FortiOS 8.0.0 release notes

Retrieves all Kubernetes IP addresses, including runtime-configured addresses, and adds them to firewall address dynamic objects.

Adds Last Check and Check Due fields to help administrators track the remaining grace period before shutdown, including in air-gapped and DDIL environments.

Adds an authenticated-client monitoring widget, an Open Authentication option, and clearer security-mode radio buttons.

Displays CISA Known Exploited Vulnerabilities for FortiClient devices managed by EMS in Asset Identity Center and Assets & Identities, with drill-down details.

Introduces tabbed settings and custom color schemes and visual identifiers to distinguish environments and security classifications.

Adds resync, failover, diagnostics, HA health details, and a configuration-difference view previously available only through CLI.

Adds GUI support for `route-map-out-preferable` and `route-map-out6-preferable`.

The wizard can configure an internet gateway for FortiCare registration or upload an offline license in air-gapped environments.

Physical and Logical topology pages retrieve and render data incrementally, reducing root-FortiGate memory use and improving scalability for large fabrics.

Allows a source IP or source interface to be selected for Layer 3 FGSP heartbeat and synchronization traffic, avoiding ECMP path divergence.

Adds `session-sync` under `config system standalone-cluster`, allowing IP session synchronization to be disabled while GTP tunnels continue synchronizing across FGSP peers.

Hardware-synchronized sessions now include PBR-corrected reverse-path information, avoiding relearning delays after failover.

Synchronizes IPv6 multicast routes from primary to secondary to minimize failover disruption.

Software-switch member interfaces can now be selected as HA monitor interfaces.

Preserves authenticated users and active sessions on the peer during failover, avoiding mass reauthentication.

Interfaces can be grouped and failover decisions made from group status rather than individual links.

Shows active or passive status in the prompt and updates it after failover.

Adds full-cone NAT controls under `config system npu`: `set eif-tcp-refresh-dir {both | outgoing | incoming}`, `set eif-udp-refresh-dir {both | outgoing | incoming}`, `set eif-tcp-ttl <time>`, `set eif-udp-ttl <time>`, `set extra-timeout-tcp <time>`, and `set extra-timeout-udp <time>`.

Adds `set rsso-ipv6-prefix-length <length>` and `set rsso-ipv4-prefix-length <length>` to NPU log server groups. Defaults are 64 for IPv6 and 32 for IPv4.

Switch controller supports Energy-Efficient Ethernet advertisement and control through LLDP.

Switch controller can push custom commands after full or differential managed-switch configuration updates.

Supports client reauthentication when a device reconnects through another port, including hub and IP-phone environments.

Switch controller can configure private-data encryption so RADIUS and TACACS+ secrets use encoded keys decryptable with a shared key.

Adds SVI, RVI, VRF, minimally configured DHCP server, and IPv4 static-route support for hybrid Layer 2 and Layer 3 networks.

Adds clearer capacity visibility, grouping actions, diagnostics, and a refined topology experience.

Enabling the toggle under System > Feature Visibility exposes LLDP Profile, QoS Policy, VLAN Policy, and PTP Profile tabs.

Raises the managed-switch name limit from 16 to 35 characters.

Allows administrators to cap authenticated sessions on each port.

Adds `config system ha` / `set bounce-intf-upon-failover {enable|disable}` to bring down all monitored interfaces, including aggregate members, during manual failover in VWP active-passive deployments with wildcard VLANs.

Supports user-defined coordinates, onboard GPS, and WiFi RTT-based trilateration.

PoE ports can use 30 W, 60 W, or class-based maximum-power settings.

Adds charts for FortiAP G and K models on Managed FortiAPs and the FortiAP Status widget, with customizable chart layouts.

FortiGate can push admin-account trusthost settings to managed FortiSwitches.

Up to four FortiSwitch units can be exposed and managed as one aggregated entity.

Ensures LLDP PDUs continue to be sent when more than 1,000 VLANs are configured.

Supported switch counts increase from 8 to 16 for 50G variants, 64 to 96 for 200G, and 196 to 300 for 2600F.

Mesh leaf connection settings can now be configured directly through the GUI.

Adds authenticated access control and intra-switch policy enforcement to FortiGate software switches.

Source and destination entries can use FQDNs and simple wildcard matching instead of only static IP addresses.

Adds channels 1 through 93 for all G and K platforms in the Ukraine-U region.

Receives LoRaWAN sensor data and securely forwards it to supported network servers while continuing to operate as a WiFi AP.

Adds high-density and medium-density default profiles, reduces the maximum weight to 200, and adjusts rogue AP, weather-channel, and DFS-channel defaults.

Maps 802.1X clients to existing groups and creates WSSO firewall authentication entries so policies apply immediately.

Administrators can define static multicast group entries through FortiGate.

Allows 802.1X on virtual switches in a software switch when `intra-switch-policy` is `explicit`.

A new `highpse` option permits 802.3af output on LAN3 when the AP is powered through 802.3at.

Multiple GENEVE interfaces sharing the same physical interface can belong to the same software switch.

Moves trunk port-selection criteria from per-trunk settings to the global switch-controller level.

RADIUS can assign a VLAN, with local VLAN pooling used as a fallback when no assignment is returned.

A VLAN-pool entry can select multiple WTP groups.

Enables Multi-Link Operation on local standalone VAPs with authentication handled by the AP.

Adds timestamp, policy information, event overview, hover tooltips, and quick actions at the top of the Log Details slide-out.

Adds custom log formats using `log custom-format` and `log-template`, beyond CSV, CEF, RFC 5424, and JSON.

Adds secure SFTP transport and industry-standard LZ4 compression while retaining default FLZ4 support.

GUI options allow resolution on log creation (`resolve-ip`, storing `dstname`) or when viewed (`resolve-hosts`). If both are enabled through CLI, creation-time resolution takes precedence.

Adds complete CLI change details to the reason field for external auditing.

FGSP and FGCP synchronize full-cone NAT expectation sessions so peer-to-peer UDP behind CGNAT remains reachable across members.

The 1G/10G Base-T ports automatically negotiate speed and duplex.

Uses IPAM for hub-and-spoke overlay addressing and spoke LAN address schemes.

Adds `set lag-hash-gre {disable | gre_inner_l3 | gre_inner_l4 | gre_inner_l3l4}` under `config system npu`; aggregate interfaces can use `set algorithm NPU-GRE`; GRE tunnels can use `set loopback-ecmp-offload {disable | enable}` for multipath offload.

`ip6-link-local` can be configured directly in interface IPv6 settings; applying a manual address removes the automatically generated link-local address.

Adds `config system npu` / `set session-denied-offload {enable | disable}` to reduce CPU use from large numbers of denied sessions.

Introduces an IPAM address type for centralized automatic allocation of VPN client ranges across multiple FortiGates.

Accepts inbound PCP MAP requests in NAT64 deployments for dynamic IPv6-to-IPv4 mapping and CLAT compatibility.

Adds `set dnssl-service {enable | disable}` under `config ip6-delegated-prefix-list` to control whether delegated-prefix domains appear in Router Advertisement DNSSL options.

Displays FEC state, RX/TX bps, packets per second, and host-level RX drops.

Adds VXLAN Anycast Gateway, EVPN Integrated Routing and Bridging, and Type-5 EVPN routes.

Adds a DHCP Template table; DHCP servers, IPAM rules, and interfaces can reference reusable templates.

ARP packets can be marked with CoS values `cos0` through `cos7`.

HA members can be accessed through IPv6 in-band management addresses.

Neighbor names appear alongside addresses in the GUI and logs.

Adds dynamic rendezvous-point discovery for IPv6 using BSR.

Expands PIM from VRF 0 to as many as 511 VRFs and supports IPv6 multicast routing and forwarding over one overlay.

Allows onboard IoT sensors and systems to publish and subscribe through the FGR broker.

FortiGate can accept incoming HTTP and use HTTPS for the upstream server connection.

Integrates Google's Bottleneck Bandwidth and RTT algorithm as an alternative to CUBIC.

Configured suffix lists can be passed to FortiClient and installed when it connects.

Detects DNS tunneling used for exfiltration or command and control and includes a trusted-domain whitelist to reduce false positives.

Raises the `set-aspath` route-map limit from 79 to 255 characters.

Implements RFC 8326 with neighbor settings `set shutdown {enable | disable | graceful | graceful-soft}`, `set graceful-shutdown-community <community>`, `set graceful-shutdown-local-preference <local preference>`, and `set graceful-shutdown-delay <delay>`.

Extends CLI statistics beyond SIP to FTP, TFTP, RTSP, and PPTP.

SFP and SFP+ interfaces can use GPON transceivers for fiber access deployments.

Uses ingress interface and VLAN ID as session keys so return traffic on different VLANs creates distinct multicast sessions.

Adds dynamic authorized MAC entries instead of only static, non-expiring entries.

Adds single-MAC-match override, hour-level match periods, QoS policy actions, and full PoE configuration.

Adds negation plus `L3OutSubnetDescription` and `L3OutSubnetNameAlias` filters with IPv4 and IPv6 support.

On NP7Lite/SOC5, `config system npu` / `set mcs-auto-start enable` automatically flushes or reinstalls affected IPsec SAs and clears offloaded sessions after outbandwidth or egress-shaping changes. It is disabled by default.

Improves GPS reception where the internal passive antenna is insufficient.

Adds `config system settings` / `set src-check-reply {enable | disable}`. The default is disabled.

Administrators can select arbitrary sub-option combinations and define a custom delimiter instead of using three fixed styles.

Locally generated DHCPv4 and DHCPv6 client packets can carry CoS markings required by some providers.

Adds `set next-hop-self-rr-vpnv4 {enable|disable}` and `set next-hop-self-rr-vpnv6 {enable|disable}` to BGP neighbors.

Selected ISDB categories can be received and advertised through BGP for threat-aware routing.

Assigns IP addresses or ranges according to the DHCP client's MAC vendor OUI.

Adds hardware-backed Layer 2 encryption across applicable FGR models with hardware switches.

Digital I/O status changes on FortiGate Rugged can run automation actions such as enabling or disabling policies or VPNs.

Supports key S3/Gn signaling for users moving between 3G and 4G/5G, including GTPv1-to-GTPv2 mapping.

Internet Service Database objects can use FQDN groups to track frequently changing service addresses.

NP7 and NP7Lite/SOC5 offloaded traffic can use shaping profiles selected from authentication and RADIUS bandwidth attributes.

Extends FQDN address-group support in ISDB from firewall policies to NGFW policies.

Adds users and user groups as source filters in policy routes.

Enables wildcard address matching in IPv6 policies.

Policies can be filtered by bytes, packets, hit count, last user, and related metrics.

Adds 12 satellite RAT types to `config gtp rat-timeout-profile` and GTPv2 policy filtering: WB-E-UTRAN and EUTRAN-NB-IoT and LTE-M variants for LEO, MEO, GEO, and OTHERSAT.

Custom tags improve organization, visual categorization, and filtering across multiple address and policy types.

Adds a `telemetry` dynamic-address subtype, an `agent-id` reference to FortiTelemetry agents, and telemetry address groups for use in telemetry policies.

Adds `config telemetry-controller global` / `set auto-group-telemetry-addr {enable | disable}`; the documented default is enabled.

Adds IPv6 health checks and `probe-response` to interface `ipv6-allowaccess`.

Spokes communicate per-tunnel egress shaping values to hubs during IKEv2 negotiation for persistent policing.

Scheduled results can update interface inbound and outbound bandwidth within configured limits; `FTNT_Auto` is the default cloud server group and failed cloud tests are retried.

Spokes exchange and enforce per-tunnel egress shaping values during IKEv2 setup.

Adds `set fec-separate-redundant-tunnel enable` to an IPsec phase1 interface; the redundant tunnel must share the destination location ID.

FEC mappings can match ToS/DSCP and negate packet-loss, latency, and bandwidth thresholds through new `*-threshold-negate` fields and a `config tos` subtable.

Uses `config system settings` / `set location-id <ip>` to distinguish spokes that advertise the same subnet.

On-demand packet duplication starts when a spoke reports out-of-SLA checks and stops when it returns in SLA. Configure `set duplication-max-num <value>` and `set packet-duplication on-demand`.

Duplication can be limited to chosen members instead of every member in a zone.

Adds Type of Service as a duplication-rule criterion.

For `inbandwidth`, `outbandwidth`, or `bibandwidth` hash modes, services can use `set bandwidth-type {overlay | underlay}`; overlay is the documented default.

Starts duplication below a configured overlay or underlay utilization threshold and stops it when the threshold is exceeded.

Adds overview, response-time, jitter/stability, retransmission, and reliability reports. Firewall policy logging gains Log application health metrics.

Adds quota, billing-start-day, and adjustment settings that can alter member cost, weight, or volume ratio after the monthly limit is exceeded.

Health checks can use `set update-bgp-route {enable | disable}`; a BGP route map can match `set match-suppress enable` and change MED to direct traffic through another hub.

Files can be exempted from sandbox submission according to governance labels, preventing sensitive data from leaving the network.

Antivirus profiles can route files to cloud or on-premises sandboxes by policy or automatic selection.

FortiAnalyzer uploads feeds to Cloud AMQP, which synchronizes them to FortiGates under the same FortiCare account. This replaces the former threat-feed terminology.

Extends APIC import beyond IPv4.

Automatically imports `l3extSubnet` external EPG networks for policy use.

Downstream members can be authorized using issuer CN and device subject CN, retaining authorization across renewals when the signing hierarchy remains trusted.

Adds a VDOM dropdown for multi-VDOM FortiGate devices.

Tooltips can open all insights for an object and hide individual insights while still indicating that hidden insights exist.

Adds category and popularity filters, multi-select, and bulk-add operations.

Applications or categories can be sanctioned, unsanctioned, or unclassified; the implicit default can be changed from unclassified.

MPIP labels no longer require a dictionary and can synchronize from Microsoft Purview through the Azure SDN connector.

Uses JQ filters to inspect JSON exchanged with custom SaaS applications, including tenant details not reflected in URLs.

FortiGate sends transferred-file fingerprints to FortiData and uses returned labels in DLP processing.

Adds the AIAP database, Generative AI category, AI Applications and AI Use Cases FortiView types, and GenAI log fields including `aiuser`, `model`, `dcgeo`, `usecase`, `cloudgenai`, and `prompt`.

Antivirus profiles gain `set outbreak-prevention-error-action {log-only | block | ignore}` and `set outbreak-prevention-timeout-action {log-only | block | ignore}`.

Allows inline sandboxing to run with flow-mode capabilities such as IPS.

Adds a warning action that presents an authorization page for matched files in proxy inspection mode.

Proxy inspection is available for SMTP(S), POP3(S), IMAP(S), and NNTP on models with 2 GB RAM.

Extracts and evaluates text from images, screenshots, and scanned documents.

External resources can use `set threat-feed-hash-mode {plain-text-db | hash-db}` for hashed URL and SNI filtering.

Adds a table type for custom FortiGuard-style categories in both policy-based and profile-based NGFW modes.

Antivirus profiles gain `set fortisandbox-scan-timeout <30-180>`.

Supports hybrid post-quantum key exchange such as X25519MLKEM768 in proxy-mode SSL deep inspection.

DLP, antivirus, IPS, and FileFilter can detect and block sensitive data, malware, and restricted files over WebSocket.

Administrators can block, monitor, allow, or quarantine sanctioned, unsanctioned, or unclassified applications.

When profiles, policies, or SSL exemptions use only local or external threat-feed categories, category detection can proceed without contacting FortiGuard.

Adds OIDs for free, in-use, and total PBAs and free and in-use IPs. `fgFwIppStatsExpiringPBAs` is noted as unsupported by FortiOS 7.6.5.

Displays individual failure reasons for each device in a federated upgrade.

Provides RAG-based documentation assistance, diagnostic and debug-log analysis, natural-language configuration generation, script refinement, and direct execution. It can use FortiAI token allotments or customer-provided OpenAI keys.

Adds GUI-driven packet-sniffer setup and PCAP export, replacing manual CLI and TFTP steps.

Adds the `http_authd` daemon and a `diag http_authd` command for monitoring authentication sessions.

FortiSwitch, FortiAP, and FortiExtender upgrades can be managed through FortiGate REST APIs by clients such as FortiManager.

FortiGate 91G and 901G support Sovereign bundles. After `config system sov-sase` / `set status enable`, local GUI and CLI become read-only and configuration is managed by the Sovereign Cloud Orchestrator and Web Portal.

Administrators can dismiss selected prompts; logs distinguish automatic and manual upgrades; email status is more detailed; and the GUI asks users to confirm auto-upgrade preference after disabling auto-upgrade and updating.

Adds `config system settings` / `gtp-fgsp-s10-only` to reduce FGSP synchronization bandwidth.

Adds `config system global` / `set log-fsck-timeout <value>`; unfinished checks continue in the background after boot.

Adds the `proxy-fqdn-host` option to use the FortiGuard FQDN in proxy Host headers.

Adds `disallowed-login-methods` to block Console, GUI, SSH, or Telnet access per administrator.

Supported TPM/NVMe models can use `diagnose debug black-box upload scp <destination string> <yyyymmdd>` or `diagnose debug black-box upload sftp <destination ip> <user> <pwd> <dst folder> <yyyymmdd>`.

Configuration, firmware, license, and certificate files can be uploaded or exported through SCP.

Adds five OIDs for block size, port range, and client IP range.

Adds a searchable and exportable Legal Third Party panel with component versions and license terms.

Supports hybrid post-quantum key exchange such as X25519MLKEM768 in flow-mode SSL deep inspection.

Interface and VPN aliases can appear in diagnose and get output; the alias limit increases from 15 to 25 characters.

Adds API visibility for application performance data in session lists.

Adds hybrid key exchange and PQC certificates while retaining compatibility with non-PQC clients.

Adds `config web-proxy explicit` / `set client-certificate-blocklist {enable | disable}` using the Malicious Certificate Database.

Default load balancing expands to five servers. GUI controls can prioritize public or custom servers and configure additional override types, including IoT device collection and virtual-patching query servers.

Each VDOM can have separate message templates and images.

A new VM under the same FortiCare account can register and obtain a license with `execute central-mgmt register-device-by-address <FortiManager_Cloud_FQDN> <API_KEY>` or equivalent cloud-init license-token data.

Adds the Firmware Upgrade Complete default stitch, Auto Firmware Upgrade Complete trigger, and Auto Upgrade Complete Email Notification action. The previous Firmware Upgrade Notification default stitch is disabled.

Location, description, and contact information can remain distinct for each HA member.

A SCIM client can act as the user database for a SAML authentication scheme in a proxy policy.

Firewall policies can reference SCIM groups without local mapping, and IPsec authorization can match certificate SAN fields to SCIM user attributes.

A selected interface can supply the current IP to the push service automatically, helping deployments with dynamic WAN addresses.

Adds Google reCAPTCHA and Cloudflare Turnstile options.

FortiGate can retrieve realms, user sources, certificates, and IdP URLs, while FortiIdentity Cloud creates and synchronizes the corresponding SSO application.

Processes user and group attributes from Access-Accept to assign dynamic firewall policies on WPA2-Personal and WPA3-SAE SSIDs.

Adds `config web-proxy global` / `set auth-sign-timeout <30-3600>`.

Supports the `continue` form item so successful authentication redirects users to a specified URL.

When VPN negotiation over TCP is enabled, TLS can transport IKE and ESP traffic.

Using an authorized AWS SDN connector, the wizard creates FortiGate VPN settings and pushes Customer Gateway and VPN tunnel configuration to AWS.

Remote-access and SIA tunnels use IPAM by default; if disabled, the wizard can enable it and allocate a client block from a selected network size.

FortiClient sends tags in JWT form as a fallback when EMS is unavailable or slow; EMS remains the preferred verification source. Requires FortiClient 7.4.5 and EMS 7.4.4 or later.

Adds CLI selection of pure and hybrid PQC algorithms.

Firewall policies and policy routes can match the public-IP geolocation of incoming remote users.

Configure `config system settings` / `set ike-port 443`.

Implements RFC 7427 and supports ML-DSA and SLH-DSA certificates. Phase1 settings include `set authmethod signature`, `set digital-signature-auth {enable | disable}`, and `set signature-hash-alg {sha1 | sha2-256 | sha2-384 | sha2-512 | identity}`.

Produces out-of-box client settings for supported operating systems. Defaults to L2TP over IPsec for Windows, Android, macOS, and iOS, with IKEv2 available for Windows and Android.

Adds SM4 encryption and SM3 hashing as IKEv1/IKEv2 Phase1 and Phase2 proposals.

Simplifies FortiClient Standalone remote-access VPN setup and synchronizes SAML configuration automatically.

Allows AP management in IPv6-based environments.

FortiAIOps collects radio data through REST APIs and recommends channels for centralized interference reduction.

Adds `config wireless-controller vap` / `set captive-network-assistant-bypass {enable | disable}`, requiring clients to open a full browser to trigger redirection when enabled.

Clients can be redirected to session-specific portal URLs supplied by Cisco ISE.

Adds WPA2/WPA3-Enterprise and WPA3-SAE support in client mode.

Extends the feature from FAP-U to QCA-based F, G, and K models.

APs can request and renew certificates from servers configured in the WTP profile without manual TFTP CA uploads.

Uses faster keepalives and additional session details to recover from disrupted data links, especially in cloud environments.

Allows simultaneous transmission across 2.4, 5, and 6 GHz bands.

Older FortiOS releases classify unsupported new APs as a generic WiFi 7 2x2 dual-band FAP MVP with limited management until FortiOS is upgraded.

Doubles the per-radio VAP limit from 8 to 16.

When WTP-profile `dtls-policy` is `ipsec-vpn` or `ipsec-sn-vpn`, a new CLI control can enable offload for higher client throughput.

Administrators can adjust Clear Channel Assessment sensitivity for dense RF environments.

The VAP setting `radius-auth-survivability` locally reauthenticates previously authenticated clients when RADIUS is unreachable.

Maintains a persistent control connection to a FortiPAM or FortiProxy ZTNA Edge, receives connection requests through the tunnel, and proxies them to protected servers.

Configure `config endpoint-control fctems`, edit the connector, and use `set capabilities used-tags`. Requires EMS 7.4.4 or later.

IPv6 tags and groups can be used in dual-stack policies. Requires FortiClient and EMS 7.4.5 or 8.0.0.

Adds `config authentication setting` / `set ems-root-ca {enable | disable}`; default is enabled. When disabled, WAD validates client certificates with the configured user CA.

Forward mode sends requests through another FortiGate, with each hop enforcing policy. Reverse mode lets a downstream FortiGate behind NAT initiate a persistent control tunnel to the connector edge and carry requested data tunnels.

Dashboards and monitors are consolidated under Status, Asset and Identities, Network Monitor, FortiView, and WiFi. The `gui-dashboard` subtable under `system.admin` is removed and replaced by `system.gui-dashboard-collection`, referenced by `system.admin`. After upgrade, `diagnose debug config-error-log read` may show `gui-dashboard`-related errors.

Default soft-switch interfaces and open SSIDs are removed across FortiWiFi platforms. On 4xF, 6xF, and G-series devices, the default WiFi VAP remains in tunnel mode with preconfigured IP, DHCP, and firewall policies. On 8xF-2R, VAPs use bridge mode with the hardware switch and internal-interface DHCP.

Scheduling is coordinated automatically with Fortinet back-end servers, removing retry configuration. Shaping-related result settings move into interface configuration. Speed-test traffic bypasses interface shaping but honors configured `update-inbandwidth-maximum` and `update-outbandwidth-maximum` values.

On 2 GB and 4 GB families, the router daemon starts only when routing configuration exists, NP memory reservation is reduced, and nTurbo maximum frame size is 1500; interfaces with larger MTUs do not offload to nTurbo. Affected 2 GB families are 40F, 60F, and 50G; affected 4 GB families are 70F, 80F, and 70G.

Server selection relies on RTT. The GUI changes from service-level status to server-specific details showing server IP, response time, and packet loss.

Adds `config system settings` / `set ike-tcp-service {enable | disable}`; default is disabled. When enabled, dial-up VPNs prefer UDP and fall back to TCP. The phase1 TCP transport option for dynamic gateways is removed. On upgrade, the setting is enabled if a dynamic tunnel used auto or TCP, or a static tunnel used TCP; a static tunnel using auto is changed to UDP.

`firewall.access-proxy` is split into `ztna.traffic-forward-proxy`, `ztna.web-proxy`, and `ztna.web-portal`. `firewall.proxy-policy` references a new `ztna-proxy` type, and policies use `ztna.destination` objects directly. GUI configuration is separated into ports, web-proxy, and traffic-forwarding pages, with shared VIPs and agentless web portals supported.

CLI-created Phase1 and Phase2 tunnel defaults change from groups 14 and 5 to groups 20 and 21. During upgrade, tunnels using the old defaults are updated to groups 14, 20, and 21.

The former SD-WAN prerequisite `set detect-mode passive` with `set members 0` is no longer required.

On NP7 systems, defaults become `config system npu` / `set vlan-lookup-cache disable` and `set htab-msg-queue dedicated`.

With `asymroute-icmp` or `asymroute6-icmp` enabled, replies no longer require the incoming interface when no route exists through it; the best available route is used.

If the address pool cannot allocate an IP, the tunnel is rejected and no default route is installed.

When `auth-ike-saml-port` is used, local-in traffic matches only when the destination port equals that value and the destination interface has `ike-saml-server` enabled.

The default is now `set csr-include-device-sn enable` under `config vpn certificate setting`.

The default auto-update schedule changes from automatic to daily.

With Anycast enabled, license activation uses `vmactivation1.fortinet.net`, `vmactivation2.fortinet.net`, and `vmactivation3.fortinet.net` instead of general update FQDNs.

Revisions are available only on disk-equipped models. `revision-backup-on-logout` is enabled by default, and System > Settings adds Create a configuration revision on logout.

This notice applies to 8.0.1 only. Network-targeted `execute backup` commands are replaced by explicit export protection choices: `execute export config {standard | full | yaml} {encrypted | obfuscated | secrypt} {ftp | scp | sftp | tftp | usb} <filename> <server> [<password>]`. Administrators must use password-based reversible protection or irreversible masking. Legacy `execute backup config` remains only for local and management-station targets.

Defaults change to `config system global` / `set allow-traffic-redirect disable` and `set ipv6-allow-traffic-redirect disable`. The supplied source text is truncated before fully describing upgrade handling.

Administrators can manually upgrade or downgrade through GUI or CLI during the seven-day setup period; registration is required afterward.

A license is still required to move to another minor or major version.

For affected upgrades using Transparent Proxy with form authentication, configure `config authentication setting`, `set captive-portal-type {ip | fqdn}`, and `set captive-portal-ip <ip>`; then enable it on the interface with `set proxy-captive-portal enable`.

Appliances without a valid Firmware & General Updates license or that reached End of Engineering Support automatically upgrade to the latest patch within their current minor version.

FCPC accepts a `ForcedUpdate` flag and major.minor.patch-build version. If the source and target share the same major and minor version, FortiGuard can bypass the license check. Related messages and automation notifications are clarified.