Federal Information Processing Standards (FIPS) certification.

To enable FIPS mode, run the following commands on the FortiAP CLI:

cfg -a FIPS_CC=1

cfg -c

To disable FIPS mode, factory reset the FortiAP.

Note: FAP-431F and FAP-433F cannot support FIPS mode.

Support WPA3-SAE security over the mesh backhaul.

On the FortiGate CLI (FortiOS 7.4.0), add one mesh-backhaul vap with security wpa3-sae, and assign it to the mesh-root FortiAP.

Note: The "Hash-to-Element (H2E) only" option is mandatory for the mesh backhaul.

On the mesh-leaf FortiAP CLI, input the following mesh settings:

cfg -a MESH_AP_TYPE=1

cfg -a MESH_AP_SSID=meshssidname

cfg -a MESH_AP_SECURITY=2

cfg -a MESH_AP_PASSWD=meshssidpassword

cfg -c

The wtp-profile of FAP-432F and 433F models can set external antenna parameters when the corresponding external antenna is installed.

On the FortiGate CLI, input the following commands:

config wireless-controller wtp-profile

edit "FAP433F"

config radio-1

set optional-antenna none | FANT-04ABGN-0606-O-R | FANT-04ABGN-0606-P-R

end

end

Support a new data-channel security option "ipsec-sn".

The FortiAP serial number is added to the initial IPsec setup message so that it can be used by a dispatcher to query the destination FortiGate. Then the FortiAP will connect to the FortiGate and encrypt the data channel with an IPsec-VPN tunnel.

Wireless bonjour-profile feature supports a new service option for Miracast.

Enable "Wi-Fi 6E" 6GHz Channels for supported regions and countries.