On a FortiGate with hyperscale firewall enabled, using the tcp-timeout-profile or udp-timeout-profile options of the config system npu command to create TCP or UDP timer profiles and then add them to hyperscale firewall policies using the tcp-timeout-pid or udp-timeout-pid firewall policy options may not work as intended.

In FortiOS 7.4.4 tcp-timeout-profile and udp-timeout-profile are now hidden and Fortinet recommends using config system global options such as the following to set TCP and UDP timers:

config system global
    set early-tcp-npu-session
    set reset-sessionless-tcp
    set tcp-halfclose-timer
    set tcp-halfopen-timer
    set tcp-option
    set tcp-rst-timer
    set tcp-timewait-timer
    set udp-idle-timer
end

If you have used tcp-timeout-pid or udp-timeout-pid to add profiles to hyperscale firewall policies, this configuration will still work the same after upgrading to FortiOS 7.4.4 and the profiles that you have added will still be there, but all this configuration will be hidden. To stop using these TCP timeout profiles you can unset the tcp-timeout-pid or udp-timeout-pid firewall policy options.

The ssh-xxx-algo commands have been moved from the config system global setting to the config system ssh-config setting.

7.4.3 and earlier:

config system global
    set ssh-enc-algo
    set ssh-hsk-algo
    set ssh-kex-algo
    set ssh-mac-algo
end

7.4.4 and later:

config system ssh-config
    set ssh-enc-algo
    set ssh-hsk-algo
    set ssh-kex-algo
    set ssh-mac-algo
end

The captive portal is now an independent setting and separated from the wireless authentication methods.

7.4.3 and earlier:

config wireless-controller vap
    edit <name>
        set security {captive portal | wpa-personal+captive+portal | wpaonly-personal+captive-portal | wpa2-onlyu-personal+captive-portal}
    next
end

7.4.4 and later:

config wireless-controller vap
    edit <name>
        set security {open | wpa-personal | wpa2-only-personal | wpa3-sae | wpa3-sae-transition | owe}
    next
end

Captive portal is disabled when security mode is wpa2-enterprise/wpa3-enterprise/OSEN.

Removed the set security-rating-result-submission setting under system.global.

The diagnose sys sdwan service command is now divided into two separate commands for IPv4 and IPv6.

IPv4:

diagnose sys sdwan service4

IPv6:

diagnose sys sdwan service6