A new major release of FortiOS is always an exciting time in the Fortinet ecosystem, because it gives the direction on where Fortinet wants to take Fortinet and, of course, FortiGate.
7.0 brought us the Zero Trust Network Access (ZTNA) features, for example, and that is still a big talking point.
I want to take this post to focus on new features, big and small, that I think are interesting, both from an operational viewpoint as someone in the field, as well as features Fortinet wants you to know about.
So, dear reader, join me in going through the depths of the FortiOS 8.0 New Features guide to find out what 8.0 has got to offer.
Note: Some features don’t have an entry in the New Features guide. In these cases, I will link to the release notes with the corresponding feature ID and, if available, supplemental documentation.
Custom tags for objects and policies
I am putting this one first, because its usefulness might otherwise slip through the cracks, and it would be a shame, because the feature is awesome and quite possibly my number 1 feature in 8.0.
At first glance, it just looks like you can attach the tag to things to make elements stand out, but where it shines is with address objects and address groups.
Imagine a scenario where you have a fleet of Linux servers that all need to get to a repository for updates. Previously, you had to create your servers as address objects, optionally add them to a group, and then use either the object itself or the group in a policy.
With tags, you can put the tag on the server address object, use the tag in an address group and use the group in a policy. Every additional Linux server gets an object with a tag, and you’re done. This makes the process more dynamic, and deleting individual objects is also easier, because there is no reference to a group.
I’m sure you can already think of some fantastic use cases for this, because I sure can.
Fortinet has a nice video demonstrating this, so I don’t have to make one.
FortiOS 8.0: Dynamic Tag Based Address Group
Using these tags for policies is a nice bonus, but I don’t see that much use here outside of filtering. If you want to tag your policies, be sure to first enable the feature Policy Tagging in Feature Visibility.
Fabric Feeds
Cloud-based Fabric Feed synchronization | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
This is a combined new feature, because it also requires FortiAnalyzer 8.0, but it’s too cool not to mention.
With fabric feeds, you can leverage the Fortinet Message Queue (FortiMQ) fabric to synchronize threat feeds across your fabric, with FortiAnalyzer being at the heart of it. On FortiAnalyzer, you can block indicators (IPs, domains, URLs, and MAC addresses), and these get synchronized to all FortiGates that are registered under the same FortiCloud account as fabric feeds.
These fabric feeds are configured in the same place as external feeds and act much the same way in how you handle and use them. Use IP and MAC feeds in policies, domains in DNS filters, and URLs in web filters as categories.
If you think this is useful, but don’t want to upgrade to 8.0, I understand your hesitation; you might be in luck. A very similar feature exists in 7.6, except it also requires FortiManager.
Blocking indicators | FortiAnalyzer 7.6.6 | Fortinet Document Library
In this configuration, indicators are blocked on FortiAnalyzer; this information is sent to FortiManager using a playbook, and FortiManager hosts these indicators as threat feeds for FortiGates to consume.
TLS 1.3 based VPN over TCP
TLS 1.3 based VPN over TCP | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
I’m putting this feature here for the future, because as it stands, it’s something you should look forward to, but it isn’t all that useful right now.
IKE over TCP has been a thing for quite some time now, and while it works, it has the distinct downside of not being TLS traffic, meaning that application-based firewalls don’t recognize it as such, even if it uses TCP/443 as its port and protocol. This can be a problem for employees on the go, because wherever they are, their non-TLS application traffic might get blocked.
With this feature, the entire IKE communication gets wrapped in a nice TLS 1.3 bow and is sent out into the world, passing itself off as any other communication you might expect on a network that allows TCP/443.
This feature also fills the requirement of TLS-based VPN being available, which 7.6 lost with 7.6.3, since SSL-VPN was deprecated.
The reason I wrote that this feature is for the future is that, at the time of writing (April 2026), FortiClient does not support this. It should come with FortiClient 8.0, but right now, it’s only FortiGates that can use this feature.
High Availability actions in the GUI
Before 8.0, lots of HA processes were CLI-only, like resyncs, forced failovers, configuration difference checks, etc. With 8.0, you can perform these things directly in the GUI, which makes this topic more approachable.
You now also get a quick overview of some vital statistics, like RAM usage and checksums.
Note: The failover in the GUI uses the not-so-nice static and manual failover method under the hood. This means that if you want to perform a failback, you have to do so manually. Due to this, I would not recommend using it, except, as the link says, for testing and demonstrations. If you want to perform a lasting failover, continue using the diagnose sys ha reset-uptime method on the CLI, which assumes you are outside the ha-uptime-diff-margin window.
DHCP templates
New features or enhancements | FortiGate / FortiOS 8.0.0 | Fortinet Document Library (Feature ID 1130044)
config system dhcp template | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
If you needed a lot of similar DHCP servers on your FortiGate, you previously had to create them individually per interface, and if you ever needed to make changes, like a new DNS or NTP server, you had to edit each entry. With DHCP templates, you can create one template entry and attach it to each interface. Pretty easy to see the value in this new feature.
In the GUI, you can find the DHCP Templates option in Network -> IPAM -> DHCP Templates. You can also create DHCP templates inline while configuring a DHCP server. You first have to enable the DHCP server option on the interface, then the DHCP template option, and in the dropdown, click on the + to get to the wizard. In the CLI, the configuration is under config system dhcp template.
Once there, you can set all options you normally can in the GUI as well. Some options, like the domain, continue to be CLI-only.
One thing I want to expand on here is how the Excluded ranges option works in the template, because, at least to me, it was not immediately obvious.
When you add an excluded range, you have a field titled Offset (start-ip-index in the CLI) and Number of addresses to reserve (ip-count in the CLI).
Offset in this case means at which IP does the excluded range start, and the number of addresses to reserve is the number of reserved IPs after, and including, the offset IP.
Let’s look at an example, using the DHCP template from above.
If you turn on the DHCP server debugs (diagnose debug application dhcps -1) on the CLI, we get the following output after enabling debugs and applying the template:
[debug]setting up address range 192.0.2.1 - 192.0.2.9
[debug]setting up address range 192.0.2.30 - 192.0.2.59
[debug]setting up address range 192.0.2.70 - 192.0.2.254The first excluded range has the offset 10, so the first excluded IP is 192.0.2.10. The reserved addresses are set to 20, so, including .10, we have 20 reserved IPs, which gives us a range from 192.0.2.10 to 192.0.2.29.
The second excluded range has the offset 60, so the first excluded IP is 192.0.2.60. The reserved addresses are set to 10, so, including .60, we have 10 reserved IPs, which gives us a range from 192.0.2.60 to 192.0.2.69.
Everything outside the excluded ranges is fair game for DHCP leases.
SD-WAN member selection based on monthly traffic volume
A big benefit of SD-WAN on FortiGates is that you can use whatever as your local internet breakout, and lots of sites are using 5G/LTE modems, which usually have a monthly traffic limit. If the limit is reached, you are often capped on your speed or incur additional costs. Using this new feature, you can set various parameters regarding your monthly quota and what should happen if your quota is reached (increasing the cost if using a Lowest cost SLA, for example), so you can deprioritize the SD-WAN member.
SD-WAN on-demand duplication
Duplication, in relation to SD-WAN, is the act of sending duplicates of packets to another FortiGate to overcome link problems, like high latency or packet loss. Using this new feature, the hub in an SD-WAN deployment can enable duplication based on the received SLA information from a spoke.
The hub usually has a remote SLA, which measures the spoke’s connection status, using the spoke’s embedded SLA information in its ICMP probes towards the hub. If the spoke is out of SLA, the hub can now enable duplication dynamically to send duplicate packets, in the hope that this is enough to provide a good experience for users on the spoke’s site.
Changes to ZTNA configuration
ZTNA configuration simplification | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
8.0 has overhauled how you configure ZTNA, both in the GUI and on the CLI. Fortinet calls it a simplification, and maybe this is true; only time will tell, but it’s a bit of a shakeup from before and will take some time to get used to.
Instead of, for example, creating, at least in the GUI, only a ZTNA server, which has everything in it, you now create:
- A port, which holds the information on how your clients connect
- A traffic forwarding server, which binds the port and is used in your policies
- Destinations, which are the resources accessed using the traffic forwarding server and are also used in your policies
The decoupling of the traffic forwarding server and the destinations is definitely where I can see the greatest enhancement, because it promotes reusability instead of duplication.
[Update 2026-05-08]: Since writing this post, I have created a blog post and video about how to configure ZTNA on 8.0 with a Microsoft Entra integration for SAML SSO. I actually like the new way more.
FortiGate 8.0 ZTNA configuration – All methods + Entra SAML SSO – KNS | ˈkɛvɪn netsec
Post-quantum cryptography
A maybe unexpected big focus of 8.0 is post-quantum cryptography (PQC). PQC isn’t a new thing in FortiOS, with Post-Quantum Preshared Keys (PPK) having been implemented in FortiOS 7.2, and quantum-safe algorithms like ML-KEM and HQC being in 7.6, but 8.0 brings some more things.
Fortinet has its own Quantum Security Hub if you want to read more about this topic in relation to Fortinet solutions, but let’s look at practical things.
HTTPS and SSH management use quantum-safe algorithms
New features or enhancements | FortiGate / FortiOS 8.0.0 | Fortinet Document Library (Feature ID 1202253)
If you access the FortiGate GUI with a browser that uses quantum-safe algorithms, you will automatically use X25519MLKEM768 to connect. This behaviour, to my knowledge, cannot be changed in FortiOS, which is not a bad thing.
On the CLI, you can find mlkem768x25519-sha256 as a default SSH key exchange algorithm.
FGT-80-REVIEW(Primary) # get system ssh-config | grep ssh-kex-algo
ssh-kex-algo : diffie-hellman-group14-sha256 diffie-hellman-group16-sha512 diffie-hellman-group18-sha512 diffie-hellman-group-exchange-sha256 curve25519-sha256@libssh.org ecdh-sha2-nistp256 ecdh-sha2-nistp384 ecdh-sha2-nistp521 mlkem768x25519-sha256Proxy-mode deep inspection supports hybrid PQC
If you perform deep inspection in a proxy-mode policy, connections are no longer downgraded to a non-hybrid PQC algorithm, bringing an immediate security benefit.
Agentless VPN supports PQC
New features or enhancements | FortiGate / FortiOS 8.0.0 | Fortinet Document Library (Feature ID 1152420)
Agentless VPN, or SSL-VPN web mode for the old-timers, can now use post-quantum and hybrid post-quantum key exchange groups to secure client access.
FGT-80-REVIEW(Primary) # config vpn ssl settings
FGT-80-REVIEW(Primary) (settings) # set tls-groups
P-521 P-521
P-384 P-384
P-256 P-256
ML-KEM512 ML-KEM512
ML-KEM768 ML-KEM768
ML-KEM1024 ML-KEM1024
P-384-MLKEM1024 P-384-MLKEM1024
P-256-MLKEM768 P-256-MLKEM768
X25519-MLKEM768 X25519-MLKEM768
X448 X448
X25519 X25519
FFDHE2048 FFDHE2048
FFDHE3072 FFDHE3072
FFDHE4096 FFDHE4096
FFDHE6144 FFDHE6144
FFDHE8192 FFDHE8192Artificial Intelligence
We all knew it would come, but Artificial Intelligence (AI) is now in FortiOS in earnest. Previously, AI-anything, in FortiOS, was used for things like anti-virus for malware scanning and recognizing and controlling AI-usage using application control, but now we have so much more, beginning with…
FortiAI-Assist
FortiAI assistant and CLI Code Lab | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
If you have used FortiManager or FortiAnalyzer in 7.6, you should be familiar with FortiAI-Assist, but Fortinet puts it best in explaining this new feature:
“FortiAI can answer technical questions by using the FortiOS documentation and troubleshoot issues by reading logs directly from FortiGate or by analyzing debug outputs provided by administrators. The CLI Code Lab tool helps administrators use natural language prompts to generate and execute complex FortiGate configurations.”
The option to choose between FortiAI and OpenAI as the provider is nice if you already have an OpenAI plan and don’t want to spend additional money on tokens, though, depending on your FortiCare support status, you get a good amount of FortiAI tokens per month.
Messages sent to FortiAI use data masking, so sensitive data, like IPs, email addresses, URLs, etc., is masked. The documentation doesn’t make it clear, but I assume it uses the same method as FortiAnalyzer and FortiManager and to-be-masked data is replaced with bogus information before being sent to the LLM and after receiving a response, the replacement is undone.
The new features entry gives some examples of what you can do, but let’s see what else it can do, like figuring out why a subnet cannot access the internet based only on a prompt (spoiler: I disabled SNAT on the policy).
Evidently, there are some issues with FortAI and accessing FortiGate configuration and diagnosis. Maybe these are guardrails, but for the time being, I have only executed the debug flow commands because FortiAI put an “especially” there.
If you click on the “Completed thought process” button, you can also see what steps are being performed in all of this.
Let’s give it the debug output and check again.
So it gave some good information here, but the important command, get firewall policy 1, does not work. Another try, and it delivered the correct command and also the solution.
As another example, let’s see how it handles local-in policy creation.
It took just a bit of help, but it got there. The logtraffic setting doesn’t exist, but I’m not going to hold it against it. In my prompt, you can also see that masked pieces of information are highlighted.
CLI Code Lab
FortiAI assistant and CLI Code Lab | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
This is not an AI feature, but it was introduced with it, so I put it in this section to not spoil the surprise of FortiAI-Assist.
The CLI Code Lab is awesome. If tags are my number 1, this is my number 2. What the CLI Code Lab offers is a no-fuss method to access the stage-and-commit/transaction feature in FortiOS.
You write your configuration in the code lab, execute it, which creates a transaction, and then you can commit it. The great thing is that the transactions are not immediately being written to memory, i.e. the running configuration, so you can do several configurations and only commit them if you are happy with the outcome. This helps when you need to make changes that, if done individually, would cut off your access, for example. There are ways around that, like scripts, but the code lab gives immediate feedback if something wouldn’t work, and it’s not committed immediately.
Here is an example flow of me changing the hostname, it not immediately being reflected in the CLI, showing the transaction information, and verifying the new hostname on the CLI after commiting the changes.
FGT-80-REVIEW(Primary) # get system global | grep hostname
gui-display-hostname: disable
hostname : FGT-80-REVIEW
FGT-80-REVIEW(Primary) # diagnose sys config-transaction show txn-info
txn_id=4, expire=11 seconds, user='admin', userfrom='https(192.168.1.101)', clicmd_fpath='/dev/cmdb_priv/txn/4_ELjGss.conf'
FGT-80-REVIEW(Primary) # diagnose sys config-transaction show txn-cli-commands 4
config system global
set hostname "CLI-CODE-LAB"
end
COMMIT CHANGES IN THE GUI
CLI-CODE-LAB(Primary) # get system global | grep hostname
gui-display-hostname: disable
hostname : CLI-CODE-LABThe way the code lab does its thing, i.e. using transactions, isn’t anything new. In the background, it uses workspace mode, introduced in 6.2, and the corresponding transaction process, but now we have a GUI way to use this feature, making it more approachable. Again. Awesome. One thing that I hope the code lab gets in the future is syntax autocomplete, like FortiManager.
Use AI and ML to detect malicious activity in DNS traffic
New features or enhancements | FortiGate / FortiOS 8.0.0 | Fortinet Document Library (Feature ID 1157379)
DNS is an often-used candidate for data exfiltration and command-and-control traffic, so this new feature, if it works well, is an easy win.
This feature also comes with a whitelist of some domains that are exempted from this type of scanning, which I’m not a fan of.
There doesn’t seem to be any information on how it works, or if you can configure it in any way, so we just have to rely on it working correctly.
MCP and A2A detection support
Agentic AI protocol support in FortiOS | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
Model Context Protocol (MCP) is a protocol that connects AI applications to external systems, so that the individual applications don’t need individual methods to access external systems. The MCP server acts as a kind of translator so the two sides can communicate with each other.
The Agent2Agent (A2A) Protocol is used by AI agents to communicate with each other using a shared language.
FortiOS 8.0 can now detect applications using these protocols and also display detailed information about what is happening in these communications.
Imagine a developer using Visual Studio Code connected to an MCP server. If the developer interacts with the GitHub repository through the MCP server, the accessed files, issues, etc., can be recognized in logs now.
With the growing adoption of MCP, this functionality becomes more and more important.
Rapid-fire new features
Let’s hammer out some new features quickly, because I do believe they are important, but there isn’t much to say about these.
Managed FortiSwitch trusted hosts and Private Data Encryption
Both trusted hosts and Private Data Encryption aren’t new to FortiSwitchOS, but before 8.0, you had to painstakingly configure these manually on each FortiSwitch or by using custom commands. With FortiOS 8.0, you can now do this using the switch controller feature, making securing your FortiSwitches that much easier.
HA role is visible in CLI prompts
HA role shown in CLI prompt | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
A feature I loved on Cisco ASAs, and missed on FortiGates, is knowing immediately, on the CLI, if the current device is a primary or a secondary. Now this is possible, and using get system status or get system ha status is no longer necessary for this.
Log summary panel
Summary panel in Log Details | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
Forward Traffic logs now display a summary panel in the details that gives you a quick overview of the most important things, like the policy ID, policy action and why something was blocked, including UTM profile and action. This feature got lost in a previous version (I want to say 7.2) due to other changes, and now we have it back.
Disallowed login methods per administrator
Administrator access hardening | FortiGate / FortiOS 8.0.0 | Fortinet Document Library
You can now restrict certain administrators from using specific login methods. This feature is especially useful because you can restrict console logins, meaning that you can make a break-glass administrator account that can only use the console and disallow it for all others.
FortiAP IPsec traffic offloading
Managed FortiAPs, by default, send their data traffic in cleartext. Previously, if you enabled a secure channel for this type of traffic, it wasn’t offloaded. With IPsec, it is now, increasing security at little to no loss in data throughput.
FortiClient can send security posture tags to FortiOS directly for VPN connections
FortiClient 7.4.5 and FortiClient EMS 7.4.4 introduced the concept of the ZTNA Token, which improves ZTNA tag resiliency because the tags could be sent to a FortiGate in JSON Web Token (JWT) format, and if EMS is not available, tags could still function. The feature can now be used for VPN connections.
Application sanctioning
Applications can now be marked as sanctioned and unsanctioned. This status can be used in Application and Filter Overrides to easily allow only specific applications, especially since you can change the default application classification to unsanctioned. That way, you have to manually sanction applications.
The negative one: Changes to revisions
It’s not all good in FortiOS 8.0. The changes to revisions on FortiGates are simply bad.
You can no longer use revisions in any way if your FortiGate does not have a hard disk.
I assume this was done for performance reasons, but it still sucks to see it.
The most important one: Custom GUI themes
No longer do we have to rely on Fortinet-provided themes for the GUI. With a full palette of colors and our own hex code combinations, we can display our FortiGate in our colors and give every administrator the choice to pick their own theme.
Take this moment to join me in a hot pink FortiOS.
config system theme
edit "HOT-PINK"
set border-radius enable
set header-color "#ff46a2"
set selected-color "#ff46a2"
set call-to-action-color "#ff46a2"
set accent-color "#ff46a2"
set banner-msg ''
next
endJokes aside, this feature was implemented because customers wanted specific colors to classify their firewalls for security and practical reasons. Edge firewalls get a theme, internal firewalls another, testing environments this one, production environments that one, etc.
Wrapping up
[Update 2026-04-27]: Since writing this post, Fortinet has released its own overview video, which covers only a few of the features mentioned in this post. Maybe give it a watch: What’s New in FortiOS 8.0 | Product Overview
Historically, the X.0.0 release gave the direction of where FortiOS is headed and further releases, especially X.0.1, brought lots more interesting features to solidify the direction. At this moment, we can only imagine what such a release holds for us, and I have my own wish list for this, and I’m sure you, dear reader, have your own.
With that, look at the other new features of FortiOS 8.0, and maybe you will find one that you think is just the best.
Leave a Reply