In scenarios where the FortiGate is sandwiched by load-balancers and SSL processing is offloaded on the external load-balancers, the FortiGate can perform scanning on the unencrypted traffic by specifying the ssl-offloaded option in firewall profile-protocol-options. Previously, this was only supported in proxy mode. Now it is supported in proxy and flow mode.

Add interface selection for IPS TLS protocol active probing.

config ips global
    config tls-active-probe
        set interface-selection-method {auto | sdwan | specify}
        set interface <interface>
        set vdom <VDOM>
        set source-ip <IPv4 address>
        set source-ip6 <IPv6 address>
    end
end

When creating a Cisco ACI direct connector, configuring multiple IPs allows the FortiGate to connect to the server in a round-robin fashion. Only one server will be active, and the remaining IPs will serve as backups if the active one fails.

The route-tag is a mechanism to map a BGP community string to a specific tag. The string may correspond to a specific network that a BGP router advertised. With this tag, an SD-WAN service rule can be used to define specific traffic handling to that network. IPv6 route tags are now supported.

Provide specific SNMP objects (OIDs) that allow the status of the mobile network connection to be monitored.

When enabling the Security Fabric on the root FortiGate, the following FortiAnalyzer GUI behavior has changed:

• If a FortiAnalyzer appliance is enabled, then the dialog will be for the FortiAnalyzer connector.
• If a FortiAnalyzer appliance is disabled but FortiAnalyzer Cloud is enabled, then the dialog will be for the Cloud Logging connector.
• If neither the FortiAnalyzer appliance or FortiAnalyzer Cloud are enabled:
  • If the device has a FAZC (standard FortiAnalyzer Cloud subscription) or AFAC (premium subscription) entitlement, then the dialog will be for the Cloud Logging connector.
  • If the device does not have a FAZC or AFAC entitlement, then the dialog will be for the FortiAnalyzer connector.
• When FortiAnalyzer Cloud is enabled and the FortiAnalyzer appliance is disabled, then the Cloud Logging connector will not let you switch to the FortiGate Cloud FortiAnalyzer.

Add object synchronization improvements:

• Simplify the conflict resolution procedure so a multi-step wizard is no longer required. All conflicts appear in one table for all FortiGates in the Fabric and supported tables.
• Add an object diff feature to display the difference between FortiGate objects that are in conflict.
• Add new CLI command for the root FortiGate:

  config system csf
      set fabric-object-unification {default | local}
  end

  When set to default, objects will be synchronized in the Security Fabric. On downstream FortiGates, if configuration-sync is set to local, the synchronized objects from the root to downstream FortiGates is not applied locally. However, the device will still send the configuration to lower FortiGates.

• The fabric-object {enable | disable} command was added to the following tables:

  • firewall.address
  • firewall.address6
  • firewall.addrgrp
  • firewall.addrgrp6
  • firewall.service.category
  • firewall.service.group
  • firewall.service.custom
  • firewall.schedule.group
  • firewall.schedule.onetime
  • firewall.schedule.recurring

  Enabling fabric-object on the root starts synchronizing this object as a Fabric object to downstream devices. Disabling fabric-object makes the object local to the device.

• Add setting to define how many task worker process are created to handle synchronizations (1 - 4, default = 2). The worker processes dies if there is no task to perform after 60 seconds.

  config system csf
      set fabric-workers <integer>
  end

Add option to switch between Peer and Peer Group view on PKI user page.

Add support for OCI IMDSv2 that offers increased security for accessing instance metadata compared to IMDSv1. IMDSv2 is used in OCI SDN connectors and during instance deployments with bootstrap metadata.

FortiGates with a premium subscription (AFAC contract) for cloud-based central logging and analytics are able to send traffic logs to FortiAnalyzer Cloud, in addition to UTM logs and event logs. FortiGates with a standard FortiAnalyzer Cloud subscription (FAZC contract) can send UTM and event logs only.