exclusive {enable | disable}
        next
    end
end

config wireless-controller global
    set acd-process-count <integer>
end

config system sdn-connector
    edit <name>
        set server-cert <remote_certificate>
        set server-ca-cert <remote_or_CA_certificate>
    next
end

config firewall local-in-policy 
    edit <id>
        set virtual-patch {enable | disable}
    next
end

# diagnose switch-controller telemetry show mac-stats switch <serial_number>

# execute factoryreset-for-central-management

config system interface
    edit <name>
        config ipv6
            set dhcp6-relay-source-interface {enable | disable}
        end
    next
end

• Proxy-based only profiles such as ICAP, Web Application Firewall, Video Filter, and Zero Trust Network Access are disabled (grayed out) on the System > Feature Visibility page.
• The Feature set field is disabled on UTM profiles. Only flow-based features are shown.
• Firewall policy pages do not have option to select a Flow-based or Proxy-based inspection mode.
• Proxy-based UTM profiles cannot be selected within policy configurations or other areas.

Note the following exceptions:

• If the proxy feature set is enabled from the CLI or carried over from upgrading, it can be displayed in the GUI.
• If proxy-based inspection mode is enabled from the CLI or carried over from upgrading, it can be displayed in GUI firewall policy pages.

Support ZTNA policy access control of unmanageable and unknown devices in the ZTNA application gateway by using the EMS_ALL_UNMANAGEABLE_CLIENTS and EMS_ALL_UNKNOWN_CLIENTS dynamic address local tags, respectively.

Enhance diagnostic commands:

• Use diagnose firewall dynamic address to view IP addresses of clients associated with EMS_ALL_UNMANAGEABLE_CLIENTS and EMS_ALL_UNKNOWN_CLIENTS dynamic addresses.
• Use diagnose user-device-store device memory list to view tags of devices identified through FortiGate device detection.

Enhance ZTNA traffic logs:

• The emsconnection (CLI) or EMS Connection (GUI) field is used for the client connection status with EMS server; possible values of unknown, offline, or online.
• The clientdevicemanageable (CLI) or Client Device Manageable (GUI) field is used for device manageability status.

In the GUI, tags can be specified in proxy policies (Policy & Objects > ZTNA > ZTNA Rules), and tags are visible on various pages (Policy & Objects > ZTNA > ZTNA Tags, Dashboard > FortiClient widget, and Security Fabric > Asset Identity Center).

The available options are: default, da (Danish), nl (Dutch), en-uk (English, United Kingdom), en-uk-ext (English, United Kingdom Extended), fi (Finnish), fr (French), fr-be (French, Belgium), fr-ca-mul (French, Canadian multilingual standard), de (German), de-ch (German, Switzerland), it (Italian), it-142 (Italian 142), pt (Portuguese), pt-br-abnt2 (Portuguese Brazilian ABNT2), no (Norwegian), gd (Scottish Gaelic), es (Spanish), sv (Swedish), and us-intl (United States international).

config extension-controller extender
    edit <name>
        set id <string>
        set authorized disable
    next
end

# diagnose nodejs logs {list | show <arg> | show-all | delete <arg>}

config firewall ippool
    edit <name>
        set nat64 enable
        set subnet-broadcast-in-ippool {enable | disable}
    next
end

• Re-introduce the concept of router detection based on detecting the device type changing.
• Do not perform a signature check when scanning HTTP traffic if the headers contain Via, Forwarded, X-Forwarded-For, X-Forwarded-Host, or X-Forwarded-Proto.
• Modify the rules for TTL-based router detection.

config vpn ssl web portal
    edit <name>
        set dhcp-ra-giaddr <gateway_IP_address>
        set dhcp6-ra-linkaddr <IPv6_link_address>
    next
end

config firewall proxy-address
    edit <name>
        set type {src-advanced | ua}
        set ua <browser>
        set ua-min-ver <string>
        set ua-max-ver <string>
    next
end

config router extcommunity-list
    edit <name>
        set type {standard | expanded}
        config rule
            edit <id>
                set action {deny | permit}
                set type {rt | soo}
                set match <extended_community_specifications>
                set regexp <ordered_list_of_attributes>
            next
        end
    next
end

config router route-map
    edit <name>
        config rule
            edit <id>
                set match-extcommunity <list>
                set match-extcommunity-exact {enable | disable}
            next
        end
    next
end

config system global
    set ip-fragment-mem-thresholds <integer>
end

config webfilter fortiguard
    set embed-image {enable | disable}
end

config switch-controller managed-switch
    edit <serial_number>
        config dhcp-snooping-static-client
            edit <name>
                set ip <IP_address>
                set vlan <vlan_ID>
                set mac <MAC_address>
                set port <port>
            next
        end
    next
end

config webfilter urlfilter
    edit <id>
        set ip4-mapped-ip6 {enable | disable}
    next
end

config router static
    edit <seq-num>
        set device "vpn1"
        set vrf 1
    next
end

BFD is skipped when the VPN interface uses vpn-id-ipip encapsulation.

config system global
    set log-single-cpu-high {enable | disable}
end

config automation setting
    set fabric-sync {enable | disable}
end

# diagnose wad filter process-type <integer>

# diagnose wad filter process-id <integer>

When running diagnose wad filter list , the process type and process id are visible in the output.

config switch-controller managed-switch
    edit <switch-id>
        config ports
            edit <name>
                set poe-port-mode {ieee802-3af | ieee802-3at}
                set poe-port-priority {critical-priority | high-priority | low-priority}
                set poe-port-power {normal | perpetual | perpetual-fast}
            next
        end
    next
end

config firewall vip
    edit <vip>
        set type server-load-balance
        config realservers
            edit <id>
                set translate-host {enable | disable}
            next
        end
    next
end

config firewall access-proxy
    edit <name>
        config api-gateway
            edit <id>
                config realservers
                    edit <id>
                        set translate-host {enable | disable}
                    next
                end
            next
        end
    next
end

config router static
    edit <seq-num>
        set tag <id>
    next
end

Add password field to BGP neighbor group to be used for the neighbor range.

config router bgp
    config neighbor-group
        edit <name>
            set password <password>
        next
    end
end

The execute restore yaml-config command has been removed and execute restore config should be used.

In the GUI, the File format field has been removed from the Restore system Configuration page.

config endpoint-control fctems
    edit <id>
        set trust-ca-cn {enable | disable}
    next
end

# diagnose sys npu-session list-brief

# diagnose sys npu-session list-brief6

• Increase the number of supported IP ranges from 3 to 10
• Support DHCP option 77 for User Class information
• Support customizing the lease time per IP range (CLI only)

config system global
    set internet-service-database on-demand
end

# diagnose debug kernel sysrq status

# diagnose debug kernel sysrq {enable | disable}

# diagnose debug kernel sysrq command crash

A kernel crash dump is outputted to the console. The FortiGate reboots and recovers without losing any functionality. This is only supported on FortiGate VMs.

• API Gateway private endpoints
• VPC endpoints for Aurora Data API
• AWS PrivateLink for S3
• VPC endpoints for Lamdba

This adds support for dynamic policies in FortiGate CNF, and to resolve various AWS PrivateLink endpoints for dynamic policies in typical deployments.

• LAN2 port of FortiAP models with LAN1 and LAN2 ports
• LAN port of FortiAP models with LAN and WAN ports

The following configuration settings are required:

• WAN-LAN operation must be configured using set wan-port-mode wan-lan on the FortiGate’s FortiAP profile and cfg -a WANLAN_MODE=WAN-LAN using the FortiAP CLI, respectively.
• LAN port mode can be configured using any of the port-mode options (nat-to-wan, bridge-to-wan, bridge-to-ssid) under config lan within config wireless-controller wtp-profile.

Details about wired clients are displayed in the FortiOS CLI using diagnose wireless-controller wlac -c lan-sta, and in the FortiAP CLI using cw_diag -c k-lan-host.

config user radius
    edit <name>
        set nas-id-type {legacy | custom | hostname}
        set nas-id <string>
    next
end

config firewall vip6
    edit "test"
        set mappedip <IPv6_address>
        set ndp-reply {enable | disable}
    next
end

# execute lte-modem set-usb-mode {0 | 1}

config system npu
    set shaping-stats {enable | disable}
end

# diagnose debug fortilink-report {all | switch-id | switch-group}

config system global
    set syslog-affinity <string>
end

config firewall ssl-ssh-profile
    edit <name>
        config ssl
            set inspect-all deep-inspection
            set cert-probe-failure {allow | block}
        end
    next
end

config system settings
    set detect-unknown-esp {enable | disable}
end

# diagnose system sdwan health-check remote <name> <seq_num>

config firewall security-policy
    set dstaddr6-negate {enable | disable}
    set srcaddr6-negate {enable | disable}
end

config firewall profile-protocol-options
    edit <name>
        config http
            set unknown-content-encoding {block | inspect | bypass}
        end
    next
end

Before this change, the same url-map was allowed with different services. After this change, API gateway with the same url-map are not allowed under the same host (including empty vhosts).

If there is already a certain url-map configured in previous API gateways, under a certain vhost, then no more API gateways with the same url-map can be added under the same vhost. Users will get an error message stating this action is not allowed.

Workaround: use CLI to set schedules with an end date of 31st.

After upgrading from 7.2.0 to 7.2.1, the EMS tag format was converted properly in the CLI configuration, but the WAD daemon is unable to recognize this new format, so the ZTNA traffic will not match any ZTNA policies with EMS tag name checking enabled.

An FQDN address type that can resolve public IPs is not recommended for ZTNA TCP forwarding on real servers because the defined internal DNS database zone is trying to override it at the same time. By doing so, the internal private address may not take effect after rebooting, and causes a ZTNA TCP forwarding failure due to the real server not being found.

• CVE-2022-41328

• CVE-2022-42475

• After upgrading, the previously configured proxy-auth-timeout value for the absolute re-authentication mode is not preserved in the new proxy-re-authentication-time.
• The new proxy-re-authentication-time is currently configured in seconds, but it should be configured in minutes to be consistent with other related authentication timers (such as proxy-auth-timeout).