The route lookup resolves to the tunnel and a permitted remote host responds could show improvement in a separate Fortinet case, for instance when a site-to-site tunnel remains listed as up but its local subnet has no route toward the remote protected prefix. The actual verification here is that both peers report matching child SAs and permitted private traffic is encrypted.

Each approved site pair exchanges traffic across its configured direct tunnel without central hairpinning could show improvement in a separate Fortinet case, for instance when a regional enterprise wants direct private connectivity between every pair of its small number of sites. The actual verification here is that both peers report matching child SAs and permitted private traffic is encrypted.

The known test peer maps to the designated tunnel while an unknown identity is rejected could show improvement in a separate Fortinet case, for instance when two IPsec tunnels use the same outbound WAN port but should accept only one known partner identity per tunnel. The actual verification here is that both peers report matching child SAs and permitted private traffic is encrypted.

The harmless detection test logs the expected signature action source and matched firewall rule could show improvement in a separate Fortinet case, for instance when a scheduled threat exercise produces no antivirus event although the file has a supported signature. The actual verification here is that a safe antivirus test file delivered by HTTPS triggers the configured profile on the correct firewall rule.

A managed test browser trusts the inspection chain and the security profile can inspect approved HTTPS payloads could show improvement in a separate Fortinet case, for instance when an outbound deep-inspection policy causes corporate browsers to reject every HTTPS certificate generated by FortiGate. The actual verification here is that a safe antivirus test file delivered by HTTPS triggers the configured profile on the correct firewall rule.

The authorized EICAR test download is blocked and an antivirus event is recorded could show improvement in a separate Fortinet case, for instance when an outbound policy has antivirus enabled but a harmless EICAR test downloaded over HTTPS is not detected. The actual verification here is that a safe antivirus test file delivered by HTTPS triggers the configured profile on the correct firewall rule.

A new controlled connection follows the updated rule and the old session behavior is explained could show improvement in a separate Fortinet case, for instance when a FortiGate still matches an established session after an administrator edits the relevant firewall rule. The actual verification here is that a contractor test session is inspected under its restricted policy without network device admin rights.

A controlled authorized user session reaches the private app and the associated security logs appear could show improvement in a separate Fortinet case, for instance when a FortiSASE user can log in but cannot reach a private application behind a branch FortiGate. The actual verification here is that a contractor test session is inspected under its restricted policy without network device admin rights.

The log entry identifies the relevant policy ID action and traffic endpoints could show improvement in a separate Fortinet case, for instance when an administrator sees a deny event but cannot determine which firewall policy matched the connection. The actual verification here is that a contractor test session is inspected under its restricted policy without network device admin rights.

FortiOS debug flow exposes packet processing and matching information for selected sessions describes a distinct situation, for example when a branch FortiGate denies a new connection although the engineer believes a broad accept rule covers it. Here the relevant FortiOS behavior is that system resource diagnostics distinguish software process pressure from raw interface bandwidth usage.

Secure private application access requires both identity-based permissions and service reachability describes a distinct situation, for example when a FortiSASE user can log in but cannot reach a private application behind a branch FortiGate. Here the relevant FortiOS behavior is that system resource diagnostics distinguish software process pressure from raw interface bandwidth usage.

DHCP leases depend on clients reaching the correct broadcast domain and an enabled address pool describes a distinct situation, for example when a new internal VLAN needs addresses from the FortiGate but clients are using stale manual settings. Here the relevant FortiOS behavior is that system resource diagnostics distinguish software process pressure from raw interface bandwidth usage.

An interface IP address does not itself supply a next hop for destinations outside connected subnets describes a distinct situation, for example when a branch FortiGate has no configured default route after its WAN address is assigned. Here the relevant FortiOS behavior is that FGCP membership requires compatible members and shared HA configuration for election and synchronization.

FortiOS debug flow exposes packet processing and matching information for selected sessions describes a distinct situation, for example when a branch FortiGate denies a new connection although the engineer believes a broad accept rule covers it. Here the relevant FortiOS behavior is that FGCP membership requires compatible members and shared HA configuration for election and synchronization.

A logging destination can be reachable while configuration excludes particular event classes describes a distinct situation, for example when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. Here the relevant FortiOS behavior is that FGCP membership requires compatible members and shared HA configuration for election and synchronization.

VPN redundancy requires both usable negotiated tunnels and a routing mechanism to choose alternatives describes a distinct situation, for example when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. Here the relevant FortiOS behavior is that IPsec routing and FortiGate forwarding policy authorizations are separate controls.

Phase 2 builds IPsec security associations using compatible selectors and cryptographic policies describes a distinct situation, for example when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. Here the relevant FortiOS behavior is that IPsec routing and FortiGate forwarding policy authorizations are separate controls.

Dynamic routing protocol setup is separate from establishing an encrypted route-based IPsec channel describes a distinct situation, for example when a customer switches from static VPN routes to BGP and assumes the IPsec tunnel automatically starts advertising every prefix. Here the relevant FortiOS behavior is that IPsec routing and FortiGate forwarding policy authorizations are separate controls.

A controlled upstream fault marks the link out of SLA and moves eligible sessions to a healthy path could show improvement in a separate Fortinet case, for instance when a health check marks an ISP usable because its gateway replies but a critical SaaS service is unreachable beyond it. The actual verification here is that the routing table selects the VPN interface for the branch prefix and the test application works.

The monitor displays both members and a permitted test flow can use each eligible link could show improvement in a separate Fortinet case, for instance when a branch has two ISP connections but its SD-WAN member configuration includes only the primary WAN interface. The actual verification here is that the routing table selects the VPN interface for the branch prefix and the test application works.

Bidirectional capture shows requests and responses flowing through the expected security gateway could show improvement in a separate Fortinet case, for instance when a FortiGate routes inbound traffic to a server but the server returns replies through a different upstream router. The actual verification here is that the routing table selects the VPN interface for the branch prefix and the test application works.

A dashboard showing the service provisioned does not prove workloads are actually inspected can be a real concern elsewhere, such as when a cloud team plans to use a FortiGate CNF deployment but omits workload association and route checks. In the present scenario the key failure is that giving contractors FortiGate administrative accounts increases privilege without enabling correct SASE onboarding.

Rebooting the collector does not restore events intentionally filtered at the sender can be a real concern elsewhere, such as when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. In the present scenario the key failure is that giving contractors FortiGate administrative accounts increases privilege without enabling correct SASE onboarding.

A common heartbeat switching failure can lead to election instability or split-brain concerns can be a real concern elsewhere, such as when a FortiGate cluster uses two heartbeat cables but both share an unreliable aggregation switch. In the present scenario the key failure is that giving contractors FortiGate administrative accounts increases privilege without enabling correct SASE onboarding.

A documented outage rehearsal still permits only the designated emergency role and records usage could show improvement in a separate Fortinet case, for instance when a firewall deployment has local emergency users and a remote RADIUS service that may be unreachable. The actual verification here is that the group appears in FortiGate monitoring and the authorized policy matches the test session.

The intended app works and its policy logs prove unrelated east-west attempts are denied could show improvement in a separate Fortinet case, for instance when a new east-west segmentation policy needs internal traffic logged without exposing every application port. The actual verification here is that the group appears in FortiGate monitoring and the authorized policy matches the test session.

A permitted group can reach the tool while an authenticated disallowed group is denied could show improvement in a separate Fortinet case, for instance when two user groups share a subnet but must receive different access privileges to an internal tool. The actual verification here is that the group appears in FortiGate monitoring and the authorized policy matches the test session.

Move or refine the intended rule so inspected traffic matches the policy with the correct profile could correct a different FortiGate problem, such as when an organization applies an application-control profile but traffic follows an earlier broad allow rule without it. The current case requires change the category action to block on the appropriate web-filter profile for its particular control path.

Enable appropriate application-control event monitoring and inspect session protocol characteristics could correct a different FortiGate problem, such as when a security operations dashboard shows generic unknown applications and little useful detail for a new workload. The current case requires change the category action to block on the appropriate web-filter profile for its particular control path.

Add a narrowly justified SSL inspection exemption for the pinned application and assess residual risk could correct a different FortiGate problem, such as when managed endpoints trust FortiGate deep inspection but certificate pinning breaks one critical finance application. The current case requires change the category action to block on the appropriate web-filter profile for its particular control path.

Application payload signatures cannot inspect bytes concealed inside an undecrypted TLS session describes a distinct situation, for example when a known malicious HTTP payload passes although its IPS sensor exists and the firewall policy uses no SSL decryption. Here the relevant FortiOS behavior is that session state may preserve earlier policy decisions until a new traffic flow is evaluated.

Logging malware identification and preventing content delivery are distinct antivirus outcomes describes a distinct situation, for example when an antivirus alert is shown in monitor mode but the malware test file still reaches the endpoint. Here the relevant FortiOS behavior is that session state may preserve earlier policy decisions until a new traffic flow is evaluated.

An IPS can recognize signatures and enforce a drop action when attached to an active inspection policy describes a distinct situation, for example when a test server receives traffic matching a known remote exploit signature but FortiGate only logs the event. Here the relevant FortiOS behavior is that session state may preserve earlier policy decisions until a new traffic flow is evaluated.