Antivirus event generation depends on inspection path profile selection and log delivery configuration describes a distinct situation, for example when a scheduled threat exercise produces no antivirus event although the file has a supported signature. Here the relevant FortiOS behavior is that application recognition and traffic shaping can enforce differentiated treatment of supported traffic classes.

Application signatures require sufficient observable traffic characteristics for reliable identification describes a distinct situation, for example when users bypass a prohibited application signature after switching clients to an alternative encrypted protocol. Here the relevant FortiOS behavior is that application recognition and traffic shaping can enforce differentiated treatment of supported traffic classes.

IPS event metadata together with session logs can attribute an observed signature to a flow describes a distinct situation, for example when an IPS detection event is present but analysts cannot determine which internal host initiated the suspicious traffic. Here the relevant FortiOS behavior is that application recognition and traffic shaping can enforce differentiated treatment of supported traffic classes.

A failure-injection drill preserves permitted critical flows through a separately monitored alternate path could show improvement in a separate Fortinet case, for instance when a partially redundant VPN deployment sends some applications through a single shared head-office tunnel despite another path being available. The actual verification here is that large packet and application tests complete below the verified effective tunnel MTU.

The known test peer maps to the designated tunnel while an unknown identity is rejected could show improvement in a separate Fortinet case, for instance when two IPsec tunnels use the same outbound WAN port but should accept only one known partner identity per tunnel. The actual verification here is that large packet and application tests complete below the verified effective tunnel MTU.

The new peer establishes the intended IKE and child SAs while the obsolete endpoint is unused could show improvement in a separate Fortinet case, for instance when a backup IPsec peer remains configured after the retired partner gateway changes its public address. The actual verification here is that large packet and application tests complete below the verified effective tunnel MTU.

FGCP membership requires compatible members and shared HA configuration for election and synchronization describes a distinct situation, for example when two FortiGates refuse to join the same FGCP high-availability cluster after installation. Here the relevant FortiOS behavior is that FortiGate logging records matching context that can distinguish the policy responsible for a session.

Secure private application access requires both identity-based permissions and service reachability describes a distinct situation, for example when a FortiSASE user can log in but cannot reach a private application behind a branch FortiGate. Here the relevant FortiOS behavior is that FortiGate logging records matching context that can distinguish the policy responsible for a session.

Administrative access protocols and source restrictions control exposure of the FortiGate management plane describes a distinct situation, for example when a freshly installed FortiGate allows administrative HTTPS from an untrusted transit network. Here the relevant FortiOS behavior is that FortiGate logging records matching context that can distinguish the policy responsible for a session.

Route installation preference uses attributes including administrative distance before ECMP decisions describes a distinct situation, for example when a network engineer configures two equal destination routes but one has a lower administrative distance. Here the relevant FortiOS behavior is that member selection policies can control cost-aware path use while honoring application performance requirements.

SD-WAN service rules select eligible links for traffic classes independently of simple interface naming describes a distinct situation, for example when a branch wants to use cheap broadband for routine web browsing and reserve its private circuit for finance apps. Here the relevant FortiOS behavior is that member selection policies can control cost-aware path use while honoring application performance requirements.

SD-WAN policies can choose routes based on measured latency jitter and packet loss describes a distinct situation, for example when a voice application suffers jitter when FortiGate distributes sessions between a low-latency and overloaded WAN link. Here the relevant FortiOS behavior is that member selection policies can control cost-aware path use while honoring application performance requirements.

Assign the narrow firewall policy to the appropriate time schedule and validate boundary behavior could correct a different FortiGate problem, such as when a weekend maintenance exception must expire when business traffic resumes on Monday. The current case requires scope FSSO identity-based rules to the correct interface address zone and group matches for its particular control path.

Use distinct source interface or address matches to separate tenant firewall policies could correct a different FortiGate problem, such as when two tenant VLANs share the same destination but must have different permitted services. The current case requires scope FSSO identity-based rules to the correct interface address zone and group matches for its particular control path.

Replace an all-services broad policy with specific approved source destination and service objects could correct a different FortiGate problem, such as when an internal accounting application should use only TCP 443 to a defined partner subnet. The current case requires scope FSSO identity-based rules to the correct interface address zone and group matches for its particular control path.

Creating a second tunnel without route selection can leave the standby unused during outages can be a real concern elsewhere, such as when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. In the present scenario the key failure is that a correct IP route cannot establish a tunnel when Phase 1 proposal negotiation fails.

An unscoped wildcard peer configuration may accept or route unexpected incoming negotiations can be a real concern elsewhere, such as when two IPsec tunnels use the same outbound WAN port but should accept only one known partner identity per tunnel. In the present scenario the key failure is that a correct IP route cannot establish a tunnel when Phase 1 proposal negotiation fails.

Assuming branch-to-branch traffic is automatically permitted through the hub ignores policy and routing can be a real concern elsewhere, such as when a business must connect three branches to headquarters while limiting unnecessary branch-to-branch connections. In the present scenario the key failure is that a correct IP route cannot establish a tunnel when Phase 1 proposal negotiation fails.

Installing more IPS signatures does not necessarily expose encrypted application request bodies can be a real concern elsewhere, such as when a known malicious HTTP payload passes although its IPS sensor exists and the firewall policy uses no SSL decryption. In the present scenario the key failure is that assuming one exact hostname automatically covers every sibling subdomain leads to inconsistent filtering.

A web filter configured but never referenced by active traffic does not enforce the category policy can be a real concern elsewhere, such as when a web-filter policy is attached to the wrong firewall rule and blocked sites remain reachable. In the present scenario the key failure is that assuming one exact hostname automatically covers every sibling subdomain leads to inconsistent filtering.

One previously established session does not prove that a newly modified signature action is ignored can be a real concern elsewhere, such as when an administrator changes an application-control signature action but the client continues using an established session. In the present scenario the key failure is that assuming one exact hostname automatically covers every sibling subdomain leads to inconsistent filtering.

Configure a permitted source NAT IP pool for the matching outbound policy could correct a different FortiGate problem, such as when a partner requires the organization to use one known public IP that differs from the FortiGate WAN address. The current case requires verify the VIP external mapping and matching firewall policy destination interface and service for its particular control path.

Use the SD-WAN zone as the relevant policy egress interface with the approved source and services could correct a different FortiGate problem, such as when a branch uses an SD-WAN zone with two WAN members but its firewall policy names only a member interface. The current case requires verify the VIP external mapping and matching firewall policy destination interface and service for its particular control path.

Review central NAT mode and modify the appropriate central SNAT map entries could correct a different FortiGate problem, such as when a service uses central SNAT controls but an administrator edits policy NAT and sees no expected change. The current case requires verify the VIP external mapping and matching firewall policy destination interface and service for its particular control path.

FortiGate security profiles operate on traffic selected by the relevant enabled firewall policy describes a distinct situation, for example when a security profile was attached to a policy but does not inspect a flow that hits another earlier allow policy. Here the relevant FortiOS behavior is that stateful DNAT depends on response packets returning through the translation session path.

FSSO identity lookup depends on timely authenticated-user events and accurate IP mappings describes a distinct situation, for example when a domain controller agent is forwarding events but FortiGate FSSO still marks several user IPs unknown. Here the relevant FortiOS behavior is that stateful DNAT depends on response packets returning through the translation session path.

Local user authentication and remote identity services have different availability and audit dependencies describes a distinct situation, for example when a firewall deployment has local emergency users and a remote RADIUS service that may be unreachable. Here the relevant FortiOS behavior is that stateful DNAT depends on response packets returning through the translation session path.

A known blocked category returns the expected denial page and a permitted category loads normally could show improvement in a separate Fortinet case, for instance when a school wants to prevent students from visiting known malicious website categories on permitted web traffic. The actual verification here is that the legitimate transaction succeeds and unrelated synthetic exploit traffic is still blocked.

The authorized EICAR test download is blocked and an antivirus event is recorded could show improvement in a separate Fortinet case, for instance when an outbound policy has antivirus enabled but a harmless EICAR test downloaded over HTTPS is not detected. The actual verification here is that the legitimate transaction succeeds and unrelated synthetic exploit traffic is still blocked.

A newly created prohibited application session is classified and blocked as intended could show improvement in a separate Fortinet case, for instance when an administrator changes an application-control signature action but the client continues using an established session. The actual verification here is that the legitimate transaction succeeds and unrelated synthetic exploit traffic is still blocked.

A healthy IKE Phase 1 by itself does not guarantee any encrypted application packets can traverse can be a real concern elsewhere, such as when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. In the present scenario the key failure is that changing only the local tunnel description cannot redirect IKE packets to the new peer.

Creating a second tunnel without route selection can leave the standby unused during outages can be a real concern elsewhere, such as when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. In the present scenario the key failure is that changing only the local tunnel description cannot redirect IKE packets to the new peer.

An established IPsec session does not mean a BGP neighbor is exchanging the desired private prefixes can be a real concern elsewhere, such as when a customer switches from static VPN routes to BGP and assumes the IPsec tunnel automatically starts advertising every prefix. In the present scenario the key failure is that changing only the local tunnel description cannot redirect IKE packets to the new peer.