Local user authentication and remote identity services have different availability and audit dependencies describes a distinct situation, for example when a firewall deployment has local emergency users and a remote RADIUS service that may be unreachable. Here the relevant FortiOS behavior is that policy-specific traffic logs provide evidence of access decisions in addition to the configured rule text.

FSSO identity lookup depends on timely authenticated-user events and accurate IP mappings describes a distinct situation, for example when a domain controller agent is forwarding events but FortiGate FSSO still marks several user IPs unknown. Here the relevant FortiOS behavior is that policy-specific traffic logs provide evidence of access decisions in addition to the configured rule text.

Source NAT rewrites internal source addresses so public return traffic reaches the firewall session describes a distinct situation, for example when multiple private office clients need internet access through a single FortiGate public WAN interface. Here the relevant FortiOS behavior is that policy-specific traffic logs provide evidence of access decisions in addition to the configured rule text.

A test route lookup selects the corrected next hop and permitted packets leave the interface could show improvement in a separate Fortinet case, for instance when an office network cannot leave through a new internet circuit because its static default route references an unreachable gateway. The actual verification here is that the desired route appears active with its expected interface and permitted branch traffic succeeds.

A simulated upstream outage removes the failed preferred path and traffic takes the approved backup could show improvement in a separate Fortinet case, for instance when a server subnet needs redundant internet routes but the backup should activate only when primary path fails. The actual verification here is that the desired route appears active with its expected interface and permitted branch traffic succeeds.

The installed forwarding entry matches the documented preference and a route lookup confirms it could show improvement in a separate Fortinet case, for instance when an administrator assumes routing favors a manually added static prefix over a connected prefix of equal specificity. The actual verification here is that the desired route appears active with its expected interface and permitted branch traffic succeeds.

Use per-process diagnostics and IPS sensor tuning to narrow required signatures and traffic scope could correct a different FortiGate problem, such as when a FortiGate shows unusually high CPU utilization following activation of broad IPS scanning. The current case requires verify antivirus and deep SSL inspection profiles are both effective on the matching rule for its particular control path.

Apply narrow approved SSL exemption categories and document remaining visibility limitations could correct a different FortiGate problem, such as when a FortiGate is configured for deep inspection but legal policy forbids decryption of selected medical services. The current case requires verify antivirus and deep SSL inspection profiles are both effective on the matching rule for its particular control path.

Review application-identification visibility and supported encrypted-transport handling could correct a different FortiGate problem, such as when users bypass a prohibited application signature after switching clients to an alternative encrypted protocol. The current case requires verify antivirus and deep SSL inspection profiles are both effective on the matching rule for its particular control path.

A standby device without synchronized sessions may require clients to reconnect after failover can be a real concern elsewhere, such as when an active-passive FortiGate pair drops established sessions when a primary unit fails unexpectedly. In the present scenario the key failure is that guessing firmware version from a device hostname may lead to unsuitable remediation instructions.

A working heartbeat alone does not mean upstream interface failures are covered by failover logic can be a real concern elsewhere, such as when a cluster fails to trigger high availability when its primary WAN physical interface loses carrier. In the present scenario the key failure is that guessing firmware version from a device hostname may lead to unsuitable remediation instructions.

A generic system CPU graph cannot identify the firewall policy that rejected a packet can be a real concern elsewhere, such as when an administrator sees a deny event but cannot determine which firewall policy matched the connection. In the present scenario the key failure is that guessing firmware version from a device hostname may lead to unsuitable remediation instructions.

Installing more IPS signatures does not necessarily expose encrypted application request bodies can be a real concern elsewhere, such as when a known malicious HTTP payload passes although its IPS sensor exists and the firewall policy uses no SSL decryption. In the present scenario the key failure is that expecting certificate inspection to read encrypted URL paths or file contents will miss threats.

Ignoring size limits can silently create an inspection exception for large downloaded payloads can be a real concern elsewhere, such as when a large file transfer bypasses antivirus checks because the configured inspection limits are exceeded. In the present scenario the key failure is that expecting certificate inspection to read encrypted URL paths or file contents will miss threats.

Assuming a destination port identifies an application across every encryption method is unreliable can be a real concern elsewhere, such as when users bypass a prohibited application signature after switching clients to an alternative encrypted protocol. In the present scenario the key failure is that expecting certificate inspection to read encrypted URL paths or file contents will miss threats.

The corporate source matches the desired rule and a guest subnet with similar identity data is denied could show improvement in a separate Fortinet case, for instance when FortiGate shows FSSO identity for a workstation but a separate guest subnet should never inherit that access. The actual verification here is that an authorized directory user authenticates while a deliberately invalid user is rejected.

A test collector outage still produces new valid FSSO logon records through the backup could show improvement in a separate Fortinet case, for instance when a branch FortiGate loses access to FSSO authentication when its primary collector service stops. The actual verification here is that an authorized directory user authenticates while a deliberately invalid user is rejected.

A fresh domain logon updates the correct username source IP and group in FortiGate could show improvement in a separate Fortinet case, for instance when a domain controller agent is forwarding events but FortiGate FSSO still marks several user IPs unknown. The actual verification here is that an authorized directory user authenticates while a deliberately invalid user is rejected.

A new external connection matches the VIP and specified policy and reaches the backend could show improvement in a separate Fortinet case, for instance when an inbound HTTPS VIP is configured but the public client receives a TCP timeout. The actual verification here is that a fresh domain logon updates the correct username source IP and group in FortiGate.

A test collector outage still produces new valid FSSO logon records through the backup could show improvement in a separate Fortinet case, for instance when a branch FortiGate loses access to FSSO authentication when its primary collector service stops. The actual verification here is that a fresh domain logon updates the correct username source IP and group in FortiGate.

The new traffic event records the expected source destination service and matching policy identifier could show improvement in a separate Fortinet case, for instance when a developer wants to inspect why an allow policy is matched but session logs contain no policy IDs. The actual verification here is that a fresh domain logon updates the correct username source IP and group in FortiGate.

A full-mesh VPN introduces direct tunnel paths but increases peer configuration and key management describes a distinct situation, for example when a regional enterprise wants direct private connectivity between every pair of its small number of sites. Here the relevant FortiOS behavior is that IKE authenticates each endpoint in addition to negotiating cryptographic transform compatibility.

IPsec peers must share at least one supported proposal for secure authentication and encryption describes a distinct situation, for example when a security group wants to deprecate weak IKE proposals without disconnecting all branch tunnels at once. Here the relevant FortiOS behavior is that IKE authenticates each endpoint in addition to negotiating cryptographic transform compatibility.

Stateful private traffic needs compatible forward and reverse paths through negotiated IPsec interfaces describes a distinct situation, for example when an IPsec tunnel encrypts traffic but a routing misconfiguration sends return packets over the public WAN. Here the relevant FortiOS behavior is that IKE authenticates each endpoint in addition to negotiating cryptographic transform compatibility.

Enabling logging on a different policy does not create evidence for an uninspected flow can be a real concern elsewhere, such as when a scheduled threat exercise produces no antivirus event although the file has a supported signature. In the present scenario the key failure is that using a generic outbound inspection CA is not equivalent to installing the server certificate for inbound inspection.

Blocking every HTTPS connection to prevent one prohibited application would disrupt permitted business traffic can be a real concern elsewhere, such as when a company wants to prevent peer-to-peer file sharing without blocking all outbound TCP 443 traffic. In the present scenario the key failure is that using a generic outbound inspection CA is not equivalent to installing the server certificate for inbound inspection.

Assuming a preexisting browser connection proves a new SSL profile is ineffective can mislead debugging can be a real concern elsewhere, such as when an administrator changes inspection profiles while old HTTPS sessions continue using previous trust behavior. In the present scenario the key failure is that using a generic outbound inspection CA is not equivalent to installing the server certificate for inbound inspection.

Configuration entry order alone is not the basis of FortiGate route installation can be a real concern elsewhere, such as when an administrator assumes routing favors a manually added static prefix over a connected prefix of equal specificity. In the present scenario the key failure is that two route entries in configuration do not imply both are active in the forwarding table.

An unused secondary interface cannot carry SD-WAN traffic merely because its cable is connected can be a real concern elsewhere, such as when a branch has two ISP connections but its SD-WAN member configuration includes only the primary WAN interface. In the present scenario the key failure is that two route entries in configuration do not imply both are active in the forwarding table.

Round-robin distribution without application SLA awareness may send voice over a degraded uplink can be a real concern elsewhere, such as when a voice application suffers jitter when FortiGate distributes sessions between a low-latency and overloaded WAN link. In the present scenario the key failure is that two route entries in configuration do not imply both are active in the forwarding table.

Define ordered SD-WAN rules with destination or application criteria and approved member preferences could correct a different FortiGate problem, such as when a branch wants to use cheap broadband for routine web browsing and reserve its private circuit for finance apps. The current case requires add both supported WAN interfaces as SD-WAN members and assign the appropriate zone for its particular control path.

Apply explicit policy controls and a documented blackhole route only where appropriate could correct a different FortiGate problem, such as when an isolated guest subnet must not use a broad route to reach a prohibited private destination. The current case requires add both supported WAN interfaces as SD-WAN members and assign the appropriate zone for its particular control path.

Check next-hop reachability interface state and the route's installation attributes could correct a different FortiGate problem, such as when an administrator created a static route for a cloud subnet but the route remains inactive in the routing monitor. The current case requires add both supported WAN interfaces as SD-WAN members and assign the appropriate zone for its particular control path.