What's new for hyperscale firewall for FortiOS 7.6.7

This section lists the new hyperscale firewall features added to FortiOS 7.6.7:

• You may be able to reduce FGCP HA failover times by changing the the NP7 link scan interval. The NP7 link scan interval is the amount of time that a FortiGate with NP7 processors waits between scans to determine if a link has failed. A shorter NP7 link scan interval can cause the FortiGate to send gratuitous ARP packets sooner after an HA failover has occurred.

  config system npu

  set np-linkscan-interval <milliseconds>

  end

  The np-link-scan-interval range is 50 to 1000ms. The default NP7 link scan interval is 1000 milliseconds (ms). If your FGCP HA cluster experiences longer than expected HA failover delays (for example a 2-second interval for a failover to occur) reducing the NP7 link scan interval may reduce HA failover delays.

  For more information, see Changing the NP7 link scan interval to reduce HA failover delays.

• The arp-reply CLI option is now supported for IPv4 and IPv6 firewall VIPs. The arp-reply option is enabled by default and you can use the following command to disable ARP replies for a firewall VIP:

  config firewall vip

  edit new-vip

  set arp-reply disable

  end

• You can use the following commands to enable or disable VLAN accounting and change the VLAN accounting message interval:

  config system npu

  set vlan-accounting {disable | enable}

  set vlan-acct-interval <milliseconds>

  end

  For more information, see Enable or disable VLAN accounting and change the VLAN accounting interval.

• If your hyperscale firewall users are authenticated using RSSO, and you want to include their user information in hyperscale hardware log messages, you can now change the RADIUS server prefix length using the rsso-ipv6-prefix-length or rsso-ipv4-prefix-length hardware logging server group options. For more information, see Hardware logging server groups and Include user information in hardware log messages.