Both peers report matching child SAs and permitted private traffic is encrypted could show improvement in a separate Fortinet case, for instance when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. The actual verification here is that bidirectional captures show both directions protected by the intended VPN security associations.

The route lookup resolves to the tunnel and a permitted remote host responds could show improvement in a separate Fortinet case, for instance when a site-to-site tunnel remains listed as up but its local subnet has no route toward the remote protected prefix. The actual verification here is that bidirectional captures show both directions protected by the intended VPN security associations.

Negotiated selectors and encrypted ingress egress counters increase during the test flow could show improvement in a separate Fortinet case, for instance when an operator mistakes the route-based tunnel interface being enabled for proof that its child SA is active. The actual verification here is that bidirectional captures show both directions protected by the intended VPN security associations.

A physically up primary interface can be unusable beyond its next hop without path monitoring can be a real concern elsewhere, such as when a server subnet needs redundant internet routes but the backup should activate only when primary path fails. In the present scenario the key failure is that configuration entry order alone is not the basis of FortiGate route installation.

Treating a configuration entry as a verified active path can hide an unreachable next hop can be a real concern elsewhere, such as when an administrator created a static route for a cloud subnet but the route remains inactive in the routing monitor. In the present scenario the key failure is that configuration entry order alone is not the basis of FortiGate route installation.

Gateway ping success can hide an upstream outage that breaks the business destination can be a real concern elsewhere, such as when a health check marks an ISP usable because its gateway replies but a critical SaaS service is unreachable beyond it. In the present scenario the key failure is that configuration entry order alone is not the basis of FortiGate route installation.

A single collector failure can prevent fresh user mappings despite healthy directory controllers can be a real concern elsewhere, such as when a branch FortiGate loses access to FSSO authentication when its primary collector service stops. In the present scenario the key failure is that using outdated IP mappings may grant policy access to a different person reusing the same address.

Editing an interface-address policy NAT setting may not override the active central SNAT table can be a real concern elsewhere, such as when a service uses central SNAT controls but an administrator edits policy NAT and sees no expected change. In the present scenario the key failure is that using outdated IP mappings may grant policy access to a different person reusing the same address.

Binding policy only to one member can break desired failover as sessions change links can be a real concern elsewhere, such as when a branch uses an SD-WAN zone with two WAN members but its firewall policy names only a member interface. In the present scenario the key failure is that using outdated IP mappings may grant policy access to a different person reusing the same address.

Apply explicit policy controls and a documented blackhole route only where appropriate could correct a different FortiGate problem, such as when an isolated guest subnet must not use a broad route to reach a prohibited private destination. The current case requires create an SD-WAN service rule favoring links that meet voice performance SLA requirements for its particular control path.

Correct the gateway and egress interface in the active FortiOS static route could correct a different FortiGate problem, such as when an office network cannot leave through a new internet circuit because its static default route references an unreachable gateway. The current case requires create an SD-WAN service rule favoring links that meet voice performance SLA requirements for its particular control path.

Bind the outbound firewall policy to the supported SD-WAN zone with correct source address conditions could correct a different FortiGate problem, such as when an SD-WAN zone contains two links but a forward firewall policy references the physical port instead of the zone. The current case requires create an SD-WAN service rule favoring links that meet voice performance SLA requirements for its particular control path.

Testing each external port reaches only its assigned internal application could show improvement in a separate Fortinet case, for instance when two applications behind one public IP must expose different TCP ports to different backend servers. The actual verification here is that the test flow records the required security-profile decision on the actual matching policy.

The encrypted LDAP connection validates the expected certificate and authenticates test users could show improvement in a separate Fortinet case, for instance when a business wants external identity verification but does not want plaintext directory passwords sent across the WAN. The actual verification here is that the test flow records the required security-profile decision on the actual matching policy.

A permitted test authentication returns a timely accept response associated with the right group could show improvement in a separate Fortinet case, for instance when a remote RADIUS server accepts user credentials but FortiGate times out on every login attempt. The actual verification here is that the test flow records the required security-profile decision on the actual matching policy.

Add the required static or dynamic route to the route-based IPsec tunnel interface could correct a different FortiGate problem, such as when a site-to-site tunnel remains listed as up but its local subnet has no route toward the remote protected prefix. The current case requires design a meshed IPsec topology with explicit per-peer routes and narrow firewall authorization for its particular control path.

Inspect IKE status Phase 2 selectors and tunnel packet counters for a test data flow could correct a different FortiGate problem, such as when an operator mistakes the route-based tunnel interface being enabled for proof that its child SA is active. The current case requires design a meshed IPsec topology with explicit per-peer routes and narrow firewall authorization for its particular control path.

Measure effective path MTU and adjust supported TCP MSS or encapsulation settings could correct a different FortiGate problem, such as when a datacenter tunnel carries pings but large application transfers repeatedly stall after enabling an overlay. The current case requires design a meshed IPsec topology with explicit per-peer routes and narrow firewall authorization for its particular control path.

Stateful private traffic needs compatible forward and reverse paths through negotiated IPsec interfaces describes a distinct situation, for example when an IPsec tunnel encrypts traffic but a routing misconfiguration sends return packets over the public WAN. Here the relevant FortiOS behavior is that redundant VPN availability depends on both physical diversity and predictable route convergence.

A full-mesh VPN introduces direct tunnel paths but increases peer configuration and key management describes a distinct situation, for example when a regional enterprise wants direct private connectivity between every pair of its small number of sites. Here the relevant FortiOS behavior is that redundant VPN availability depends on both physical diversity and predictable route convergence.

A hub-and-spoke VPN can aggregate branch connectivity without a full mesh of direct tunnels describes a distinct situation, for example when a business must connect three branches to headquarters while limiting unnecessary branch-to-branch connections. Here the relevant FortiOS behavior is that redundant VPN availability depends on both physical diversity and predictable route convergence.

Encrypted payload detection requires TLS decryption before content scanners can read the downloaded file describes a distinct situation, for example when an administrator enables deep SSL inspection but HTTPS downloads pass through antivirus without file scans. Here the relevant FortiOS behavior is that logging malware identification and preventing content delivery are distinct antivirus outcomes.

Applications that pin a specific certificate may reject authorized TLS interception even when enterprise CA is trusted describes a distinct situation, for example when managed endpoints trust FortiGate deep inspection but certificate pinning breaks one critical finance application. Here the relevant FortiOS behavior is that logging malware identification and preventing content delivery are distinct antivirus outcomes.

Application recognition and traffic shaping can enforce differentiated treatment of supported traffic classes describes a distinct situation, for example when a research group wants to limit streaming media bandwidth but preserve interactive meeting traffic. Here the relevant FortiOS behavior is that logging malware identification and preventing content delivery are distinct antivirus outcomes.

System status and interface diagnostics establish the actual software and network state before changing policies describes a distinct situation, for example when a FortiGate administrator needs the interface status and build version before opening a troubleshooting case. Here the relevant FortiOS behavior is that per-member management provides out-of-band visibility without changing the virtual cluster traffic identity.

Traffic log generation depends on policy logging choices separately from threat detection alerts describes a distinct situation, for example when security analysts cannot find allowed outbound flows because the matching policy records only security events. Here the relevant FortiOS behavior is that per-member management provides out-of-band visibility without changing the virtual cluster traffic identity.

Coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift describes a distinct situation, for example when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. Here the relevant FortiOS behavior is that per-member management provides out-of-band visibility without changing the virtual cluster traffic identity.

Application control identifies supported application behavior beyond the transport port used by a session describes a distinct situation, for example when a company wants to prevent peer-to-peer file sharing without blocking all outbound TCP 443 traffic. Here the relevant FortiOS behavior is that IPS event metadata together with session logs can attribute an observed signature to a flow.

Logging malware identification and preventing content delivery are distinct antivirus outcomes describes a distinct situation, for example when an antivirus alert is shown in monitor mode but the malware test file still reaches the endpoint. Here the relevant FortiOS behavior is that IPS event metadata together with session logs can attribute an observed signature to a flow.

Antivirus event generation depends on inspection path profile selection and log delivery configuration describes a distinct situation, for example when a scheduled threat exercise produces no antivirus event although the file has a supported signature. Here the relevant FortiOS behavior is that IPS event metadata together with session logs can attribute an observed signature to a flow.

A visible certificate common name alone cannot reliably expose arbitrary encrypted URL paths can be a real concern elsewhere, such as when an administrator uses a certificate-inspection-only policy but expects a path-specific HTTPS URL rule to match. In the present scenario the key failure is that disabling the full IPS profile because of one false positive removes protection for unrelated signatures.

Disabling deep inspection for every destination to solve one pinned client greatly reduces coverage can be a real concern elsewhere, such as when managed endpoints trust FortiGate deep inspection but certificate pinning breaks one critical finance application. In the present scenario the key failure is that disabling the full IPS profile because of one false positive removes protection for unrelated signatures.

Expecting certificate inspection to read encrypted URL paths or file contents will miss threats can be a real concern elsewhere, such as when a firewall team wants URL-domain filtering of encrypted web sessions without inspecting application payloads. In the present scenario the key failure is that disabling the full IPS profile because of one false positive removes protection for unrelated signatures.