FortiOS 7.6.5 release notes

The setup wizard can configure a gateway for FortiCare connectivity and accepts offline license-file uploads in air-gapped environments.

Tooltips include a button to view all insights and controls to hide individual insights while retaining an indication that insights are hidden.

FortiAP devices can be managed over IPv6, improving integration and scalability in IPv6-based networks.

When available, FortiAIOps collects radio data through REST APIs and recommends channels to reduce Wi-Fi interference.

Client mode on FWF G-series models supports WPA2/WPA3-Enterprise and WPA3-SAE.

FortiAPs can automatically request certificates from EST or SCEP servers configured in the WTP profile, replacing manual CA uploads through TFTP and simplifying renewal.

Multi-Link Operation permits simultaneous transmission over 2.4, 5, and 6 GHz bands.

Mesh leaf FAP settings can be configured directly through the GUI.

An AP newer than the running FortiOS release is classified as FAP MVP, a generic Wi-Fi 7 2x2 dual-band profile providing limited management and visibility until FortiOS is upgraded to a release that fully supports the model.

The AP can receive LoRaWAN sensor data and securely forward it to supported network servers while also operating as a Wi-Fi access point.

802.1X can be enabled on virtual switches within a software switch when `intra-switch-policy` is set to `explicit`, enabling dynamic VLAN and traffic controls.

When Resolved hostnames is enabled under Log Settings, On log creation (`resolve-ip`) adds the resolved hostname as `dstname`, while When viewed (`resolve-hosts`) resolves destination addresses when logs are fetched. If both are enabled through CLI, On log creation takes precedence.

Denied sessions can be offloaded to NP7 processors to reduce CPU load using `config system npu set session-denied-offload {enable | disable} end`.

Administrators can control whether delegated-prefix domains are included in Router Advertisement DNSSL options using `config ip6-delegated-prefix-list edit <id> set dnssl-service {enable | disable} next end`.

FQDN address groups within the Internet Service Database can be applied to NGFW policies as well as firewall policies.

Passive learning is enabled by default and can be overridden using `config firewall address edit <address> set passive-fqdn-learning {disable | enable} next end`.

IPv6 is supported for HTTP and TWAMP SD-WAN health checks, and `probe-response` is available in interface `ip6-allowaccess`. Example: `config system sdwan config health-check edit "ipv6_test" set addr-mode ipv6 set server 2000:172:16:200::1 set protocol twamp next end end`. The responder can be enabled with `config system interface edit "port3" config ipv6 set ip6-address 2000:172:16:200::1/64 set ip6-allowaccess ping https ssh probe-response end next end config system probe-response set mode twamp end`.

Scheduled speed-test results can automatically update interface inbound and outbound bandwidth for QoS while respecting configured minimum and maximum values. FTNT_Auto is used when no cloud server group is specified, and failed cloud tests are retried.

Recurring firewall schedules can select a three-hour labeled window, with speed-test start randomized within it, using `config firewall schedule recurring edit <name> set label-day <none | over-night | early-morning | morning | midday | afternoon | evening | night | late-night> next end`. Retry behavior is configured with `config system speed-test-schedule edit "port1" set retries <value> set retry-pause <value> next end`. A preferred cloud server group can be selected with `config system speed-test-schedule edit "port1" set server-name <server group name> next end`.

A hub can detect a spoke receiving no SLA probes for a configurable duration and mark its routes for suppression. A BGP outbound route map can match suppression state and adjust MED to steer traffic through another hub. Relevant controls include `set update-bgp-route {enable | disable}` under the SD-WAN health check and `set match-suppress enable` in a route-map rule.

FortiGate models with 2 GB RAM can again use proxy-based inspection for SMTP/SMTPS, POP3/POP3S, IMAP/IMAPS, and NNTP services in firewall policies.

Configure the timeout from 30 to 180 seconds using `config antivirus profile edit <name> set fortisandbox-scan-timeout <30-180> next end`.

Newly supported MIB fields are `fgFwIppStatsFreePBAs`, `fgFwIppStatsInusePBAs`, `fgFwIppStatsTotalPBAs`, `fgFwIppStatsInuseIPs`, and `fgFwIppStatsFreeIPs`.

Federated upgrade reporting now identifies each failed device and its specific failure reason.

FortiSASE Sovereign licensing bundles are supported on FortiGate 91G and 901G. Enabling `config system sov-sase set status enable end` makes the FortiGate GUI and CLI read-only; subsequent configuration changes are managed from the FortiSASE-Sovereign Portal.

On affected systems, the router daemon starts only when routing configuration exists, NP-reserved memory is reduced, and nTurbo maximum frame size is 1500. Interfaces with a higher MTU are not offloaded to nTurbo. Affected 2 GB families are 40F, 60F, and 50G; affected 4 GB families are 70F, 80F, and 70G.

Supported TPM/NVMe models such as FG-700G can upload black-box logs using `diagnose debug black-box upload scp <destination string> <yyyymmdd>` or `diagnose debug black-box upload sftp <destination ip> <user> <pwd> <dst folder> <yyyymmdd>`.

The management interface supports hybrid post-quantum key exchange and PQC certificates while retaining compatibility with clients that do not support PQC.

The sign-on URL timeout can be set from 30 to 3600 seconds using `config web-proxy global set auth-sign-timeout <30-3600> end`, giving clients more time to reach the identity provider.

New CLI options allow pure and hybrid PQC algorithms for Agentless VPN.

Flow-mode SSL deep inspection supports TLS 1.3 hybrid post-quantum key exchanges such as X25519MLKEM768 for compatibility with modern browsers and PQC-enabled servers.

Configure port 443 using `config system settings set ike-port 443 end`.

During 802.1X authentication, Filter-ID can map clients to existing user groups and create WSSO firewall authentication entries so the appropriate firewall policy applies without another login.

Default soft-switch interfaces and open SSIDs are removed across FortiWiFi platforms. On 4xF, 6xF, and G-series models, the default WiFi VAP remains in tunnel mode with preconfigured IP, DHCP, and firewall policies. On 8xF-2R models, VAPs use bridge mode with the hardware switch, receive DHCP from the internal interface, and are controlled by firewall policy.

FWF models broadcast a temporary unique MAC-based SSID for only five minutes after first power-up instead of a static default SSID. Initial login requires an administrator password change and launches a WiFi Setup Wizard to customize or disable WiFi.

For CLI-created Phase 1 and Phase 2 tunnels, the defaults change from DH groups 14 and 5 to groups 20 and 21. During upgrade, VPNs using the prior defaults are updated to groups 14, 20, and 21.

On NP7 systems, `vlan-lookup-cache` defaults to disabled and `htab-msg-queue` defaults to dedicated: `config system npu set vlan-lookup-cache disable set htab-msg-queue dedicated end`. Changing `vlan-lookup-cache` requires a system restart.

With `asymroute-icmp` or `asymroute6-icmp` enabled, replies are no longer required to use the arrival interface. If no return route exists through that interface, FortiOS selects the best available route. Settings: `config system settings set asymroute-icmp {enable | disable} set asymroute6-icmp {enable | disable} end`.

When `auth-ike-saml-port` is used, iprope matches local-in traffic only if the destination port equals `auth-ike-saml-port` and the destination interface has `ike-saml-server` enabled.

On affected two-WAN-port models, both WAN ports default to DHCP, an SD-WAN zone is created with both ports, the default firewall policy uses that zone, and an SLA tests 1.1.1.1 and 9.9.9.9. Affected families are 6xE, 6xF, 7xF, 7xG, 8xE, 8xF, 9xE, 9xG, 10xE, 100EF, 10xF, 12xG, 140E, 20xE, and 20xF, where x can be 0 or 1.

The default FortiGuard package update schedule changes from automatic to daily.

IPv4 and IPv6 high session-quota thresholds now default to 64000 and low thresholds to 51200. Relevant controls are `config system npu set ipv6-prefix-session-quota {disable | enable} set ipv6-prefix-session-quota-high <high-threshold> set ipv6-prefix-session-quota-low <low-threshold> set ipv4-session-quota {disable | enable} set ipv4-session-quota-high <high-threshold> set ipv4-session-quota-low <low-threshold> end`.

New tunnel-mode SSIDs no longer enable quarantine by default, avoiding automatic creation of unused quarantine VLANs.

The `fgFwIppStatsExpiringPBAs` SNMP field is not supported by FortiOS 7.6.5.