What's new

The following sections describe new features, enhancements, and changes in FortiProxy 7.4.12:

• Multi-condition support for proxy addresses and address groups

• Logging for license sharing events

• CLI changes

Multi-condition support for proxy addresses and address groups

When configuring proxy addresses and address groups, you can now specify multiple addresses or address groups and configure the AND/OR relationship among them, The addresses or address groups can then be used in firewall policies.

For example, you can now specify multiple addresses: A, B, C, D and configure them as "A AND B) OR (C AND D" using the following:

config firewall proxy-addrgrp

edit "A_and_B"

set logic-type and

set member "A" "B"

next

edit "C_and_D"

set logic-type and

set member "C" "D"

next

end

config firewall policy

ed 1

set dstaddr A_and_B C_and_D

...

next

end

Logging for license sharing events

FortiProxy 7.4.12 adds logging for the following license sharing events:

• When a member becomes stale and recovers from stale status, the event is recorded on the root node.

• When a member node is promoted as root or reverts back as a member, the event is recorded on the member node.

• When the effective root node changes, the event is recorded on each member node.

See the License Sharing Deployment Guide for more details.

CLI changes

FortiProxy 7.4.12 includes the following CLI changes:

• config web-proxy global—Use the new set policy-partial-match subcommand to enable/disable policy partial match. The default is enable.

• config firewall profile-protocol-options—The set domain-fronting sub-command includes the new strict option to block and log domain fronting, including potential matching IP and domain. This option is different from the block option which blocks and logs domain fronting but not potential matching IP and domain.