A healthy IKE Phase 1 by itself does not guarantee any encrypted application packets can traverse can be a real concern elsewhere, such as when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. In the present scenario the key failure is that changing only the local tunnel description cannot redirect IKE packets to the new peer.

Creating a second tunnel without route selection can leave the standby unused during outages can be a real concern elsewhere, such as when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. In the present scenario the key failure is that changing only the local tunnel description cannot redirect IKE packets to the new peer.

An established IPsec session does not mean a BGP neighbor is exchanging the desired private prefixes can be a real concern elsewhere, such as when a customer switches from static VPN routes to BGP and assumes the IPsec tunnel automatically starts advertising every prefix. In the present scenario the key failure is that changing only the local tunnel description cannot redirect IKE packets to the new peer.

Assigning a mismatched mode profile may prevent the intended security configuration from operating can be a real concern elsewhere, such as when a proxy-based web filter profile cannot be applied to a policy configured for an incompatible flow inspection mode. In the present scenario the key failure is that a global no-inspection policy would disable intended TLS content controls for unrelated sites.

Assuming a preexisting browser connection proves a new SSL profile is ineffective can mislead debugging can be a real concern elsewhere, such as when an administrator changes inspection profiles while old HTTPS sessions continue using previous trust behavior. In the present scenario the key failure is that a global no-inspection policy would disable intended TLS content controls for unrelated sites.

Blocking all traffic to one entire application port would exceed the stated exploit-specific goal can be a real concern elsewhere, such as when an enterprise wants to block only verified high-severity exploit signatures rather than all unknown web requests. In the present scenario the key failure is that a global no-inspection policy would disable intended TLS content controls for unrelated sites.

Policy-specific traffic logs provide evidence of access decisions in addition to the configured rule text describes a distinct situation, for example when a developer wants to inspect why an allow policy is matched but session logs contain no policy IDs. Here the relevant FortiOS behavior is that redundant collectors reduce dependence on one Windows identity-collection service for passive authentication.

Stateful DNAT depends on response packets returning through the translation session path describes a distinct situation, for example when an application expects symmetric return sessions after publishing a private web server via DNAT. Here the relevant FortiOS behavior is that redundant collectors reduce dependence on one Windows identity-collection service for passive authentication.

Local user authentication and remote identity services have different availability and audit dependencies describes a distinct situation, for example when a firewall deployment has local emergency users and a remote RADIUS service that may be unreachable. Here the relevant FortiOS behavior is that redundant collectors reduce dependence on one Windows identity-collection service for passive authentication.

Add both supported WAN interfaces as SD-WAN members and assign the appropriate zone could correct a different FortiGate problem, such as when a branch has two ISP connections but its SD-WAN member configuration includes only the primary WAN interface. The current case requires review supported SD-WAN session selection and recovery design for that protocol for its particular control path.

Use performance SLA probes toward representative reachable targets with relevant latency and loss thresholds could correct a different FortiGate problem, such as when a health check marks an ISP usable because its gateway replies but a critical SaaS service is unreachable beyond it. The current case requires review supported SD-WAN session selection and recovery design for that protocol for its particular control path.

Correct the gateway and egress interface in the active FortiOS static route could correct a different FortiGate problem, such as when an office network cannot leave through a new internet circuit because its static default route references an unreachable gateway. The current case requires review supported SD-WAN session selection and recovery design for that protocol for its particular control path.

Create an SD-WAN service rule favoring links that meet voice performance SLA requirements could correct a different FortiGate problem, such as when a voice application suffers jitter when FortiGate distributes sessions between a low-latency and overloaded WAN link. The current case requires check next-hop reachability interface state and the route's installation attributes for its particular control path.

Review supported SD-WAN session selection and recovery design for that protocol could correct a different FortiGate problem, such as when an application requires session persistence but users are disconnected when a monitored SD-WAN link changes state. The current case requires check next-hop reachability interface state and the route's installation attributes for its particular control path.

Repair the return-path routing so stateful sessions traverse the expected firewall path could correct a different FortiGate problem, such as when a FortiGate routes inbound traffic to a server but the server returns replies through a different upstream router. The current case requires check next-hop reachability interface state and the route's installation attributes for its particular control path.

Determine the matched policy ID and associate the correct flow or proxy web-filter profile could correct a different FortiGate problem, such as when a web-filter policy is attached to the wrong firewall rule and blocked sites remain reachable. The current case requires use certificate inspection with an appropriate web filter profile for the approved limited visibility for its particular control path.

Restore supported FortiGuard update connectivity and verify antivirus package freshness could correct a different FortiGate problem, such as when a FortiGate antivirus signature database has not been updated after the WAN was disconnected for weeks. The current case requires use certificate inspection with an appropriate web filter profile for the approved limited visibility for its particular control path.

Add a narrowly justified SSL inspection exemption for the pinned application and assess residual risk could correct a different FortiGate problem, such as when managed endpoints trust FortiGate deep inspection but certificate pinning breaks one critical finance application. The current case requires use certificate inspection with an appropriate web filter profile for the approved limited visibility for its particular control path.

Assuming different administrative distances provide true equal-cost balancing is incorrect can be a real concern elsewhere, such as when a data center wants to distribute eligible flows over two same-cost internet links but only one is used. In the present scenario the key failure is that using one unreliable monitoring endpoint can make health status misleading for all applications.

An unused secondary interface cannot carry SD-WAN traffic merely because its cable is connected can be a real concern elsewhere, such as when a branch has two ISP connections but its SD-WAN member configuration includes only the primary WAN interface. In the present scenario the key failure is that using one unreliable monitoring endpoint can make health status misleading for all applications.

A physically up primary interface can be unusable beyond its next hop without path monitoring can be a real concern elsewhere, such as when a server subnet needs redundant internet routes but the backup should activate only when primary path fails. In the present scenario the key failure is that using one unreliable monitoring endpoint can make health status misleading for all applications.

LDAP integration lets FortiGate validate supported directory identities through the specified server describes a distinct situation, for example when employees authenticate with a corporate directory but FortiGate has no LDAP server connector configured. Here the relevant FortiOS behavior is that policy order and actual session matching determine which apparently duplicate rule is effective.

FortiOS central SNAT uses a separate mapping table when the central NAT feature is enabled describes a distinct situation, for example when a service uses central SNAT controls but an administrator edits policy NAT and sees no expected change. Here the relevant FortiOS behavior is that policy order and actual session matching determine which apparently duplicate rule is effective.

Destination NAT via a FortiGate VIP maps the published address or port to the internal destination describes a distinct situation, for example when a public-facing server behind FortiGate must accept HTTPS on a fixed external address. Here the relevant FortiOS behavior is that policy order and actual session matching determine which apparently duplicate rule is effective.

SD-WAN zones and members participate in routing and policy references that survive interface changes describes a distinct situation, for example when an administrator removes a WAN link from the SD-WAN zone without updating route and policy dependencies. Here the relevant FortiOS behavior is that SD-WAN balancing can incorporate configured or measured member capacity rather than treating all links alike.

Route installation preference uses attributes including administrative distance before ECMP decisions describes a distinct situation, for example when a network engineer configures two equal destination routes but one has a lower administrative distance. Here the relevant FortiOS behavior is that SD-WAN balancing can incorporate configured or measured member capacity rather than treating all links alike.

FortiOS firewall policies refer to SD-WAN zones while service rules select members inside the zone describes a distinct situation, for example when an SD-WAN zone contains two links but a forward firewall policy references the physical port instead of the zone. Here the relevant FortiOS behavior is that SD-WAN balancing can incorporate configured or measured member capacity rather than treating all links alike.

Allowing the policy without required NAT can send unroutable RFC1918 source addresses to the internet can be a real concern elsewhere, such as when multiple private office clients need internet access through a single FortiGate public WAN interface. In the present scenario the key failure is that a successful directory bind does not prove the user belongs to the group permitted by the policy.

Creating a firewall group name without functional LDAP connectivity cannot prove user credentials can be a real concern elsewhere, such as when employees authenticate with a corporate directory but FortiGate has no LDAP server connector configured. In the present scenario the key failure is that a successful directory bind does not prove the user belongs to the group permitted by the policy.

An unused policy carrying the strongest profile does not protect flows matched elsewhere can be a real concern elsewhere, such as when a security profile was attached to a policy but does not inspect a flow that hits another earlier allow policy. In the present scenario the key failure is that a successful directory bind does not prove the user belongs to the group permitted by the policy.

Both peers report matching child SAs and permitted private traffic is encrypted could show improvement in a separate Fortinet case, for instance when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. The actual verification here is that bidirectional captures show both directions protected by the intended VPN security associations.

The route lookup resolves to the tunnel and a permitted remote host responds could show improvement in a separate Fortinet case, for instance when a site-to-site tunnel remains listed as up but its local subnet has no route toward the remote protected prefix. The actual verification here is that bidirectional captures show both directions protected by the intended VPN security associations.

Negotiated selectors and encrypted ingress egress counters increase during the test flow could show improvement in a separate Fortinet case, for instance when an operator mistakes the route-based tunnel interface being enabled for proof that its child SA is active. The actual verification here is that bidirectional captures show both directions protected by the intended VPN security associations.