Added Special notices > AWS-On-Demand image.

Added FG-91E, FG-1100E, FG-1101E, and FOS-VM64-HV to Supported models.

Removed FG-VM64-AWSONDEMAND from Supported models.

Added FG-2200E, FG-2201E, FG-3300E, and FG-3301E to Special branch supported models.

POE, FG-200E, FG-201E, FG-300D, FG-300E, FG-301E, FG-400D, FG-400E, FG-401E,

FG-500D, FG-500E, FG-501E, FG-600D, FG-600E, FG-601E, FG-800D, FG-900D, FG1000D, FG-1100E, FG-1101E, FG-1200D, FG-1500D, FG-1500DT, FG-2000E, FG-2500E,

FG-3000D, FG-3100D, FG-3200D, FG-3400E, FG-3401E, FG-3600E, FG-3601E, FG3700D, FG-3800D, FG-3810D, FG-3815D, FG-5001D, FG-3960E, FG-3980E, FG-5001E, FG-5001E1

FG-VM64-KVM, FG-VM64-OPC, FG-VM64-RAXONDEMAND, FG-VMX, FG-VM64-XEN

l  Added default automation rules (after factory reset). All are disabled by default, except for the FEXP push notification.

l  Added new incoming webhook trigger for automation.

l  Removed Email Alert Settings page.

l  Added new API for POST /api/v2/monitor/system/automationstitch/webhook/<trigger mkey>.

This issue affects the FG-60E, FG-61E, FG-80E, FG-81E, FG-90E, and FG-91E models that contain a hardware switch and have FortiLink configured on it by default. Aggregate, physical, and software switch interfaces are unaffected.

config system smc-ntp <==added set ntpsync enable <==added set syncinterval 120 <==added config ntpserver <==added edit 1 set server 208.91.114.98 <==added

next

end

end

config endpoint-control fctems edit <name> …

set certificate <cert-name> <==added … next …

end

Add execute fctems verify. execute fctems verify <fctems name>

config wireless-controller wtp-profile edit “FAP423E-default” config platform set type 423E

end

set handoff-sta-thresh 55 set frequency-handoff enable <==changed set ap-handoff enable <==changed config radio-1 set band 802.11n,g-only

end config radio-2 set band 802.11ac

next

end

pcui-cloudinit-test # execute <?> update-eip Update external IP. <==added

config sys interface edit [Name] set eip               <==added

next

end

config system virtual-wan-link config health-check set protocol dns <==added dns option set system-dns <==added

end

end

config system sdn-connector edit “aci_direct1” set type aci-direct <==added

next

end

config wireless-controller vap edit guestwifi set ssid “GuestWiFi” set security captive-portal set external-web “http://170.00.00.000/portal/index.php” set selected-usergroups “Guest-group” set intra-vap-privacy enable set schedule “always”

set external-web-format auto-detect <==added

next

end

config firewall policy edit 9

set nat enable

next

end

Add diagnose commands to show vendor information.

diagnose vendor-mac id diagnose vendor-mac match

config firewall proxy-policy edit 4 set av-profile “av” <==added

next

end

config wireless-controller wag-profile <==added edit [Profile Name]               <==added

end

config wireless-controller vap edit “80e_gre” set ssid “FOS-QA_Bruce_80e_gre” set local-bridging enable set vlanid 3135 set primary-wag-profile “tunnel” <==added set secondary-wag-profile “l2tp” <==added

next

end

config wireless-controller wtp-p edit “FAPU431F-default” config platform set type U431F set mode single-5G

end config radio-1 set band 802.11ax-5G

end config radio-2 set band 802.11ax

end config radio-3 set mode monitor

end

next

end

rofile

config firewall policy edit 88 set srcintf “port4”

next

end

config firewall policy edit 201 set srcintf “wan1” set dstintf “wan2” set srcaddr “all” set dstaddr “all”

next

end

config firewall internet-service-name edit “test-locaction-isdb-1” set type location set internet-service-id 65537 set country-id 840 set region-id 283 set city-id 23352

next

end

Rename internet-service-id to internet-service-src-id, and internetservice-name to internet-service-src-name under firewall policy.

config firewall policy edit 99 set internet-service enable set internet-service-name “test-locaction-isdb-1” <==changed set internet-service-src enable

set internet-service-src-name “test-location-isdb-3” <==changed

next

end

config dpdk global set status [enable | disable] set multiqueue [enable | disable] set sleep-on-idle [enable | disable] set elasticbuffer [enable | disable] set hugepage-percentage [Percentage of

config dpdk cpus set rx-cpus [CPUs enabled to run DPDK RX engines] set vnp-cpus [CPUs enabled to run DPDK VNP engines] set ips-cpus [CPUs enabled to run DPDK IPS engines] set tx-cpus [CPUs enabled to run DPDK TX engines]

config vpn ssl web portal edit tunnel-portal set split-tunneling-routing-negate [enable | disable] <==added set ipv6-split-tunneling-routing-negate [enable | disable] <==added

next

end

config firewall central-snat-map edit 2 set type ipv6 <==added

next

end

config fire edit 1 set

wall policy name “policy_id_1”

next

end

Replace captive-portal-radius-server with radius-server on captive portal VAP with CMCC portal type.

config wireless-controller vap edit “vap-cmcc”

“http://172.30.144.11:8080/am/portal/ac/FG81EP4Q16000601/ssid/vap-cmcc” set radius-server “cmcc-radius” <==added set local-bridging enable set portal-type cmcc

next

end

Replace captive-portal-macauth-radius-server with radius-mac-auth-server on captive portal VAP with CMCC mac-auth portal type.

config wireless-controller vap edit “Melody-CMCC” set ssid “vap-CMCC-macauth” set security captive-portal set external-web

“http://172.30.144.11:8080/am/portal/ac/FG81EP4Q16000601/ssid/vap-CMCCmacauth” set radius-mac-auth enable set radius-mac-auth-server “cmcc_mac_auth_svr” <==added set radius-server “cmcc_auth_svr” <==added set local-bridging enable set portal-type cmcc-macauth

next

end

Change the least value of acct-interim-interval from 600 to 60 in RADIUS server.

config user radius edit radius set acct-interim-interval <60 – 86400> <==new range

next

end

config firewall address6 edit “test-ipv6-geoip” set type geography <==added set country “CA”

next

end

next

end

Add comments field under multicast-policy.

config firewall multicast-policy edit 1 set uuid d0f74f64-fc41-51e9-2dfc-729f027e9979 set comments “multicast-policy-1”

next

end

config system csf set fabric-object-unification [default | local] <==added

end

VPN settings.

config vpn ssl settings set encrypt-and-store-password [enable | disable] <==added set transform-backward-slashes [enable | disable] <==added

end

config router route-map edit <name> config rule edit <id> set match-vrf Match VRF ID. <==added

next

end

next

end

Add vrf-leak under BGP configuration.

config router bgp config vrf-leak added edit <id> added

end

next

end

end

Add clear route vrf-leak commands. execute router clear bgp all vrfexecute router clear bgp all soft

vrf-leak

config system interface edit port4 set allowaccess ? ping PING access. https HTTPS access.

ssh SSH access. snmp SNMP access. http HTTP access. telnet TELNET access. fgfm FortiManager access.

radius-acct RADIUS accounting access. probe-response Probe access.

fabric Security Fabric access. <==added ftm FTM access.

next

end

config sys virtual-wan-link config service edit 2 set mode manual

set priority-members 2 3 <==changed

next

end

end

config switch-controller security-policy 802-1X

next

end

config application list edit “app-list-1” config entries edit 1000008 config parameters edit 1 config members <==added edit 1 <==added set name command <==added

next

end

next

end

next

end

next

end

config system ipsec-aggregate edit testagg set algorithm ?

L3 Use layer 3 address for distribution. L4 Use layer 4 information for distribution.

round-robin Per-packet round-robin distribution. redundant Use first tunnel that is up for all traffic.

weighted-round-robin Weighted round-robin distribution. <==added

next

end

Add aggregate-weight under ipsec phase1-interface.

next

end

config system auto-script edit 1 set timeout 0 <==added

next

end

config system interface edit “port1” set vdom “root” set ip 10.111.255.86 255.255.255.0 set allowaccess ping set type physical set monitor-bandwidth enable set snmp-index 1

next

end

config system sdn-connector edit “azure1” set type azure

set use-metadata-iam [enable|disable] <==added

next

end

config firewall addrgrp edit “test-folder-addrgrp-1” set type folder <==added set member “172-16-200-156” set allow-routing enable

next

end

config system virtual-wan-link config health-check set probe-timeout 500 <==added

end

end

config system automation-action edit “slack1” set action-type slack-notification <==added

next

end

config vpn ssl web realm edit <realm_name> set radius-server <radius_server> <==added set nas-ip <nas_ip> <==added

next

end

config switch-controller 802-1X-settings set tx-period 30 <==added

end

config switch-controller managed-switch edit S524DN4K16000116 config 802-1X-settings set local-override enable set tx-period 30 <==added

end

next

end

config firewall address edit “aws-asg-addr1” set type dynamic set sdn “aws-sdn”

set filter “AutoScaleGroup=10703c-4f731e90-fortigate-payg-auto-

end

config firewall vip config realservers set type address <==added

set address [firewall.address.dynamic_address] <==added

end

end

config switch-controller managed-switch edit S248EPTF18001384 config ports edit port1 get | grep igmp-snooping <==removed

next

end

next

end

config sys virtual-wan-link config service edit 1 set mode load-balance

set sla-compare-method number <==removed

next

end

end

config antivirus profile edit “av” set scan-mode legacy <==removed

next

end

config antivirus settings set default-db extended <==removed set grayware enable set override-timeout 0

end

config antivirus settings set use-extreme-db [enable | disable] <==added only on mid- and high-end

FortiGates set grayware enable set override-timeout 0

end

config antivirus profile edit “av” set feature-set [flow | proxy] <==added

next

end

config system dns-database edit “slave” set domain “fm.tvssa.net”

set type slave set rr-max 0

set ip-master 172.16.78.171

next edit “slave2” set status disable set domain “test.edu” set type slave set rr-max 40000 set ip-master 172.16.78.171

next

end

config application list edit “app-list-1” set force-inclusion-ssl-di-sigs disable <==added

next

end

config sys vdom-exception

next

end

config vpn ipsec phase1-interface edit “1” set type dynamic set peertype any set net-device disable set mode-cfg enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set dpd on-idle set assign-ip-from dhcp set dhcp-ra-giaddr <==added

next

end

config vpn ocvpn set multipath [enable | disable] <==added set wan-interface <interface name> <==added set ip-allocation-block x.x.x.x y.y.y.y <==added set sdwan [enable | disable] <==added config overlays <==added edit <overlay name> <==added set inter-overlay [allow | deny] <==added next

end

config forticlient-access <==added set status enable <==added

next

end

end

In FortiOS 6.4.0, the default WTF profiles are not created by default until a FortiAP is added by discovery or manually.

entries must be removed and replaced in the source data configuration (config icap profile). This step needs to be performed before upgrading in case of configuration loss.

config wireless-controller wtp-profile edit <FAP-Profile> set ext-info-enable enable <==changed

next

end

config wireless-controller wtp-profile edit <New profile> config platform set type 221E <==changed

end

next

end

config log memory filter set severity information <==changed

end

config switch-controller storm-control set rate 500 set unknown-unicast disable <==changed set unknown-multicast disable set broadcast disable <==changed

end

config user radius edit 1 set password-renewal enable <==changed

next

end

end

l 1U platforms increased from 8 to 16 l 2U platforms increased from 32 to 64 l High-end platforms increased from 32 to 256

l FG-200E/201E WTP table size changed from 128 to 256 l FG-3960E/3980E WTP table size changed from 4096 to 8192

config wireless-controller vap edit weak-signal-vap set probe-resp-suppression enable|disable set probe-resp-threshold set radio-sensitivity enable|disable set radio-2g-threshold set radio-5g-threshold set sticky-client-remove enable|disable <==added set sticky-client-2g-threshold <==added set sticky-client-5g-threshold <==added

end

end

config wireless-controller wtp-profile edit [ FAPU421EV-default | FAPU422EV-default | FAPU423EV-default ] config radio-2 set band 802.11ac set channel-bonding 160MHz

end

next

end

config wireless-controller wids-profile edit <WIDS-profile-name>

next

end

The range of ap-scan-threshold, in dBm, is -95 to -20 (default = -90).

l Add proxy-after-tcp-handshake option in protocol option and SSL-SSH profile.

l HE (high efficiency)/160 MHz bandwidth/TWT support

FortiView and Monitor entries have been removed from the navigation bar. Most of the pages under them now show up as widgets in several newly added default dashboards. Exceptions being:

l WiFi Client Monitor, which has been renamed to WiFi Clients and moved to the WiFi &

Switch Controller section l Modem and WAN OPT pages which will still show up under Monitor if the feature is enabled.

l Added CMDB attribute fortinet-one-cloud-authentication to FortiClient EMS table. l Added curl verbose diagnosis debugs to FortiClient NAC daemon for debug images. l Added fortiems-cloud option to type attribute in user.fsso table.

Added CLI command to push ip-source-guard static entries to FortiSwitch.

l  This feature enables source guard entries to be set for physical switches as well as trunk ports. l The source guard IP needs to be unique for every source guard entry across all ports.

l  The binding entry is a second level table (switch_id being the base) with port_name as the parent key. Deleted events work at a switch level, but the with second level tables, there is a need to store grandparent context as well. An opaque data field has been created in the queue node and the corresponding flcfg_add_event_queue and flcfg_delete_sw_

l  Any calls to the flcfg_add_event_queue have been modified.

l  There are two kinds of events that will be generated with this command: FLCFG_MSW_CMF_ SOURCE_GUARD_UPDATE for port level info change and FLCFG_MSW_CMF_SOURCE_ GUARD_ENTRY_UPDATE for binding entry level info change.

l  Add command to show FSSO dynamic address from authd daemon:

diagnose debug authd fsso show-address

l  Make diagnose firewall dynamic commands to accept one optional parameter as address name:

diagnose firewall dynamic list diagnose firewall dynamic address

l  Add FSSO subtype for firewall address:

config firewall address edit <name> set sub-type fsso

next

end

GUI changes:

l  Address dialog page l New subtype field to select between FSSO and Fabric Connector l New FSSO group field to select address group

l  Address list page

l  Tooltip for new FSSO dynamic address supports resolved address l Detail column shows the address groups for the address

l Add new CLI setting for SAML user:

config user saml edit * set ?

cert Certificate to sign SAML messages.

*entity-id SP entity ID.

*single-sign-on-url SP single sign-on URL. single-logout-url SP single logout URL.

*idp-entity-id IDP entity ID.

*idp-single-sign-on-url IDP single sign-on URL. idp-single-logout-url IDP single logout url.

group-name Group name in assertion statement.

next

end

l  Added Hit Count and Last Used columns for Routing Monitor> Policy, Policy Route List, and SD-WAN Rules pages.

SD-WAN interfaces:

l  SD-WAN in navigation bar renamed SD-WAN Interfaces. l SD-WAN Interfaces list converted to a full page list with pie charts at the top.

l  Added Sessions, Upload, Download (bandwidth), Bytes Sent, and Bytes Received columns to the table.

l  The Edit dialog is no longer a slide in so it is consistent with other full page lists.

SD-WAN rules:

l  Added a checkmark next to interface that is currently selected by SD-WAN.

l  Checkmark has Memberis selected tooltip. A reason (has best measured performances/meets most SLAs) is further stated for Best Performance (priority) and SLA (SLA/load-balance) strategies.

l  If multiple members are selected at the same time, GUI only marks the highest ranked member, unless mode is load-balance.

l  Added health check/SLA statistics tables for SD-WAN member omni select tooltip.

l  In the Edit dialog, the Strategies field changed to cards to allow a brief description of each strategy.

l  Added gutter to the Edit dialog. The gutter contains Last used and Hit count of the rule. l The gutter also contains a table showing statistics of currently selected members for SLA. l Added support for multiple members being selected in manual mode.

Performance SLA:

l  Added support for IPv4 DNS protocol. l Added support for using system DNS. GUI will display the system DNS server in this case. l Support set members 0, which means all SD-WAN members participate in a health check.

In an Azure HA scenario, EIP and route tables failover are specified in the SDN connector configuration. A new attribute, resource-group, was added, which allows a user to specifying the resource group that an EIP or route table is from. This new attribute can be empty so upgrade code is not required.

If the resource-group of an EIP or route table is not provided, it is assumed the resource comes from the same resource group setting in the SDN connector (if there is no setting, it assumes the same resource group as the FortiGate itself by getting it from the instance metadata). CLI changes:

config log fortianalyzer-cloud filter

Most options within config log fortianalyzer-cloud filter defaulted to disable and could not be changed. Now, they default to enable and can be changed. License-based restrictions still apply, but the configuration can be used to refine the logs being sent to FortiAnalyzer Cloud.

The exception is the dlp-archive option, which is still set to disable and cannot be changed.

l  consolidated.policy removed, related function and attribute removed

l  system.settings.consolidated-firewall-mode removed, consolidated related function and attribute removed

l  Both policies are merged to firewall.policy

l  Application changes related to policy merge including ips, wad, sslvpn, ocvpn, dnsproxy, voip, urlfilter, proxy, scanunit, authd, snmp, updated, miglogd, etc.

GUI changes: l IPv4 Policy and IPv6 Policy menu entries have been removed and both can now be configured under the new Firewall Policy menu.

The extension improves the quality of GUI bug reports. The extension communicates with FortiOS and allows users to perform a capture. The capture includes (but is not limited to) the following:

l Screen recording l Device metadata l Client (browser) metadata l HTTP network logs l JavaScript console logs l Various daemon logs l Client memory and CPU usage l Device memory and CPU usage

l Added wtp-profile support for FAP-231E NPI platform.

l  Single 5G l Radio 1 operates at 2.4 GHz l Radio 2 operates at 5 GHz l Radio 3 set to monitor mode l Dual 5G

l  Radio 1 operates at 5 GHz and uses the higher spectrum of channels ( >=

64 ) l Radio 2: operates at 5 GHz and uses the lower spectrum of channels ( < 64) l Radio 3: can be set to AP mode

l  New wtp-profile platform property ddscan.

l  FortiGate will configure DFS channels on FAP-231E with region code E, I, V, Y, and D.

l  Default mode for 3-radio AP models set to single 5G .

GUI changes:

l  Added GUI support for FAP-231E platform: l New GUI option, Dedicated scan, which is counterpart of ddscan platform property.

l  When dedicated scan is enabled:

l  Monitor mode becomes exclusive to radio 3 l No AP mode for radio 3, even in dual 5G l No WIDS profile setting for radio 1 and 2 API changes:

l  /api/v2/monitor/wifi/ap_platforms l Radio property changed from object to array to accommodate for multimode platforms. First element is single 5G, and second is dual 5G platform radio configuration. For nonmultimode platforms, array is of length 1.

l  Added SNMP query OIDs (1.3.6.1.4.1.12356.101.23) for the following DHCP servers:

l  OID: 1.3.6.1.4.1.12356.101.23.1.1

l  FORTINET-FORTIGATE-

MIB:fortinet.fnFortiGateMib.fgDhcp.fgDhcpInfo.fgDhcpServerNumber l OID: 1.3.6.1.4.1.12356.101.23.2.1.1.2 l FORTINET-FORTIGATE-

MIB:fortinet.fnFortiGateMib.fgDhcp.fgDhcpTables.fgDhcpTable.fgDhcpEntry.

fgDhcpLeaseUsage

l  Added one SNMP trap (1301) for 3 DHCP events (DHCP server runs out of IP pool, IP address is already in use, or DHCP client interface received NAK).

config firewall ssl-ssh-profile edit “custom-deep-inspection” set comment “Customizable deep inspection config ssl set inspect-all disable

end config https set ports 443

set status deep-inspection set proxy-after-tcp-handshake disable set client-certificate bypass set unsupported-ssl-cipher allow

end

next

end

config wireless-controller vap

set dhcp-option82-circuit-id-insertion style-3 <==added

next

end

config system interface edit wan1 set mode dhcp …. config client-options edit 1 set code 60 set type {hex | string | ip | fqdn}

set value|ip “xxxxxx”

next

end

next

end

config wireless-controller vap edit vap-ipv6 set ipv6-rules drop-icmp6ra drop-icmp6rs drop-llmnr6 drop-icmp6mld2 drop-dhcp6s drop-dhcp6c ndp-proxy drop-ns-dad drop-ns-nondad next

end

Interfaces list:

l  Radio buttons in the top-right corner let users switch between grouping by type, role, and sort lists alphabetically have been removed. There is a dropdown instead with the following options:

l  Group by type l Group by zone l Group by status, l Group by role l No grouping

l  Zones do not support parent-child relationships anymore.

l  The DHCP Server column has been divided into two separate columns, DHCP Clients and

l  CSF support has been added. When switching to a downstream device, both the list and the faceplate should update.

l  For VDOMs, administrators can only view complete information about interfaces for the VDOM they are in. This applies even to administrators who have access to more than one VDOM.

l  On devices that support VLAN switching, the VLAN Switch Mode toggle has been removed from the list page. It now shows up under System> Settings.

l  Faceplates do not auto-refresh on page load anymore. For auto-refresh, users need to enable the muTable refresh feature from the button in the bottom-right corner.

Interfaces dialog:

l  Under Administrative Access, CAPWAP and FortiTelemetry have been combined into one option labeled Fabric Connection.

l  The secondary IP address toggle has been moved from the Miscellaneous section to the Address section.

l  A gutter has been added that displays the device hostname, the interface it belongs to, and relevant help links.

CLI changes:

l Consolidate fortitelemetry and capwap into fabric for allowaccess in system.interface.

In the past, 802.1Q specification allowed a single VLAN header to be inserted into an Ethernet frame. This new feature allows one more VLAN tag to be inserted into a single frame.

config wireless-controller wtp-profile edit “FAPU431F-default” config platform

end set handoff-sta-thresh 30 config radio-1 set band 802.11ax-5G

set zero-wait-dfs [enable | disable] <==added, default is enable

end config radio-2 set band 802.11ax

end config radio-3 set mode monitor

end

next

end

config wireless-controller vap edit “lo-sd-cap” set ssid “local-stand-cap” set security captive-portal set external-web “https://172.18.56.163/portal/index.php” set radius-server “peap”

set local-standalone enable <==added set local-bridging enable set portal-type external-auth

next

end

This solution provides hole punching support for RFC 4787 compliant NATs that use endpoint independent mapping. For a given source IP/port, the NAT mapping observed by the hub does not change when communicating with other endpoints, such as spoke-to-spoke shortcuts.

l After setting the radio to monitor mode, the spectrum analysis tag is enabled in the FortiAP

View More Details page. The tag displays the spectrum scan results for 2.4G and 5G bands.

CLI changes: l Add get command to view spectrum data for an AP.

get wireless-controller spectral-info <wtp_id> <radio_id>

l Add exec command to start spectrum analysis.

exec wireless-controller spectral-scan <wtp_id> <radio_id> <on/off>

<duration(s)> <channels> <report-interval>

l  Add a configurable probe count as number of most recent probes to calculate latency and jitter.

l  This new option is under config system virtual-wan-link > config healthcheck > edit a health-check.

config wireless-controller apcfg-profile <==added edit [Profile Name] <==added next

end

config wireless-controller wtp-profile edit “FAP423E-default” config platform set type 423E

end

set apcfg-profile “FAP423E-apcfg” <==added

next

end

This feature is currently only applicable on FAP-W2/S models with the latest 6.4 firmware.

config wireless-controller wtp-profile edit “FAP433F-default” config platform set type 433F <==new type set ddscan enable

end set handoff-sta-thresh 55 config radio-1 set band 802.11ax,n,g-only

end config radio-2 set band 802.11ax-5G

end config radio-3 set mode monitor

next

edit “FAP431F-default” config platform set type 431F <==new type set ddscan enable

end set handoff-sta-thresh 55 config radio-1 set band 802.11ax,n,g-only

end config radio-2 set band 802.11ax-5G

end config radio-3 set mode monitor

end

next

end

config wireless-controller access-control-list <==added edit “ACL-1” config layer3-ipv4-rules edit 10 set dstaddr 172.16.200.44/255.255.255.255

end

next

end

config wireless-con edit “wifi.fap.01” set ssid

“starr-ssid.fap.01”

set access-control-list “ACL-1” <==added

next

end

config wireless-controller wtp edit “FP423E3X16000020” set admin enable set firmware-provision “6.4.0412” <==added set wtp-profile “FAP423E-default” config radio-1 end config radio-2

end

next

end

With this change, a FortiGate with a built-in disk can hold up to four versions of firmware for each FAP model instead of one as before. A FortiGate without built-in disk can hold one version as before.

config system interface edit ipsec-tunnel-1 set type tunnel set mtu-override enable/disable <==added

set mtu 1400 <==added

next

end

config system virtual-wan-link config health-check edit h1 …. set diffservcode <6-bits binary, range 000000–111111> next

next

end

The Security Fabric Settings page has been renamed to Fabric Connectors and all the settings under it now show up as separate cards. The Fabric Connectors menu entry is renamed and shows up as External Connectors.

l  Fabric Connectors is now a card view similar to External Connectors with various Fortinet products (FortiSandbox, FortiManager, Cloud Logging, etc.).

l  Every card goes to its own dialog instead of having a dialog with all the configuration settings. l CSF support is not added in this version.

l  Various statistics and connectivity results have been moved from the main dialog to the gutter to reduce clutter from the Edit dialog views.

C5d

C5n

F1

G3

G4

H1

I3

I3en

M5

M5a

M5ad M5d

M5dn

M5n

P2

R4

R5

R5a

R5ad R5d

R5dn

R5n

T3

u-6tb1.metal u-9tb1.metal u-12tb1.metal u-18tb1.metal u-24tb1.metal

X1 X1e z1d

Other web browsers may function correctly, but are not supported by Fortinet.

Other web browsers may function correctly, but are not supported by Fortinet.

Upgrade FortiManager before upgrading FortiGate.

Upgrade FortiAnalyzer before upgrading FortiGate.

l Microsoft Windows l Mac OS X l Linux

See important compatibility information in FortiClient Endpoint Telemetry license on page 46 and Fortinet Security Fabric upgrade on page 46.

FortiClient for Linux is supported on Ubuntu 16.04 and later, Red Hat 7.4 and later, and CentOS 7.4 and later.

If you are using FortiClient only for IPsec VPN or SSL VPN, FortiClient version 5.6.0 and later are supported.

(FortiLink support)

Supported models: FCTL-5103B, FCTL-5903C, FCTL-5913C

l  Windows Hyper-V Server 2019

l  ESXi versions 4.0, 4.1, 5.0, 5.1, 5.5, 6.0, 6.5, and 6.7

l Intel 82599 l Intel X540 l Intel X710/XL710

Google Chrome version 80

Mozilla Firefox version 74

Google Chrome version 80

Ubuntu 16.04 / 18.04

Mozilla Firefox version 74

Google Chrome version 80

Google Chrome

Google Chrome

Workaround: Create a new firewall policy from scratch and the default application control can be applied again.

Workaround: You can configure MMS profiles from the CLI using the config firewall mms-profile command.

“-“.

l  Added default automation rules (after factory reset). All are disabled by default, except for the FEXP push notification.

l  Added new incoming webhook trigger for automation.

l  Removed Email Alert Settings page.

l  Added new API for POST /api/v2/monitor/system/automationstitch/webhook/<trigger mkey>.

Workaround: Users with 6.0.x should upgrade to remove the sync-error or disable vlanoptimization. On a network with switch-controller.global.vlan-all-mode all

configured, the setting will revert to the default value of defined. Users who wish to maintain the vlan-all-mode all behavior may restore it after upgrading.

Affected models include: FG-60E, FG-60E-POE, FG-61E, FG-80E, FG-80E-POE, FG-81E, FG81E-POE, FG-100E, FG-100EF, FG-101E, FG-140E, FWF-60E, FWF-61E.