The policy-category-deep-inspect command has been removed and replaced with https-sub-category.

Removed:

config web-proxy global
    set policy-category-deep-inspect {enable | disable}
end

Added:

config firewall proxy-policy
      edit <id>
        set https-sub-category {enable | disable}
    next
end

Starting in FortiOS 7.2.1, FortiGate (when web proxy is configured) implicitly enforces deep inspection if an HTTP CONNECT request or TLS SNI partially matches a policy with deep inspection enabled.

To retain legacy behavior for category-based proxy addresses (FortiGuard URL categories), disable https-sub-category after upgrading to FortiOS 7.6.3 or later.

The config system autoupdate tunneling command has been removed and replaced with config system fortiguard.

Removed:

config system autoupdate tunneling
    set address <proxy_address>
    set port <proxy_port>
    set username <username>
    set password <password>
    set status {enable | disable}
end

Added:

config system fortiguard
    set proxy-server-ip <proxy_address>
    set proxy-server-port <proxy_port>
    set proxy-username <username>
    set proxy-password <password>
end

Add sta-offline-ip2mac-cleanup and sta-offline-cleanup in wireless timers:

config wireless-controller timers
    set sta-offline-ip2mac-cleanup 300
    set sta-offline-cleanup 300
end

Add max-sta-offline-ip2mac and max-sta-offline in wireless global:

config wireless-controller global
    set max-sta-offline-ip2mac 1024
    set max-sta-offline 1024
end

Allow adding expiry as an option for generating an API-user key.

# execute api-user generate-key <API username> [expiry in mins]

Increase the maximum IPS signature hold time from 7 days to 21 days.

The hyperscale firewall command config firewall ippool_grp has been changed to config firewall ippool-grp.

Add an option to control whether webfilter.urlfilter simple-type entries match subdomains.

config webfilter urlfilter
    edit <id>
        set include-subdomains {enable/disable} 
    next
end