FortiOS 8.0.1 release notes

The IPS engine now detects and inspects GTPv2 Tunnel IDs, enabling accurate GTP-U payload analysis and faster isolation of compromised subscriber devices.

Adds a header-bell Notification Center with General and Event Alerts, log access, FortiAI diagnosis, automation-trigger creation, dismissal, and alert-type preferences.

Feature Visibility now follows the FortiGate navigation structure and improves search, organization, configuration discovery, and change review.

FortiView Applications and AI Applications now classify applications as sanctioned, unsanctioned, or unclassified and support interactive filtering and drill-down for shadow IT, GenAI, and risk analysis.

FortiView AI widgets can use FortiAnalyzer as a source for GenAI traffic analysis and reporting.

Adds GUI monitoring of 5G modem status and modem firmware upgrades.

On desktop models and FG-100F/200F series, first boot can create a default outbound policy with one click when no firewall policies exist.

The NP7 link-scan interval can be reduced to improve FGCP failover timing: `config system npu; set np-linkscan-interval <milliseconds>; end`. Range: 50–1000 ms; default: 1000 ms.

Traffic interfaces remain operationally down until FGSP IPsec synchronization completes; IKE signals completion instead of the HA process.

Each HA member can use a management IP on a VLAN over the heartbeat link, with an automatic route to the secondary through the primary. Configure with `config system interface; edit <name>; set management-ip <ip> <netmask>; set remote-management-ip <ip> <netmask>; set interface <interface>; set vlanid <vlan id>; next; end`.

Adds high-memory failover protection and FIM/FPM/FPC failure tolerance under `config system ha`, including `memory-based-failover`, `memory-failover-threshold`, monitoring/sample periods, flip timeout, and `memory-failover-board-failure-tolerance`.

Adds `config system npu; set sctp-offload {enable | disable}; set sctp-ctrlpkt-to-host {enable | disable}; end`.

Adds `config system npu; config fp-anomaly; set ipv4-option {allow | trap-to-host}; end; end`.

NP7 CGN NAT64 EIF per-session syslogs can include RSSO user and group information learned from RADIUS accounting.

Adds driver-level hardware acceleration for IPsec over VNE on SoC5/NP7Lite and NP7 platforms.

Hyperscale VDOM deny policies now support `match-vip`, allowing traffic to be matched and blocked after DNAT.

RSPAN and ERSPAN can be configured for individual FortiSwitch stacks rather than all switches on a FortiLink interface.

A Voice Controller discovers and authorizes FortiVoice appliances and FortiFone phones over FortiLink and centrally configures extensions, ring groups, and PBX location.

On supported NP6-family 3.2-kernel devices, `config system npu; set emac-vlan-mode {functionality | offloading}; end` trades accurate counters for broader offload. `functionality` is the default.

All 5G units support `config system cellular-modem; config modem1; set dhcp-relay {enable | disable}; end; end`.

When `intra-switch-policy` is explicit, software switches support `wildcard-vlan` and `vlan-filter` under `config system switch-interface`.

FortiExtender profiles can use a radio as a Wi-Fi WAN client, including enterprise authentication, radio mode, network selection, and persistence settings under `config extension-controller extender-vap` and `config extension-controller extender-profile`.

Clients roaming between FortiAPs can retain their original IP address and network path even across different VLANs or subnets.

A single WPA3-transition SSID can span 2.4, 5, and 6 GHz while maintaining legacy compatibility and WPA3 on 6 GHz.

Failed wireless authentication attempts can be temporarily suppressed after a configurable threshold in tunnel, bridge, and local-standalone deployments.

Virtual-switch interfaces with STP support `config system interface; edit <interface>; set stp-root-guard {enable | disable}; next; end`.

The varlog disk can be formatted with LUKS/dm-crypt using `execute formatlogdisk encrypt`; its key can reside in TPM when available or on the local filesystem.

IPsec tunnel-negotiation failure and tunnel-down logs now include a reason field.

New system event logs record device- and account-level contract and license changes affecting automatic-upgrade eligibility.

FortiOS accepts inbound PCP MAP requests in NAT64 deployments, supporting dynamic IPv6-to-IPv4 mappings for CLAT-based CPEs.

FortiGate can accept incoming HTTP and establish HTTPS to the backend HTTPS server.

Adds `config system npu; set vlan-accounting {disable | enable}; set vlan-acct-interval <milliseconds>; end`. Accounting defaults to enabled; interval defaults to 200 ms with a 100–10000 ms range.

VLAN and software-switch interfaces can have MAC addresses configured independently of their parents.

When central NAT is disabled, the GUI supports VIP reordering and Insert Above/Below; Security Rating detects overlapping or shadowed VIPs.

URL-based firmware restoration can supply an optional client certificate: `execute restore image url <url> [Enter|<cert_name>]`.

SIP ALG can assign each voice server a unique external address from a dedicated VIP range during 302 redirects.

VRFs can have user-defined names in addition to numeric IDs, and routing commands can display those names.

An unaddressed IPsec tunnel can borrow a loopback address for PIM using `config router multicast; config interface; edit "p1"; set update-source "lo1"; next; end; end`.

Clients can securely discover and interact with a captive portal using the URL advertised through DHCP option 114.

The `link-sync-group` feature makes member interfaces transition collectively, improving LACP and carrier resilience and avoiding fail-detect loops.

New OIDs expose VPN tunnel, Proxy ID, and IPsec SA statistics.

A network IP can be assigned per VLAN so wireless clients with static addresses map to the VLAN matching their subnet.

NP7 extends GTP-U dynamic source-port support to IPv6, reducing each bidirectional flow to two sessions.

A matching multicast policy can forward multicast back to an incoming interface where `switch-controller-access-vlan` is enabled.

FortiGate implements RFC 4388 to obtain a remote client's MAC address from an internal or external DHCP lease database, supporting uses such as MAB across subnets.

FGR-70F/70G platforms can use `execute obm-console` with a USB-to-serial cable to control up to four devices.

Firewall policies can directly use SCIM groups, and IPsec authorization can match certificate SAN fields against SCIM attributes.

Traffic shaping on the 4.19 kernel supports weighted random early detection queuing.

Explicit SD-WAN services support `set hash-mode spillover`, moving new sessions to the next SLA-compliant member when ingress or egress thresholds are exceeded while retaining existing sessions.

Explicit SD-WAN rules can distribute traffic by member weight while excluding links beyond their spillover thresholds.

SD-WAN health checks can use FortiExtender `signal-strength` and `quota-usage` as SLA cost factors.

Dynamic routes installed by IPsec `add-route` can receive a priority using `config vpn ipsec phase1-interface; edit <name>; set priority <integer>; next; end`.

A new `rpkid` daemon maintains Route Origin Authorizations and works with BGP to validate route origins.

Adds RFC 8092 12-byte large communities for improved policy control with 4-byte ASNs.

ICMP health checks support configurable packet size and the Don't Fragment flag to detect MTU mismatches.

IPv6 SD-WAN health checks support HTTPS alongside `http-get`, `http-agent`, and `http-match`.

Downstream Security Fabric devices can remain authorized across certificate renewals based on trusted issuer and subject CNs.

FortiGate can centrally deploy image upgrades to supported FT100G, Windows, and macOS FortiTelemetry agents.

External hashed URL and SNI lists can be enforced by Web Filter without storing or accessing plaintext values.

The topology can focus on one FortiGate and its subtree and switch among Assets, Vulnerable Assets, Security Rating, and End of Support views.

DLP can extract and evaluate text from images, screenshots, and scanned documents.

Proxy Web Filter can submit images to FortiGuard Image Classification and apply category-specific logging and blocking thresholds.

Administrators can define private applications and include them in telemetry profiles for Windows and macOS agents.

FortiGate supports hashed EDM datasets, and the `edm-csv2json` FNDN tool converts typed CSV data into an importable hashed format.

Proxy-mode SSL deep inspection can translate TLS key exchange between post-quantum and classical algorithms.

New Application Control signatures can be held for a configured period before activation, matching the existing IPS-signature review workflow.

Application signatures support custom classifications, scopes, rule-based assignment, and filtering in Application Control overrides.

Flow-based TLS deep inspection supports `ml-dsa-44`, `ml-dsa-65`, and `ml-dsa-87` post-quantum signatures.

FortiGate can initiate FortiAP upgrades from FTP, TFTP, SFTP, SSH, and HTTP(S) servers.

The Inline CASB GUI displays FortiGuard SaaS risk levels and supports risk-based filtering.

FortiGate can generate and assign a unique strong administrator password when authorizing a FortiAP without one; retention or reset on deauthorization is configurable.

FortiGate can be managed as a TR-069 CPE through an ACS, including configuration, firmware deployment, reboot, and factory reset.

`config system global; set disk-scan-timeout <0-86400>; end` terminates a timed-out manual disk scan and reboots the device. Default: 7200 seconds.

Device-status monitor profiles produce event logs after matching devices remain online for a configured duration; automation stitches can consume the events and quarantine devices.

Web proxy supports multiple certificates, for example EdDSA plus RSA: `config web-proxy global; set ssl-cert "cert1" "cert2"; set proxy-fqdn "default.fqdn"; end`.

The firmware release RSS feed now includes FIPS and FIPS-CC releases.

Automation email notifications use improved templates by default, omit raw log content, and include additional event information where applicable.

RADIUS-authenticated VAPs can use both dynamic VLAN assignment and a local VLAN pool fallback.

IPAM can include DHCP-client interfaces using `config system ipam; set dhcp-intf-conflict-check {enable | disable}; end`; it is disabled by default and cannot be enabled with `automatic-conflict-resolution`.

Adds `config system npu; set default-ipsec-mcs-type {policy | shaping}; set mcs-host-packet-tpe-shaping {enable | disable}; end`.

Multiple sub-tunnels and CPU queues can form one logical super tunnel for parallel throughput. Enable with `config vpn ipsec phase1-interface; edit <name>; set multipath <integer>; next; end`.

NP7 devices can flush or reinstall affected SAs and clear offloaded sessions after shaping changes using `config system npu; set mcs-auto-start enable; end`; disabled by default.

Remote-access and SIA VPN wizards can automatically allocate an IPv6 client range from IPAM for dual-stack clients.

The IPsec wizard separates FortiClient and native operating-system clients into distinct top-level template choices.

WiFi Controller runs an initial DARRP after 90% of managed FortiAPs have been online for 30 minutes and runs DARRP for each newly joined FortiAP after 30 minutes.

A reverse connector can register as a relay node with an upstream ZTNA Edge and participate in a multi-hop relay chain.

Large TCP packets entering an IPsec tunnel now cause an `ICMP_FRAG_NEEDED` response so the sender adjusts packet size, rather than FortiGate automatically adjusting MSS.

8.0.1 replaces network-server `execute backup` usage with explicit export protection. Use `execute export config {standard | full | yaml} {encrypted | obfuscated | secrypt} {ftp | scp | sftp | tftp | usb} <filename> <server> [<password>]`. Password-protected exports are reversible only with that password; masked secrets are not restorable. Legacy `execute backup config` is limited to local and management-station targets.

Dedicated host queues and dedicated management CPU are enabled by default; NP7 DSWH buffering and overload behavior are changed. Regular host queues drop at DSWH under extreme load rather than applying backpressure. Disabling dedicated management CPU may maximize CPS but removes the new isolation.

Newly generated hostnames use the product name plus a short serial-derived hash, for example `FGT-71F-XEZOKB`, instead of a product-only name such as `FortiGate-71F`.

New desktop models and FG-100F/200F series no longer ship with a preconfigured outbound firewall policy; it may be created through the initial setup wizard.

During `override-wait-time`, primary selection now uses HA uptime instead of reverse priority.

After factory reset or initial setup, port1 and port2 are removed from the virtual switch and configured as DHCP clients to support ZTP.

With default `dhcp-broadcast-flag` enabled, the L2 socket sends only packets with source 0 and other DHCP traffic uses the L3 UDP socket. When disabled, DHCP uses an `ETH_P_IP` L2 socket and ARP uses a separate `ETH_P_ARP` socket.

The default IPsec tunnel-interface MTU changed from 1420 to 1402 on all FortiGate models.

`system.global.log-daemon-cpu-threshold` now defaults to 75 instead of 0, and its valid range changed from 0–99 to 50–99.

The default HA upgrade mode changed from simultaneous to uninterruptible.

Under `config system fortiguard`, `update-server-location` is renamed to `fortiguard-server-location`: `config system fortiguard; set fortiguard-server-location <location>; end`.

IPv4 and IPv6 firewall VIPs support `arp-reply`, enabled by default. Disable with `config firewall vip; edit new-vip; set arp-reply disable; end`.

The supported block-size range for port-block-allocation IP pools is expanded as stated in the notes from `644096` to `164096`.

The `intra-vap-privacy` setting is available for local-bridging VAPs.

On FGT-200G and higher-end models, `extension-controller.extender` capacity increases to 512 LAN-extension connections.

The maximum firewall-policy name length increases from 35 to 255 characters; integrations with shorter assumptions may require review.

Fixes a security vulnerability triggered when connecting to a malicious SSH server that sends crafted packets. No CVE or severity is stated in the supplied notes.

Custom application tenant extraction through user-defined JQ filters was removed from the Inline CASB CLI and GUI due to custom-script security risk and maintenance complexity.

WAD no longer blocks uploads to an SSL VPN web application when it processes SSL VPN traffic.

`GET /api/v2/monitor/vpn/ssl` no longer creates multiple subsessions for one user due to API and CLI matching differences.

DNS filtering over TLS is no longer bypassed with SSL deep inspection and a proxy-mode DNS filter.

Frequent configuration reloads no longer cause `dnsproxy` to stop responding.

Large FQDN configurations no longer cause pass-through DNS packet loss during updates.

ZTNA destinations no longer fall to Implicit Deny when EMS connectivity is lost because of SSL verification failure.

Intermittent HTTPS timeouts with proxy UTM inspection on a virtual-server VIP are fixed.

Explicit or web proxy policies no longer stop WAD when a one-way origin-server request is answered locally.

WAD now correctly forwards FIN packets to servers for proxy-created IP sessions.

NAT is correctly applied when a lone SYN is sent to a VIP without an ACK or reset.

Fixes offload and traffic-blocking issues for back-to-back EMAC VLAN interfaces and inter-VDOM links.

Traffic is no longer blocked when `auto-asic-offload` is enabled for back-to-back EMAC VLAN and inter-VDOM-link topologies.

VXLAN traffic no longer fails when offloading is enabled.

NAT64 traffic no longer matches an incorrect firewall policy when multiple policies are configured.

Interface bandwidth shaping now enforces aggregate limits correctly during parallel streams on NP7.

VIPs using EC384 certificates now advertise `TLS_AES_256_GCM_SHA384` correctly.

Policies containing a large number of address objects can now be installed successfully.

FTP passive mode works without NAT after upgrading from FortiOS 7.4.9 to 7.6.6.

Fixes traffic disruption occurring when firewall-policy offloading is enabled.

VIP health checks now work when backend servers are reachable through a non-default VRF.

Configuring 221 or more source-address objects in a local-in policy no longer causes an unexpected reboot.

MAC-type dynamic Fabric addresses now match NGFW policies when used as source or destination objects.

Virtual servers no longer return HTTP 504 when backends require `rsa_pkcs1_sha256`, `rsa_pkcs1_sha384`, or `rsa_pkcs1_sha512` during TLS 1.2 handshakes.

HA clusters remain synchronized when private-data encryption is enabled.

Session-sync packets from an unknown FGSP peer no longer stop the `sessionsync` daemon.

An IKE NAT port change no longer blocks traffic after HA failover.

Releasing a session chain with multiple derived sessions no longer restarts `ipsengine`.

Fixes an `ipsengine` error while processing HTTP traffic.

Fragmented UDP traffic can no longer bypass IPS when NP acceleration is enabled on an IPsec tunnel.

Malformed safe-search bridge input no longer unexpectedly restarts `ipsengine`.

A TLS probe no longer unexpectedly restarts `ipsengine`.

HTTP/2 processing no longer consumes excessive memory and drives FortiGate into conserve mode.

Invalid `--context` options in custom signatures no longer unexpectedly restart `ipsengine` during load or upgrade.

Certificate inspection no longer blocks TLS 1.0 after IPS engine update 7.01196.

Fragmented packets are handled correctly, preventing HTTP failures through nTurbo.

Fixes traffic disruption caused by an IPsec tunnel-manager write-sequence issue.

Renewing expired phase1-interface certificates no longer unexpectedly restarts `iked`.

Fixes traffic-forwarding issues with NPU offload enabled for IPsec VPN.

IPsec dialup authentication no longer fails when RADIUS username capitalization differs.

IKEv2 correctly matches certificate requests when one FortiGate VPN server interoperates with multiple vendors and CA certificates.

Corrects traffic-forwarding problems caused by improperly handled IPsec MTU constraints.

Large ICMP traffic over IPsec is handled correctly with NPU offload enabled.

Phase-2 rekey no longer drops traffic and BGP neighbors on NP7 and NP7Lite when IPsec-over-VNE offload is enabled.

Fixes IPsec data-transfer problems when NPU offload is enabled.

FortiGate 50G no longer drops ICMP packets over IPsec when NPU offloading is enabled.

Dialup VPN traffic from remote RADIUS users is no longer blocked by an empty firewall authentication list.

Tunnel gateway switching now refreshes the negotiation timeout so IPsec negotiation does not expire before 2FA completes.

FortiAnalyzer Cloud now receives logs from secondary units in HA clusters running FortiOS 7.4.9 and later.

FortiGate retains the FortiAnalyzer serial number when failing over from primary to secondary FortiAnalyzer.

Logging connection interruptions to FortiAnalyzer no longer cause excessive memory consumption.

Disk-log cleanup no longer deletes IPS PCAP archives merely because other UTM categories lack files for the same roll number.

WAD now handles a mismatch between a server certificate key type and the ServerKeyExchange signature type.

SSL deep inspection no longer blocks or bypasses traffic when the first ClientHello TCP payload is 1024 bytes or less.

Traffic is no longer blocked when `unsupported-ssl-version allow` is enabled and minimum TLS is 1.1.

SSL deep inspection is no longer bypassed by proxy-based firewall policies using WAF.

Malformed LDAP `objectSid` data no longer causes WAD failure and Implicit Deny connection drops.

WAD no longer errors when a VIP with HTTP/3 enabled receives a large volume of QUIC packets.

FortiGate no longer responds with TLS 1.0 or 1.1 when `ssl-min-proto-version` is TLS 1.2.

TLS handshakes now succeed when `TLS-AES-256-GCM-SHA384` is the only configured cipher suite.

Enabling WebSocket no longer causes WAD memory use to grow continuously.

An FSSO identity lookup returning no user and no matching proxy policy no longer stops WAD.

A blocked WAD event loop no longer consumes excessive memory and causes conserve mode.

`POST /api/v2/monitor/system/firmware/upgrade` no longer returns HTTP 500/API error -28 when `force` is omitted.

JSON filtering of policy and address-group lists no longer drops entries or returns incorrect results.

BGP networks continue to advertise correctly after the AS number changes.

Restarting routing no longer removes default routes when a VIP external address matches the gateway.

Fixes a BGP process error during a FIM failover sequence.

FortiGate can delete IPv6 prefix routes with a `/0` prefix length.

Prevents WAN outages when upgrading from 7.6.1 to 7.6.3 or 7.6.5 with SD-WAN and IPsec-over-VNE links.

Fixes packet loss observed after upgrading from 7.0.14 to 7.2.10.

Dead and working monitors sharing an ICMP ID no longer destabilize link monitoring.

ADVPN shortcuts no longer flap when SD-WAN traffic quality degrades.

A static route no longer remains when the health-check server FQDN cannot be resolved.

Fixes unstable SD-WAN connectivity when a hub withdraws BGP routes.

Receive-rule packet de-duplication no longer terminates TCP sessions shortly after establishment.

The official notes reuse several identifiers across enhancement and resolved-issue sections, including 895242, 1073893, 1205727, 1236578, 1248524, 1254541, 1277091, 1277890, 1280968, 1288373, and 1295481.

No FortiOS build number or release date is stated in the provided release-note pages.

The provided material contains no explicit open known-issues list, supported-model matrix, upgrade-path table, or upgrade prerequisites.