Web Filter Quota traffic can no longer be set to 0 (374380)
To fix a bug in older major release, the CLI has been changed so that minimum traffic quota does not allow 0 as an entry. The value entered must be in the range of 1 – 4,294,967,295; if 0 is entered, then an error message will be returned.
CLI Commands:
config webfilter profile edit default config ftgd-wf config quota edit 1 set type traffic set value {a number in the range of 1 – 4,294,967,295}
Web Filter profile page GUI updates (309012)
The GUI for the Web Filter security profile and Web Profile Overrides pages are changed.
DLP sensor GUI changes (307225)
The DLP sensor for file size has been corrected to indicate that the file size has to be greater than the number of KB entered. Previously, the GUI incorrectly showed that the files size could be greater than or equal to the number of KB entered.
Enhancements to IPS Signatures page (285543)
The IPS signatures list page now shows which IPS package is currently deployed. Users can also change their IPS package by linking directly to the FortiGate’s System > FortiGuard page from the IPS Signatures list page.
Restricting access to YouTube (replacement for the YouTube Education filter feature) (378277)
Previous versions of FortiOS supported YouTube for Schools (YTfS). As of July 1, 2016 this feature is no longer supported by YouTube. Instead you can use the information in the YouTube support article Restrict YouTube content on your network or managed devices to achieve the same result. FortiOS supports applying Strict or Moderate restrictions using HTTP headers as described in this article.
In FortiOS 5.6 with inspection mode set to proxy-based, in a Web Filter profile under Search Engines you can select Restrict YouTube Access and select either Strict or Moderate.
SSL/SSH profile certificate handling changes (373835)
In order to support DSA and ECDSA key exchange (in addition to RSA) in SSL resign and replace mode, CLI commands for deep-inspection have changed. The certname command in ssl-ssh-profile has been removed.
To select from the list of available certificates in the system, use the CLI below.
edit deep-inspection set server-cert-mode re-sign set certname-{rsa | dsa | ecdsa}
Fortinet bar option disabled in profile protocol options when VDOM is in flow-based inspection mode (384953)
In order to prevent the Fortinet Bar from being enabled and redirecting traffic to proxy (WAD) when a VDOM is in flow-based mode, the Fortinet Bar option is disabled in profile protocol options.
New diagnose command to delete avatars (388634)
Commands to delete avatars by FortiClient UID or avatar name have been added to the CLI.
the two following commands has been added to diagnose endpoint avatar: l diagnose endpoint avatar delete <ftcl_uid> l diagnose endpoint avatar delete <ftcl_uid> <username>
The attribute delete did not exist before. The values <fctl_uid> and <user_name> describe a set of avatars. If only <fctl_uid> is defined, all avatars belonging to this FortiClient UID that are not being used will be removed. If both values are defined, the avatar belonging to them will be removed unless they are being used in which case this call will cause an error to user.