Changes in default behavior

Bug ID	Description
780568	Introduce CLI/WAD learn check for the same `url-map` among HTTPS, TCP forwarding, and SAML SP API gateway entities. Before this change, the same `url-map` was allowed with different services. After this change, API gateway with the same `url-map` are not allowed under the same host (including empty vhosts). If there is already a certain `url-map` configured in previous API gateways, under a certain vhost, then no more API gateways with the same `url-map` can be added under the same vhost. Users will get an error message stating this action is not allowed.
798427	The following enhancements have been added to the Top FortiSandbox Files FortiView monitor: PDF reports are downloaded on-demand. By default, only 10 are kept in memory. PDFs are deleted from memory after 24 hours.
819937	For new firewall policies with a deny action, `set match-vip` is enabled by default. When upgrading from a previous version, existing policy settings for `match-vip` are preserved.
829458	Remove the `allow-quic` option from the `options` setting under `config application list`. The QUIC option is also removed from the Application Sensor configuration page in the GUI. Since HTTP3 over QUIC is fully supported by FortiOS, blocking QUIC by default in the application control profile is no longer necessary.
829544	Remove the maintainer account (which allowed users to log in through the console after a hard reboot). Users who lose their password must have physical access to the FortiGate and perform a TFTP restore of the firmware in order to regain access to the FortiGate.
837048	In the following scenarios, creating a matching address object for an interface is enabled automatically and cannot be disabled: When creating a new interface with the LAN role. When an interface role is changed from a non-LAN role to a LAN role. Once the address object is created, it cannot be deleted unless the interface role is changed to a non-LAN role.

Bug ID

Description

780568

Introduce CLI/WAD learn check for the same url-map among HTTPS, TCP forwarding, and SAML SP API gateway entities.

Before this change, the same url-map was allowed with different services. After this change, API gateway with the same url-map are not allowed under the same host (including empty vhosts).

If there is already a certain url-map configured in previous API gateways, under a certain vhost, then no more API gateways with the same url-map can be added under the same vhost. Users will get an error message stating this action is not allowed.

798427

The following enhancements have been added to the Top FortiSandbox Files FortiView monitor:

PDF reports are downloaded on-demand. By default, only 10 are kept in memory.
PDFs are deleted from memory after 24 hours.

819937

For new firewall policies with a deny action, set match-vip is enabled by default. When upgrading from a previous version, existing policy settings for match-vip are preserved.

829458

Remove the allow-quic option from the options setting under config application list. The QUIC option is also removed from the Application Sensor configuration page in the GUI. Since HTTP3 over QUIC is fully supported by FortiOS, blocking QUIC by default in the application control profile is no longer necessary.

829544

Remove the maintainer account (which allowed users to log in through the console after a hard reboot). Users who lose their password must have physical access to the FortiGate and perform a TFTP restore of the firmware in order to regain access to the FortiGate.

837048

In the following scenarios, creating a matching address object for an interface is enabled automatically and cannot be disabled:

When creating a new interface with the LAN role.
When an interface role is changed from a non-LAN role to a LAN role.

Once the address object is created, it cannot be deleted unless the interface role is changed to a non-LAN role.

FortiOS Release Notes

Changes in default behavior

Changes in default behavior

Changes in default behavior