In wids-profile, add the new ap-scan-threshold setting, which is the minimum signal level of rogue APs detected and required by the managed FortiAP devices. Only the rogue APs with a signal level higher than the threshold will be reported to the FortiGate WiFi Controller.

config wireless-controller wids-profile
    edit <WIDS-profile-name>
        set ap-scan enable
        set ap-scan-threshold "-80"
    next
end

The range of ap-scan-threshold, in dBm, is -95 to -20 (default = -90).

Under Administrative Access, CAPWAP and FortiTelemetry have been combined into one option labeled Fabric Connection. If either CAPWAP or FortiTelemetry were enabled on a particular interface, the new fabric option will be enabled after upgrading.

FortiGate support for NSX-T v2.4: East/West traffic.

Add support for EMS cloud:

• Added CMDB attribute fortinet-one-cloud-authentication to FortiClient EMS table.
• Added curl verbose diagnosis debugs to FortiClient NAC daemon for debug images.
• Added fortiems-cloud option to type attribute in user.fsso table.

Add support for tracking number of hits to a policy route:

• Policy route hit counter and last used tag added to each policy displayed in diagnose firewall proute list command.
• New CLI command diagnose firewall proute show, displays policy route hit counter and last used for a given proute id, (if 0, dumps all).
• New CLI command diagnose firewall proute clear, clears policy route hit counter and last used for a given proute id, (if 0, clears all).

Change public IP and routing table entries allocated in different resource groups in Azure HA.

In an Azure HA scenario, the EIP and route table to fail over is specified in the SDN connector configuration. A new attribute, resource-group, is added to allow customers to specify the resource group that a EIP or route table is from. This new attribute can be empty so upgrade code is not needed.

If the resource-group of the EIP or route table is not provided, it is assumed the resource comes from the same resource group as the SDN connector setting (if it is not set there, assume the same resource group as the FortiGate itself by getting it from the instance metadata).

Limit OCVPN spoke to only join existing overlay.

DPDK support on FortiOS VM platform.

Add support for additional SHA-2 algorithms with SNMPv3.

Update interface-related pages to use AngularJS and muTable.

Interfaces list:

• Radio buttons in the top-right corner let users switch between grouping by type, role, and sort lists alphabetically have been removed. There is a dropdown instead with the following options:
  • Group by type
  • Group by zone
  • Group by status,
  • Group by role
  • No grouping
• Zones do not support parent-child relationships anymore.
• The DHCP Server column has been divided into two separate columns, DHCP Clients and DHCP Ranges.
• CSF support has been added. When switching to a downstream device, both the list and the faceplate should update.
• For VDOMs, administrators can only view complete information about interfaces for the VDOM they are in. This applies even to administrators who have access to more than one VDOM.
• On devices that support VLAN switching, the VLAN Switch Mode toggle has been removed from the list page. It now shows up under System> Settings.
• Faceplates do not auto-refresh on page load anymore. For auto-refresh, users need to enable the muTable refresh feature from the button in the bottom-right corner.

Interfaces dialog:

• Under Administrative Access, CAPWAP and FortiTelemetry have been combined into one option labeled Fabric Connection.
• The secondary IP address toggle has been moved from the Miscellaneous section to the Address section.
• A gutter has been added that displays the device hostname, the interface it belongs to, and relevant help links.

CLI changes:

• Consolidate fortitelemetry and capwap into fabric for allowaccess in system.interface.