Inspect the session table and evaluate clearing only affected sessions after approved policy changes could correct a different FortiGate problem, such as when a FortiGate still matches an established session after an administrator edits the relevant firewall rule. The current case requires configure supported dedicated HA management interfaces and per-unit access settings for its particular control path.

Run a scoped debug flow and inspect route policy and session decisions for the test packets could correct a different FortiGate problem, such as when a branch FortiGate denies a new connection although the engineer believes a broad accept rule covers it. The current case requires configure supported dedicated HA management interfaces and per-unit access settings for its particular control path.

Check physical interface counters duplex speed and error statistics alongside link state could correct a different FortiGate problem, such as when an engineer sees retransmissions on one WAN circuit after a replacement SFP optic was installed. The current case requires configure supported dedicated HA management interfaces and per-unit access settings for its particular control path.

Stateful DNAT depends on response packets returning through the translation session path describes a distinct situation, for example when an application expects symmetric return sessions after publishing a private web server via DNAT. Here the relevant FortiOS behavior is that source NAT rewrites internal source addresses so public return traffic reaches the firewall session.

Policy schedules gate matching permission in addition to the address and service fields describes a distinct situation, for example when a weekend maintenance exception must expire when business traffic resumes on Monday. Here the relevant FortiOS behavior is that source NAT rewrites internal source addresses so public return traffic reaches the firewall session.

Firewall authentication decisions depend on validated identity and effective group eligibility describes a distinct situation, for example when an authenticated staff member can access a restricted application despite having left the approved department. Here the relevant FortiOS behavior is that source NAT rewrites internal source addresses so public return traffic reaches the firewall session.

A full-mesh VPN introduces direct tunnel paths but increases peer configuration and key management describes a distinct situation, for example when a regional enterprise wants direct private connectivity between every pair of its small number of sites. Here the relevant FortiOS behavior is that logical interface state and negotiated IPsec security association state are different operational signals.

IPsec encapsulation adds headers that can reduce the packet payload limit of the transport path describes a distinct situation, for example when a datacenter tunnel carries pings but large application transfers repeatedly stall after enabling an overlay. Here the relevant FortiOS behavior is that logical interface state and negotiated IPsec security association state are different operational signals.

VPN redundancy requires both usable negotiated tunnels and a routing mechanism to choose alternatives describes a distinct situation, for example when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. Here the relevant FortiOS behavior is that logical interface state and negotiated IPsec security association state are different operational signals.

Measure effective path MTU and adjust supported TCP MSS or encapsulation settings could correct a different FortiGate problem, such as when a datacenter tunnel carries pings but large application transfers repeatedly stall after enabling an overlay. The current case requires configure eligible backup routes and monitored failover behavior across independent IPsec interfaces for its particular control path.

Align Phase 2 proposals PFS settings and traffic selectors with the remote peer could correct a different FortiGate problem, such as when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. The current case requires configure eligible backup routes and monitored failover behavior across independent IPsec interfaces for its particular control path.

Align supported IKE version authentication and Phase 1 encryption and integrity proposals on both peers could correct a different FortiGate problem, such as when a branch FortiGate and a partner gateway fail IKE negotiation after administrators choose incompatible encryption proposals. The current case requires configure eligible backup routes and monitored failover behavior across independent IPsec interfaces for its particular control path.

The approved conferencing traffic works and other prohibited applications remain blocked could show improvement in a separate Fortinet case, for instance when an application signature detects a business-approved conferencing tool as high risk and blocks important calls. The actual verification here is that an authorized synthetic exploit test is blocked and the IPS signature event identifies the action.

A harmless test file is prevented from arriving and the log records the configured enforcement could show improvement in a separate Fortinet case, for instance when an antivirus alert is shown in monitor mode but the malware test file still reaches the endpoint. The actual verification here is that an authorized synthetic exploit test is blocked and the IPS signature event identifies the action.

Monitored media traffic meets the intended handling while meeting calls remain usable could show improvement in a separate Fortinet case, for instance when a research group wants to limit streaming media bandwidth but preserve interactive meeting traffic. The actual verification here is that an authorized synthetic exploit test is blocked and the IPS signature event identifies the action.

Assuming different administrative distances provide true equal-cost balancing is incorrect can be a real concern elsewhere, such as when a data center wants to distribute eligible flows over two same-cost internet links but only one is used. In the present scenario the key failure is that treating a configuration entry as a verified active path can hide an unreachable next hop.

Two route entries in configuration do not imply both are active in the forwarding table can be a real concern elsewhere, such as when a network engineer configures two equal destination routes but one has a lower administrative distance. In the present scenario the key failure is that treating a configuration entry as a verified active path can hide an unreachable next hop.

Per-member policy references are not a substitute for the appropriate zone-level policy can be a real concern elsewhere, such as when an SD-WAN zone contains two links but a forward firewall policy references the physical port instead of the zone. In the present scenario the key failure is that treating a configuration entry as a verified active path can hide an unreachable next hop.

A tagged client reaches its gateway and the ingress interface is identified in session diagnostics could show improvement in a separate Fortinet case, for instance when a FortiGate is connected to a trunk switch but a new department tag never reaches its firewall policy. The actual verification here is that a permitted group gains designated resources while an unapproved group remains denied.

The recorded hardware model firmware build and port status match the device under investigation could show improvement in a separate Fortinet case, for instance when a FortiGate administrator needs the interface status and build version before opening a troubleshooting case. The actual verification here is that a permitted group gains designated resources while an unapproved group remains denied.

Both units report the intended build and synchronized healthy status after the documented upgrade could show improvement in a separate Fortinet case, for instance when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. The actual verification here is that a permitted group gains designated resources while an unapproved group remains denied.

Established sessions can retain processing context and may not reflect every policy change immediately describes a distinct situation, for example when an administrator changes inspection profiles while old HTTPS sessions continue using previous trust behavior. Here the relevant FortiOS behavior is that FortiOS antivirus profile features are selected to match the enabled inspection mode.

Session state may preserve earlier policy decisions until a new traffic flow is evaluated describes a distinct situation, for example when an administrator changes an application-control signature action but the client continues using an established session. Here the relevant FortiOS behavior is that FortiOS antivirus profile features are selected to match the enabled inspection mode.

Category lookup depends on valid FortiGuard subscription status and reachable rating resources describes a distinct situation, for example when a firewall can access the internet but web category queries return unrated responses after license expiration. Here the relevant FortiOS behavior is that FortiOS antivirus profile features are selected to match the enabled inspection mode.

Set the appropriate antivirus signature action to block or quarantine according to policy could correct a different FortiGate problem, such as when an antivirus alert is shown in monitor mode but the malware test file still reaches the endpoint. The current case requires configure a supported inbound protected-SSL-server inspection profile with the owned server certificate for its particular control path.

Use certificate inspection with an appropriate web filter profile for the approved limited visibility could correct a different FortiGate problem, such as when a firewall team wants URL-domain filtering of encrypted web sessions without inspecting application payloads. The current case requires configure a supported inbound protected-SSL-server inspection profile with the owned server certificate for its particular control path.

Review configured file size and oversize-file handling for the applicable antivirus inspection mode could correct a different FortiGate problem, such as when a large file transfer bypasses antivirus checks because the configured inspection limits are exceeded. The current case requires configure a supported inbound protected-SSL-server inspection profile with the owned server certificate for its particular control path.

Scanner limits influence whether oversized content can be fully processed before an allow decision describes a distinct situation, for example when a large file transfer bypasses antivirus checks because the configured inspection limits are exceeded. Here the relevant FortiOS behavior is that deep TLS inspection reissues server certificates under a trusted inspection authority to expose encrypted content.

FortiOS IPS processing is enforced on sessions matching policies with suitable IPS profiles describes a distinct situation, for example when an IPS sensor is configured globally but no firewall rule references it for a protected subnet. Here the relevant FortiOS behavior is that deep TLS inspection reissues server certificates under a trusted inspection authority to expose encrypted content.

Application-layer web filtering events provide classification detail distinct from session-level allow logs describes a distinct situation, for example when web-filter logs list only accepted network connections but the security administrator needs blocked category evidence. Here the relevant FortiOS behavior is that deep TLS inspection reissues server certificates under a trusted inspection authority to expose encrypted content.

The new flow allocation favors broadband and metered-link usage remains within the approved budget could show improvement in a separate Fortinet case, for instance when a managed branch sees more traffic on a costly metered link despite sufficient primary broadband capacity. The actual verification here is that the monitor displays both members and a permitted test flow can use each eligible link.

The desired route appears active with its expected interface and permitted branch traffic succeeds could show improvement in a separate Fortinet case, for instance when an administrator created a static route for a cloud subnet but the route remains inactive in the routing monitor. The actual verification here is that the monitor displays both members and a permitted test flow can use each eligible link.

Voice test sessions select the lower-jitter eligible link while performance SLA measurements stay in bounds could show improvement in a separate Fortinet case, for instance when a voice application suffers jitter when FortiGate distributes sessions between a low-latency and overloaded WAN link. The actual verification here is that the monitor displays both members and a permitted test flow can use each eligible link.