Using the shared primary data-plane address cannot reliably select a particular failed member can be a real concern elsewhere, such as when an administrator cannot reach the secondary FortiGate independently to diagnose its failed hardware sensor. In the present scenario the key failure is that assuming every existing connection is immediately reevaluated as a new session can mislead troubleshooting.

Pointing to a collector address alone does not guarantee log acceptance and retention can be a real concern elsewhere, such as when a FortiGate forwards logs to FortiAnalyzer but the analytics appliance shows the device as unauthorized. In the present scenario the key failure is that assuming every existing connection is immediately reevaluated as a new session can mislead troubleshooting.

Giving contractors FortiGate administrative accounts increases privilege without enabling correct SASE onboarding can be a real concern elsewhere, such as when a business wants to enforce consistent web security for contractors without making them administrators of local FortiGates. In the present scenario the key failure is that assuming every existing connection is immediately reevaluated as a new session can mislead troubleshooting.

A documented outage rehearsal still permits only the designated emergency role and records usage could show improvement in a separate Fortinet case, for instance when a firewall deployment has local emergency users and a remote RADIUS service that may be unreachable. The actual verification here is that the new traffic event records the expected source destination service and matching policy identifier.

External test traffic shows the approved translated source and response packets reach the right client could show improvement in a separate Fortinet case, for instance when multiple private office clients need internet access through a single FortiGate public WAN interface. The actual verification here is that the new traffic event records the expected source destination service and matching policy identifier.

Packet capture confirms the backend response returns through FortiGate and maps to the original client could show improvement in a separate Fortinet case, for instance when an application expects symmetric return sessions after publishing a private web server via DNAT. The actual verification here is that the new traffic event records the expected source destination service and matching policy identifier.

Configure a secure LDAP authentication server and map permitted groups into policy could correct a different FortiGate problem, such as when employees authenticate with a corporate directory but FortiGate has no LDAP server connector configured. The current case requires configure an approved captive-portal authentication flow on the restricted firewall policy for its particular control path.

Create a narrowly scoped policy with the correct ingress egress addresses schedule and service could correct a different FortiGate problem, such as when a test packet has a matching route but FortiGate logs report an implicit firewall denial. The current case requires configure an approved captive-portal authentication flow on the restricted firewall policy for its particular control path.

Use the SD-WAN zone as the relevant policy egress interface with the approved source and services could correct a different FortiGate problem, such as when a branch uses an SD-WAN zone with two WAN members but its firewall policy names only a member interface. The current case requires configure an approved captive-portal authentication flow on the restricted firewall policy for its particular control path.

A controlled session shows the expected policy ID application signature and policy enforcement could show improvement in a separate Fortinet case, for instance when an organization applies an application-control profile but traffic follows an earlier broad allow rule without it. The actual verification here is that a harmless test file is prevented from arriving and the log records the configured enforcement.

The test path is evaluated at the expected granularity under an authorized inspection configuration could show improvement in a separate Fortinet case, for instance when an administrator uses a certificate-inspection-only policy but expects a path-specific HTTPS URL rule to match. The actual verification here is that a harmless test file is prevented from arriving and the log records the configured enforcement.

A newly created prohibited application session is classified and blocked as intended could show improvement in a separate Fortinet case, for instance when an administrator changes an application-control signature action but the client continues using an established session. The actual verification here is that a harmless test file is prevented from arriving and the log records the configured enforcement.

Bidirectional test traffic crosses the expected firewall interfaces without asymmetric bypass could show improvement in a separate Fortinet case, for instance when an Azure team deploys a FortiGate virtual appliance but its return traffic bypasses the instance. The actual verification here is that an authorized workstation reaches the management login while an untrusted test host is denied.

The log entry identifies the relevant policy ID action and traffic endpoints could show improvement in a separate Fortinet case, for instance when an administrator sees a deny event but cannot determine which firewall policy matched the connection. The actual verification here is that an authorized workstation reaches the management login while an untrusted test host is denied.

Memory metrics return below the relevant threshold and new permitted sessions establish normally could show improvement in a separate Fortinet case, for instance when users report intermittent internet outage while the FortiGate memory is near conserve-mode thresholds. The actual verification here is that an authorized workstation reaches the management login while an untrusted test host is denied.

A monitor-only IPS signature leaves attempted exploit packets able to traverse the firewall can be a real concern elsewhere, such as when a test server receives traffic matching a known remote exploit signature but FortiGate only logs the event. In the present scenario the key failure is that treating every antivirus detection log as proof that malware was blocked can expose endpoints.

A global signature counter without source context is insufficient for incident triage can be a real concern elsewhere, such as when an IPS detection event is present but analysts cannot determine which internal host initiated the suspicious traffic. In the present scenario the key failure is that treating every antivirus detection log as proof that malware was blocked can expose endpoints.

A standalone IPS sensor object without an active policy reference does not protect packet flows can be a real concern elsewhere, such as when an IPS sensor is configured globally but no firewall rule references it for a protected subnet. In the present scenario the key failure is that treating every antivirus detection log as proof that malware was blocked can expose endpoints.

Configure HA monitored interfaces so critical uplinks influence the device failover decision could correct a different FortiGate problem, such as when a cluster fails to trigger high availability when its primary WAN physical interface loses carrier. The current case requires configure the required cloud route tables and forwarding permissions for symmetric inspection for its particular control path.

Design FortiSASE user onboarding and secure access policies for supported endpoint connectivity could correct a different FortiGate problem, such as when a distributed company needs to apply cloud-delivered security checks to remote users outside branch offices. The current case requires configure the required cloud route tables and forwarding permissions for symmetric inspection for its particular control path.

Inspect FortiGuard entitlement status and reachability to approved FortiGuard distribution servers could correct a different FortiGate problem, such as when a FortiGate reports FortiGuard rating errors although the firewall appliance is registered. The current case requires configure the required cloud route tables and forwarding permissions for symmetric inspection for its particular control path.

Post-upgrade validation shows expected configuration and services after each required upgrade hop could show improvement in a separate Fortinet case, for instance when a firmware rollout has multiple supported intermediate upgrade steps that operations intends to skip. The actual verification here is that the FortiGate routing table includes a usable default gateway and permitted external probes succeed.

A new controlled connection follows the updated rule and the old session behavior is explained could show improvement in a separate Fortinet case, for instance when a FortiGate still matches an established session after an administrator edits the relevant firewall rule. The actual verification here is that the FortiGate routing table includes a usable default gateway and permitted external probes succeed.

A supported signature update and a test category query succeed with current entitlement information could show improvement in a separate Fortinet case, for instance when a FortiGate reports FortiGuard rating errors although the firewall appliance is registered. The actual verification here is that the FortiGate routing table includes a usable default gateway and permitted external probes succeed.

Assuming a VM image has unlimited packet throughput can create production saturation can be a real concern elsewhere, such as when a public cloud change uses an unsupported instance type for the intended FortiGate VM throughput. In the present scenario the key failure is that sending all remote users directly to internet sites can bypass the organization's cloud security policy.

Rebooting the collector does not restore events intentionally filtered at the sender can be a real concern elsewhere, such as when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. In the present scenario the key failure is that sending all remote users directly to internet sites can bypass the organization's cloud security policy.

Randomly changing multiple policies before inspecting packet flow hides the actual denying condition can be a real concern elsewhere, such as when a branch FortiGate denies a new connection although the engineer believes a broad accept rule covers it. In the present scenario the key failure is that sending all remote users directly to internet sites can bypass the organization's cloud security policy.

Adding another inter-interface forward policy cannot enable disabled interface HTTPS administration can be a real concern elsewhere, such as when an admin cannot connect to the FortiGate GUI even though a transit firewall policy permits HTTPS packets. In the present scenario the key failure is that allowing the policy without required NAT can send unroutable RFC1918 source addresses to the internet.

A valid default route alone does not grant permission for traffic through the firewall can be a real concern elsewhere, such as when a test packet has a matching route but FortiGate logs report an implicit firewall denial. In the present scenario the key failure is that allowing the policy without required NAT can send unroutable RFC1918 source addresses to the internet.

Two broad conflicting VIP mappings on the same public address and port cannot distinguish services can be a real concern elsewhere, such as when two applications behind one public IP must expose different TCP ports to different backend servers. In the present scenario the key failure is that allowing the policy without required NAT can send unroutable RFC1918 source addresses to the internet.

Check encrypted traffic visibility and permitted SSL inspection before expecting payload-based IPS matching could correct a different FortiGate problem, such as when a known malicious HTTP payload passes although its IPS sensor exists and the firewall policy uses no SSL decryption. The current case requires restore supported FortiGuard update connectivity and verify antivirus package freshness for its particular control path.

Test a new session and verify the active application-control policy and recognition events could correct a different FortiGate problem, such as when an administrator changes an application-control signature action but the client continues using an established session. The current case requires restore supported FortiGuard update connectivity and verify antivirus package freshness for its particular control path.

Apply narrow approved SSL exemption categories and document remaining visibility limitations could correct a different FortiGate problem, such as when a FortiGate is configured for deep inspection but legal policy forbids decryption of selected medical services. The current case requires restore supported FortiGuard update connectivity and verify antivirus package freshness for its particular control path.