The IoT Detection service, which includes IoT Detection Definitions (APDB) and the IoT Query service (IOTH), is merged into the Attack Surface Security Rating service (FGSA).

Support enabling one-arm sniffer mode on mirrored ports (RSPAN or ESPAN) between a FortiSwitch port and a FortiGate VLAN interface. Prior to this change, one-arm sniffer mode could only be applied to physical interfaces. After this change, it can be applied to VLAN, VXLAN, and GRE interfaces.

When creating a new wtp-profile entry, automatically set channel-bonding 40 MHz for 5 GHz radios, and to 160 MHz for 6 GHz radios (FortiWiFi 60E models only).

Support five-digit build numbers for the IPS engine instead of the previous three-digit major/minor version number. When the FortiGate extracts the IPS engine binary, it will now be able to extract IPS engine versions in the five-digit object ID format. Displaying the engine version remains the same in the GUI and CLI, as it already displays the minor version in the five-digit format.

Reposition PSIRT related packages and functionality from the Security Rating entitlement into the Firmware entitlement. This allows more customers with the basic Firmware entitlement to have access to the latest PSIRT package updates, which can be run under Security Fabric > Security Rating > Security Posture checks.

Update SSL VPN default behavior and visibility in the GUI:

• By default, disable and hide SSL VPN web mode settings from the GUI and the CLI.
• By default, hide the SSL VPN tunnel mode settings and the VPN > SSL-VPN menus from the GUI.
• Divide the CLI configuration settings for VPN GUI feature visibility into IPsec (set gui-vpn under config system settings) and SSL VPN (set gui-sslvpn under config system settings), where IPsec is still enabled by default and SSL VPN is now disabled by default.
• Add warning messages in the GUI on the VPN > SSL-VPN Settings page under the SSL-VPN status and Authentication/Portal Mapping fields when SSL VPN tunnel or web mode are enabled.
• Add a new check on the Security Fabric > Security Rating page called Disable SSL-VPN Settings. This check fails whenever SSL VPN is enabled.

To enable SSL VPN web mode:

config system global
    set sslvpn-web-mode enable
end

To enable VPN > SSL-VPN menus in the GUI:

config system settings
    set gui-sslvpn enable
end

If SSL VPN web mode and tunnel mode were configured in a FortiOS version prior to upgrading to FortiOS 7.4.1 and later, then the VPN > SSL-VPN menus and SSL VPN web mode settings remain visible in the GUI.

In FortiOS, alternative remote access solutions are IPsec VPN and ZTNA.