Changes in default behavior
|
Bug ID |
Description |
|---|---|
|
1176942 |
When auth-ike-saml-port is used, iprope will match the local-in traffic only when the destination port is `auth-ike-saml-port` and the destination interface has `ike-saml-server` enabled. |
|
1204277 |
The default auto-update schedule for FortiGuard packages has been changed from automatic to daily. |
|
1207557 |
The default behavior has changed: when Anycast is enabled, VM license activation now uses dedicated activation FQDNs (vmactivation1/2/3.fortinet.net) instead of general update FQDNs, resulting in faster and more reliable activation. |
|
1225202 |
The default setting for allow-traffic-redirect and ipv6-allow-traffic-redirect has been changed from enable to disable: config system global
set allow-traffic-redirect disable
set ipv6-allow-traffic-redirect disable
end
Upon upgrade, both of these settings will be changed to disable even if they were enabled before. Disabling this setting ensures that traffic arriving at an interface and redirected out on the same interface requires a firewall policy to explicitly allow the traffic. If you want to redirect traffic without the need for a policy based only on routing decision, then manually enable these settings. |