config wireless-controller wtp-profile
    edit "FAP433F"
        config radio-1
            set optional-antenna {none | FANT-04ABGN-0606-O-R | FANT-04ABGN-0606-P-R}
        end
    next
end

This setting can be configured in the GUI for supported FortiAP profile in the Radio section. Enable External antenna and select the external antenna model from the list of defined values.

This setting allows antenna gains that are specific to the Fortinet external antenna model and the Wi-Fi band (2.4 GHz or 5 GHz) being used to be taken into consideration by the FortiGate wireless controller to set transmit power properly for a managed FortiAP device.

config wireless-controller vap
    edit <name>
        set security wpa2-only-enterprise
        set roaming-acct-interim-update {enable | disable}
    next
end

config wireless-controller vap
    edit <name>
        set ssid <name>
        set security wpa3-sae
        set pmf enable
        set sae-hnp-only {enable | disable}
    next
end

Supported FortiAP models include: FAP-432F, FAP-432FR, FAP-433F, FAP-233G, FAP-432G, FAP-433G, FAP-U432F, and FAP-U433F. For example:

config wireless-controller wtp-profile
    edit "FP433G"
        config platform
            set type 433G
        end
        config radio-2
            set optional-antenna custom
            set optional-antenna-gain "10"
        end
    next
end

These settings can be configured in the GUI for supported FortiAP profile in the Radio section. Enable External antenna, select Custom from the dropdown, and enter a value for External antenna gain (dB).

config wireless-controller wtp-profile
    edit <name>
        config radio-1
            set mode sam
            set sam-ssid <string>
            set sam-security-type {wpa-enterprise |wpa3-sae | owe}
        end
    next
end

config wireless-controller vap
    edit <name>
        set 80211k {enable | disable}
        set 80211v {enable | disable}
    next
end

• Users can set the Bonjour profile in the WTP configuration and WTP profile.

  config wireless-controller wtp-profile
      edit <name>
          set bonjour-profile <name>
      next
  end

• To ensure uninterrupted service, introduce a new election procedure among the APs. This provides a failover mechanism or redundancy if the Bonjour gateway goes down.

config wireless-controller timers
    set nat-session-keep-alive <integer>
end

# execute wireless-controller create-sae-pk

• Add cmac-aes128 option in the router key-chain settings:

  config router key-chain
      edit <name>
          config key
              edit <id>
                  set algorithm cmac-aes128
              next
          end
      next
  end

• Add auth-options for BGP neighbor and neighbor-group settings:

  config router bgp
      config neighbor
          edit <ip>
              set auth-options <key-chain>
          end
      next
      config neighbor-group
          edit <name>
              set auth-options <key-chain>
          end
      next
  end

• Add debug command for tcp-auth-options:

  # diagnose sys tcp-auth-options

After connecting to the FortiGate Controller, the following settings are automatically configured on the FortiGate Connector:

• VDOM link interface in the LAN extension VDOM is a part of the LAN extension software switch
• VDOM link interface in the traffic VDOM is dynamically assigned an IP address, which has been obtained from the FortiGate Controller

This feature is required to support the FortiGate Secure Edge use case for FortiSASE.

ADVPN 2.0 incorporates intelligence into the spokes to ensure shortcut tunnels, known as shortcuts, are established using underlays available on both spokes and chosen based on matching certain link health criteria.

ADVPN 2.0 provides a more flexible SD-WAN solution than the original ADVPN to achieve resiliency against underlay outages or degraded underlay performance that is no longer dependent on specific BGP routing designs or mechanisms.

config webfilter profile
    edit <name>
        set web-flow-log-encoding {utf-8 | punycode}
    next
end

• Diameter-based packet forwarding and routing: the FortiGate can forward and route Diameter packets that match a firewall policy with an enabled diameter-filter profile.
• Packet sanity checking: this feature checks if the packet passing through the FortiGate conforms to the Diameter protocol standards as defined in RFC 3588.
• Logging: for network auditing purposes, the traffic for both dropped and forwarded Diameter-based packets can be logged.

This is crucial for interfaces used to exchange information with roaming partners over the IPX network.

config system global
    set ssh-hostkey-override {enable | disable}
    set ssh-hostkey-password <password>
    set ssh-hostkey <encrypted_private_key>
end

config system interface
    edit <name>
        config ipv6
            config vrrp6
                edit <id>
                    set ignore-default-route {enable | disable}
                next
            end
        end
    next
end

config system snmp sysinfo
    set trap-free-memory-threshold <integer>
    set trap-freeable-memory-threshold <integer>
end

config vpn ipsec phase1-interface
    rename <string> to <string>
end

config system ha
    set ipsec-phase2-proposal <option>
end

Workaround: navigate to the Diagnostics & Tools pane of the FortiSwitch to see the correct registration status.

Workaround: super_admin users can enable the monitor bandwidth feature on the interface first, then the widget can work for read-only administrators.

Workaround: avoid navigating to memory-intensive pages under Dashboard with multiple widgets that can cause a spike in memory consumption. Users can create custom dashboards with a single widget to reduce the concurrent load.

Workaround: use the CLI to configure it.

Workaround: perform a full page refresh to allow the page to load again.