Change ZTNA firewall vip6 option from arp-reply to ndp-reply.

config firewall vip6
    edit "test"
        set mappedip <IPv6_address>
        set ndp-reply {enable | disable}
    next
end

Add command that allows users to switch between high-speed modem (USB 2.0, option 0) and super-speed modem (USB 3.0, option 1) operation mode.

# execute lte-modem set-usb-mode {0 | 1}

Add shaping-stats option under config system npu to enable/disable NP7 traffic shaping statistics.

config system npu
    set shaping-stats {enable | disable}
end

Add command to collect FortiLink-related data in the FortiGate debug report.

# diagnose debug fortilink-report {all | switch-id | switch-group}

Add syslog-affinity option to set the CPU mask for syslogd and its child process.

config system global
    set syslog-affinity <string>
end

Add cert-probe-failure option to allow/block the SSL-SSH profile deep inspection based on the certificate probe failure.

config firewall ssl-ssh-profile
    edit <name>
        config ssl
            set inspect-all deep-inspection
            set cert-probe-failure {allow | block}
        end
    next
end

Add option for the unknown ESP packets detection feature (default = enable).

config system settings
    set detect-unknown-esp {enable | disable}
end

Add diagnostic command to show the statistics of the SD-WAN peer' remote health checks.

# diagnose system sdwan health-check remote <name> <seq_num>

Add srcaddr6/dstaddr6 negate option in security policy configuration.

config firewall security-policy
    set dstaddr6-negate {enable | disable}
    set srcaddr6-negate {enable | disable}
end

Add restart option in the execute federated-upgrade command, which adds the ability to fail the multi-version upgrade in the event of a syntax error during the upgrade, and allows users to restart the currently configured upgrade through the CLI.

Move unknown-content-encoding option from antivirus profile to firewall profile-protocol-options.

config firewall profile-protocol-options
    edit <name>
        config http
            set unknown-content-encoding {block | inspect | bypass}
        end
    next
end