FortiOS 7.6.6 release notes

Adds NP7 VLAN accounting controls under `config system npu`: `set vlan-accounting {disable | enable}`. Accounting is enabled by default. The interval can be adjusted with `set vlan-acct-interval <milliseconds>`; default 200 ms, range 100–10000 ms. Increasing the interval can reduce SPV/TPV messages, CG-FULL conditions, and packet drops on busy systems with many VLANs.

Adds `config system npu` / `set np-linkscan-interval <milliseconds>` to tune NP7 link-failure scanning. Range is 50–1000 ms and default is 1000 ms. A shorter interval may reduce FGCP HA failover delay by causing gratuitous ARP transmission sooner.

Adds driver-level NPU offload for IPsec over VNE interfaces on SoC5/NP7Lite and NP7 platforms, improving performance and throughput.

Adds a searchable and exportable GUI panel listing third-party software, licenses, license terms, and version information.

Administrators can manually upgrade or downgrade through the GUI or CLI during the seven-day setup period. Device registration is required afterward.

Adds full-cone NAT/Endpoint Independent Filtering controls under `config system npu`: `set eif-tcp-refresh-dir {both | outgoing | incoming}`, `set eif-udp-refresh-dir {both | outgoing | incoming}`, `set eif-tcp-ttl <time>`, `set eif-udp-ttl <time>`, `set extra-timeout-tcp <time>`, and `set extra-timeout-udp <time>`.

Hyperscale hardware logging can include RADIUS server prefix lengths using `set rsso-ipv6-prefix-length <length>` and `set rsso-ipv4-prefix-length <length>` in an NPU log server group. Defaults are 64 for IPv6 and 32 for IPv4.

Adds channels 1 through 93 in the 6 GHz range for all G and K platforms in the Ukraine-U region.

Adds global switch-controller configuration of trunk port-selection criteria on Marvell platforms, replacing the previous per-trunk approach.

Allows Dynamic VLAN and VLAN Pooling to be enabled simultaneously on a RADIUS-authenticated VAP. A RADIUS VLAN assignment is used when supplied; otherwise the local VLAN pool provides the assignment.

Allows multiple WTP groups to be selected when creating a VLAN entry in WTP group mode.

Enables MultiLink Operation on local standalone VAPs for FortiAPK models, with authentication performed directly on the FortiAP.

Adds external active GNSS antenna support for FWF50G5G to improve GPS reception, accuracy, and reliability.

Adds a strict reverse-path-style source verification option under `config system settings`: `set src-check-reply {enable | disable}`. The default is disabled.

Allows SCIM groups to be used directly in firewall policies without local group mapping. IPsec VPN authorization can also match certificate SAN fields against SCIM user attributes.

Adds the default Firmware Upgrade Complete automation stitch, Auto Firmware Upgrade Complete trigger, and Auto Upgrade Complete Email Notification action. Firmware-upgrade email text is clarified.

Adds WebSocket inspection for UTM modules including DLP, antivirus, IPS, and File Filter, allowing detection and blocking of sensitive data, malware, and restricted files sent over WebSocket.

Allows administrators to select any combination of DHCP Option 82 suboptions and define a custom delimiter, replacing the previous three fixed, non-editable styles.

Models that require registration for full access now allow seven days of full GUI and CLI configuration before registration becomes mandatory.

Adds GUI support for monitoring 5G modem status and performing modem firmware upgrades.

Enhances FCPC to accept a ForcedUpdate flag and major.minor.patch-build versioning. If a FortiGate detects an invalid firmware license, FortiGuard may ignore the license check and permit an update when source and target major/minor versions match. Logs, notifications, and automation messages now more clearly distinguish automatic and required upgrades.

Preserves per-member SNMP location, description, and contact information so individual HA members can be identified in monitoring systems, including members at different sites.

Adds Connectivity Fault Management support on FortiGate G-series platforms for diagnosing and troubleshooting Ethernet network faults.

On NP7Lite/SoC5 systems, `config system npu` / `set mcs-auto-start enable` automatically flushes or reinstalls affected IPsec SAs and clears offloaded sessions after changes to outbandwidth or egress shaping profiles. It is disabled by default.

Native remote-access VPN wizard configurations work out of the box on supported operating systems. Defaults use L2TP over IPsec for Windows, Android, macOS, and iOS; IKEv2 can be configured for Windows and Android.

Distributes encrypted traffic across multiple sub-tunnels and CPU queues to use multiple CPU cores. Enable under `config vpn ipsec phase1-interface` with `set multipath <integer>`.

Allows an unaddressed IPsec tunnel to act as a PIM interface by borrowing a loopback address. Under `config router multicast` and the tunnel interface, configure `set update-source "lo1"`.

Adds `config authentication setting` / `set ems-root-ca {enable | disable}`. The default is enabled. When disabled, WAD validates the client certificate using the configured user CA instead of the EMS root CA.

The CLI prompt dynamically includes `Primary` or `Secondary`, for example `FortiGate(Secondary) (global) #`. This changes the prompt format and can break Ansible or other automation that expects a fixed pattern.

When Anycast is enabled, VM license activation uses `vmactivation1.fortinet.net`, `vmactivation2.fortinet.net`, and `vmactivation3.fortinet.net` instead of general update FQDNs. Firewall and DNS allowlists may need updating.

The dedicated host queue and `dedicated-management-cpu` are enabled by default; the NP7 DSWH profile is changed; the driver no longer returns `e_busy` under intense retry; and regular host queues drop packets at DSWH under extreme load instead of applying backpressure to DSW. Disabling the dedicated management CPU may maximize CPS performance.

GovRamp mode now defaults after factory reset to `ntp1.fortinetgov.com` at 23.249.63.60/23.249.63.61 and `ntp2.fortinetgov.com` at 23.249.63.62/23.249.63.63. Previous defaults were `time-a-g.nist.gov` at 129.6.15.28 and `time-b-g.nist.gov` at 129.6.15.29.

NGFW policy-mode VDOMs now drop traffic when IPS sockets are unavailable, including during boot, IPS upgrades, or manual IPS shutdown. Previously, traffic could bypass inspection.

After factory reset or out-of-box initialization on FortiGate 20xG models, port1 and port2 are removed from the virtual switch and configured for DHCP to support ZTP.

The default IPsec tunnel-interface MTU changes from 1420 to 1402 on FG-5xG, FG-7xG, FG-9xG, FG-12xG, FG-20xG, FG-40xF, FG-60xF, FG-70xG, FG-90xG, FG-100xF, FG-180xF, FG-260xF, FG-300xF, FG-320xF, FG-350xF, FG-370xF, FG-420xF, FG-440xF, FG-480xF, FG-7000F, FG-ARM64-AWS, FG-ARM64-AZURE, FG-ARM64-GCP, FG-ARM64-KVM, FG-ARM64-OCI, FG-ARM64-XEN, FG-VM64, FG-VM64-ALI, FG-VM64-AZURE, FG-VM64-AWS, FG-VM64-GCP, FG-VM64-HV, FG-VM64-IBM, FG-VM64-XEN, FG-VM64-KVM, and FG-VM64-OPC.

The former default Firmware Upgrade Notification automation stitch is disabled and superseded by the new Firmware Upgrade Complete workflow.

On applicable models, full configuration and manual firmware upgrade or downgrade are available for seven days before registration becomes required.

Before registration, configuration is permitted under `config firewall policy`, `config router setting`, `config router static`, `config router static6`, `config system admin`, `config system central-management`, `config system dns`, `config system interface`, `config system pppoe-interface`, and `config system settings` to support central management, ZTP, and LTP provisioning.

By default, changing outbandwidth or egress shaping on a physical or VLAN interface does not affect already established IPsec tunnels or sessions offloaded by NP7 or NP7Lite/SoC5. Flush or reinstall the affected IPsec SAs and clear offloaded sessions, or enable `config system npu` / `set mcs-auto-start enable` on NP7Lite/SoC5.

On busy NP7 systems with many VLANs, enabled VLAN accounting can generate many SPV/TPV lookup messages and may contribute to CG-FULL conditions or packet drops. Consider disabling it with `set vlan-accounting disable` or increasing `set vlan-acct-interval <milliseconds>`.