Add web-mode-snat setting in config vpn ssl settings to enable/disable the use of IP pools defined in a firewall policy while using web mode. This setting is disabled by default.

config vpn ssl settings
    set web-mode-snat {enable | disable}
end

When enabled, the IP pools should be added as secondary IPs in the SSL VPN interface.

On FortiGates that support hyperscale firewall features, the following command has been changed to allow using a link aggregation group (LAG) as the HA hardware session synchronization interface.

config system ha
    set hw-session-sync-dev <interface>
end

The LAG members can be any data interfaces that can be used as hardware session synchronization interfaces and can be added to LAGs. Limitations vary among FortiGate models. For example, the FG-1800F and FG-1801F can only use port25 to port40 interfaces as hardware session synchronization interfaces. On the FG-4200F, FG-4201F, FG-4400F, and FG-4401F HA1, HA2, AUX1, and AUX2 interfaces cannot be added to a LAG.

Add auth-timeout setting in config wireless-controller timers to configure the waiting time after which a wireless client is considered to fail RADIUS authentication and times out (in seconds, 5 - 30, default = 5).

config wireless-controller timers
    set auth-timeout <integer>
end

For webhook, aws-lambda, azure-function, google-cloud-function, and alicloud-function automation actions, change the headers attribute to a http-headers configurable subtable (instead of a PARSE_F_MEMBER attribute) so the subtable entries are a key-value pair that can be variable sized strings.

config system automation-action
    edit <name>
        set action-type {webhook | aws-lambda | azure-function | google-cloud-function | alicloud-function}
        config http-headers
            edit 1
                set key <string>
                set value <string>
            next
            edit 2
                set key <string>
                set value <string>
            next
        end
    next
end