config wireless-controller wtp
    edit <id>
        set ble-major-id <integer>
        set ble-minor-id <integer>
    next
end

config wireless-controller wtp-group
    edit <name>
        set ble-major-id <integer>
        set wtps <wtp-id1>, <wtp-id2>, ...
    next
end

The BLE major ID defined in the WTP settings overrides the BLE major ID defined in the WTP group settings and the BLE major ID defined in the BLE profile settings.

The BLE major ID defined in the WTP group settings overrides the BLE major ID defined in the BLE profile settings.

The BLE minor ID defined in the WTP settings overrides the BLE minor ID defined in the BLE profile settings.

config wireless-controller wids-profile
    edit <name>
        set ap-scan enable
        set ap-scan-channel-list-2G-5G <channel-1> <channel-2> ... <channel-x>        
        set ap-scan-channel-list-6G <channel-1> <channel-2> ... <channel-y>       
    next
end

config wifi-networks
    edit <id>
        set wifi-security wpa-enterprise
        set wifi-eap-type {both | tls | peap}
        set wifi-username <string>
        set wifi-client-certificate <client_certificate>
        set wifi-private-key <client_certificate>
    next
end

The username, client certificate, and private key settings are applicable when connecting to a WPA2/WPA3-Enterprise SSID with EAP-TLS.

config wireless-controller wtp-profile
    edit <name>
        config radio-<number>
            set mimo-mode <supported_modes_depend_on_FAP_platform>
        end
    next
end

config system lte-modem
    set pdptype {IPv4 | IPv6 | IPv4v6}
end

config system lte-modem
    set data-usage-tracking enable
    config sim-switch
        set by-data-plan enable
    end
    config data-plan
        edit <id>
            set target-sim-slot {SIM-slot-1 | SIM-slot-2}
            set data-limit <integer>
            set data-limit-alert <integer>
            set billing-period {monthly | weekly | daily}
            set billing-date <integer>
            set billing-weekday {sunday | monday | tuesday | wednesday | thursday | friday | saturday}
            set billing-hour <integer>
            set overage {enable | disable}
            set iccid <SIM_ICCID>
            set delay-switch-time <HH:MM>
        next
    end
end

config authentication rule
    edit <name>
        set web-auth-cookie enable
        set cors-stateful {enable | disable}
        set cors-depth <integer>
    next
end

config firewall proxy-policy
    edit <id>
        set detect-https-in-http-request {enable | disable}
    next
end

The transparent conditional DNS forwarder allows the FortiGate to intercept and reroute DNS queries for specific domains to a specific DNS server. This provides greater control over DNS requests, especially when the administrator is not managing the DNS server configuration of the client devices. This can improve network efficiency and performance by resolving IPs local to the client’s PCs rather than IPs local to the central DNS server.

The diagnose firewall iprope lookup command has been updated to specify additional parameters, including policy type (policy or proxy), and a new parameter for identity-based policy matching. The policy match feature will be activated if more than six parameters are specified in the existing diagnose command.

# diagnose firewall iprope lookup <source_ip> <source_port> <destination_ip> <destination_port> <protocol> <device> <policy_type> [<auth_type>] [<user/group>] [<server>]

The diagnose ips pme fabric-address list command can be used to check what address is set in the security policy after FABRIC_DEVICE is used in the address.

config system session-ttl
    config port
        edit <id>
            set protocol <integer>
            set timeout <timeout_value>
            set refresh-direction {both | outgoing | incoming}
        next
    end
end

• When a single row is selected, display a menu with accompanying descriptive text below it. The More dropdown in this menu contains the same items as the right-click context menu.
• When multiple rows are selected, the inline menu disappears and the top menu bar changes to display buttons applicable to multi-selection.
• Update the top-right view options to a dropdown containing three options.
• Add a tooltip to the view option to indicate that selecting By Sequence will result in the fastest loading time if the table size is greater than 10 thousand.

config router static
    edit <seq-num>
        set tag <id>
    next
end

Add password field to BGP neighbor group to be used for the neighbor range.

config router bgp
    config neighbor-group
        edit <name>
            set password <password>
        next
    end
end

The following options are added:

• minimum-sla-meet-members setting in SD-WAN zone configurations
• zone-mode setting in SD-WAN service configurations
• service-id attribute in SD-WAN neighbor configurations
• sla-stickness attribute in SD-WAN service configurations
• Allow the neighbor-group to be configured under SD-WAN neighbor configurations

• When the load balancing strategy is configured under the manual mode strategy, SLA targets are not used.
• When the load balancing strategy is configured under the lowest cost (SLA) strategy, SLA targets are used.

• Support UDP speed tests.
• Support multiple TCP connections to the server instead of a single connection.
• Measure the latency to speed test servers and select the server with the smallest latency to perform the test.
• Support the auto mode speed test, which selects either UDP or TCP testing automatically based on the latency threshold.

The following IPv4 and IPv6 BGP configuration settings are required:

• The hub FortiGate should be configured with neighbor-group and neighbor-range/neighbor-range6.
• Each spoke FortiGate should be configured with neighbor-group and neighbor-range/neighbor-range6 (like the hub), and more importantly, each spoke should be configured with set passive disable to ensure spokes are able to initiate dynamic BGP connections between each other.
• The hub FortiGate should have route reflection disabled (by default) where each neighbor-group setting should have set route-reflector-client disable.

• Display FortiVoice endpoint details in the device tooltips (FortiView monitor and log pages). Users can view the display name and extension number of each FortiFone, making it easier to identify and manage endpoint phones.
• When a FortiVoice-supplied MAC or IP address is used in a firewall policy, automatically create a FortiVoice tag (MAC/IP) dynamic address on the FortiGate that contains all the provisioned FortiFones registered with FortiVoice. The dynamic address can be used in firewall policies to restrict rules to authorized FortiFones only.

• Artificial intelligence technology (category 100): sites that offer solutions, insights, and resources related to artificial intelligence (AI).
• Cryptocurrency (category 101): sites that specialize in digital or virtual currencies that are secured by cryptography and operate on decentralized networks.

# execute vpn certificate local generate est <options>

After upgrading, users must activate the user password policy using the CLI. The previous password policy settings will remain valid, but they will not be effective unless the password policy is enabled. If the password policy is not enabled, the expire-days <integer> option will not force users to change their password after number of specified days.

• Reorganize ike-log-filter and ike-gateway-filter into two separate sub-commands.
• Rename the src-addr and dst-addr filter options to loc-addr and rem-addr to make the naming more precise.
• Add option to show the name of current executing functions in the IKE debug log (diagnose vpn ike log function-name {enable | disable}).
• Display VDOM name instead of VDOM index in the debug log to provide more readability.

config vpn ssl settings
    set dtls-heartbeat-idle-timeout <integer>
    set dtls-heartbeat-interval <integer>
    set dtls-heartbeat-fail-count <integer>
end

The default value for these attributes is 3 seconds, which is also the minimum allowable value. The maximum allowable value for these attributes is 10 seconds.

This silent misconfiguration can result in unexpected behavior of firewall policies that use the impacted service. For example, some 6K and 7K platforms have firewall service ALL (protocol type IP) as the first service, and this can cause the ALL service to be modified unexpectedly.