config system settings
    set dp-load-distribution-method {derived | to-master | src-ip | dst-ip | src-dst-ip | src-ip-sport | dst-ip-dport | src-dst-ip-sport-dport}
end

The default load balancing method, derived, means traffic for that VDOM uses the global load balancing method set by the dp-load-distribution-method option of the global config load-balance setting command.

config router static
    edit <seq-num>
        set tag <id>
    next
end

Add password field to BGP neighbor group to be used for the neighbor range.

config router bgp
    config neighbor-group
        edit <name>
            set password <password>
        next
    end
end

# diagnose sys filesystem hash

• Support UDP speed tests.
• Support multiple TCP connections to the server instead of a single connection.
• Measure the latency to speed test servers and select the server with the smallest latency to perform the test.
• Support the auto mode speed test, which selects either UDP or TCP testing automatically based on the latency threshold.

CLI changes:

config switch-controller global
    set vlan-identity {name | description}
end

config system fortiguard
    set auto-firmware-upgrade {enable | disable}
    set auto-firmware-upgrade-delay <integer>
end

Where:

• auto-firmware-upgrade is enabled by default upon upgrade.
• auto-firmware-upgrade-delay is set to 3 days by default.

Affected platforms:

FGT-40F, FGT-40F-3G4G, FGT-60E, FGT-60E-DSL, FGT-60E-DSLJ, FGT-60E-POE, FGT-60F, FGT-61E, FGT-61F, FGT-70F, FGT-71F, FGT-80E, FGT-80E-POE, FGT-80F, FGT-80F-BP, FGT-80F-POE, FGT-81E, FGT-81E-POE, FGT-81F, FGT-81F-POE, FGT-90E, FGT-91E, FGR-60F, FGR-60F-3G4G, FGR-70F, FGR-70F-3G4G, FWF-40F, FWF-40F-3G4G, FWF-60E, FWF-60E-DSL, FWF-60E-DSLJ, FWF-60F, FWF-61E, FWF-61F, FWF-80F-2R, FWF-81F-2R, FWF-81F-2R-3G4G-POE, FWF-81F-2R-POE

This silent misconfiguration can result in unexpected behavior of firewall policies that use the impacted service. For example, some 6K and 7K platforms have firewall service ALL (protocol type IP) as the first service, and this can cause the ALL service to be modified unexpectedly.

config system pppoe-interface
    edit <name>
        set device <string> 
        set username <string>
        set password <password>
    next
end

config vpn ssl settings
    set source-interface <PPPoE_interface_name>
end

This issue is also observed on VNE tunnel configurations.

Affected platforms: FGT-340xE, FGT-360xE

Workaround:

1. Take the ports out of LAG and disable FEC, and then put them back to the LAG.
2. Disable FEC manually on the driver level via commands.

• CVE-2023-45862

• CVE-2023-37930

• CVE-2023-42785