Whatʼs new

The following sections describe the new features and enhancements.

Disabling the IP-based URL rating

You can now enable or disable IP-based URL rating for the SSL/SSH protocol with the following commands:

config firewall ssl-ssh-profile

edit <profile_name>

set ssl-exemption-ip-rating {enable| disable}

next

end

By default, the IP-based URL rating for the SSL/SSH protocol is enabled.

You can now enable or disable the IP-based URL rating for proxy addresses with the following commands:

config firewall profile-protocol-options

edit <name>

config http

set address-ip-rating enable/disable [default:enable]

end

next

end

By default, the IP-based URL rating for proxy addresses is enabled.

Enabling or disabling reverse DNS lookup

You can now control whether a reverse DNS lookup is performed for policy matching. By default, using reverse DNS lookup is enabled. Use the following commands to change this option:

config firewall profile-protocol-options

edit <name_of_profile>

config http

set verify-dns-for-policy-matching {enable | disable}

end

next

end

New default value for tcp-window-type under config firewall profile-protocol-options

Under config firewall profile-protocol-options, when configuring HTTP, FTP, SSH, and CIFS, the set tcp-window-type option has the following changes:

• New value option auto-tuning, which allows the system to automatically tune the TCP window size. When memory usage reaches the threshold of 80%, FortiProxy automatically changes the value to system to protect memory usage.

• Default value is changed from system to auto-tuning.