A stale authenticated session or obsolete group mapping can extend previously granted access can be a real concern elsewhere, such as when an authenticated staff member can access a restricted application despite having left the approved department. In the present scenario the key failure is that reading the rule label alone does not prove a particular connection matched that rule.

Adding another inter-interface forward policy cannot enable disabled interface HTTPS administration can be a real concern elsewhere, such as when an admin cannot connect to the FortiGate GUI even though a transit firewall policy permits HTTPS packets. In the present scenario the key failure is that reading the rule label alone does not prove a particular connection matched that rule.

A correct VIP object by itself does not provide an accepting firewall policy can be a real concern elsewhere, such as when an inbound HTTPS VIP is configured but the public client receives a TCP timeout. In the present scenario the key failure is that reading the rule label alone does not prove a particular connection matched that rule.

Scope FSSO identity-based rules to the correct interface address zone and group matches could correct a different FortiGate problem, such as when FortiGate shows FSSO identity for a workstation but a separate guest subnet should never inherit that access. The current case requires inspect agent-to-collector communication and the association between logon events and current source IPs for its particular control path.

Design and test an approved fallback authentication model with least-privilege emergency accounts could correct a different FortiGate problem, such as when a firewall deployment has local emergency users and a remote RADIUS service that may be unreachable. The current case requires inspect agent-to-collector communication and the association between logon events and current source IPs for its particular control path.

Choose the supported flow-based inspection policy and compatible security profiles could correct a different FortiGate problem, such as when a firewall deployment must inspect traffic without sending the full HTTP request through proxy-based processing. The current case requires inspect agent-to-collector communication and the association between logon events and current source IPs for its particular control path.

Use distinct source interface or address matches to separate tenant firewall policies could correct a different FortiGate problem, such as when two tenant VLANs share the same destination but must have different permitted services. The current case requires verify RADIUS server reachability shared secret and authentication request settings for its particular control path.

Configure supported backup collector connections and validate reachability and failover could correct a different FortiGate problem, such as when a branch FortiGate loses access to FSSO authentication when its primary collector service stops. The current case requires verify RADIUS server reachability shared secret and authentication request settings for its particular control path.

Review central NAT mode and modify the appropriate central SNAT map entries could correct a different FortiGate problem, such as when a service uses central SNAT controls but an administrator edits policy NAT and sees no expected change. The current case requires verify RADIUS server reachability shared secret and authentication request settings for its particular control path.

Web filtering evaluates configured category decisions when the required URL classification is available describes a distinct situation, for example when a school wants to prevent students from visiting known malicious website categories on permitted web traffic. Here the relevant FortiOS behavior is that an IPS can recognize signatures and enforce a drop action when attached to an active inspection policy.

Encrypted HTTPS URL paths are generally hidden without approved decryption of application data describes a distinct situation, for example when an administrator uses a certificate-inspection-only policy but expects a path-specific HTTPS URL rule to match. Here the relevant FortiOS behavior is that an IPS can recognize signatures and enforce a drop action when attached to an active inspection policy.

Inbound SSL server protection requires suitable certificate identity and key material for the protected service describes a distinct situation, for example when a bank requests inspection of its own HTTPS web server traffic entering through a FortiGate VIP. Here the relevant FortiOS behavior is that an IPS can recognize signatures and enforce a drop action when attached to an active inspection policy.

Secure private application access requires both identity-based permissions and service reachability describes a distinct situation, for example when a FortiSASE user can log in but cannot reach a private application behind a branch FortiGate. Here the relevant FortiOS behavior is that a FortiGate VLAN interface receives packets only for its configured tag carried over the parent link.

Stateful session entries retain forwarding information while an established session remains in service describes a distinct situation, for example when a FortiGate still matches an established session after an administrator edits the relevant firewall rule. Here the relevant FortiOS behavior is that a FortiGate VLAN interface receives packets only for its configured tag carried over the parent link.

Virtual firewall capacity depends on eligible cloud resources and the chosen FortiGate licensing model describes a distinct situation, for example when a public cloud change uses an unsupported instance type for the intended FortiGate VM throughput. Here the relevant FortiOS behavior is that a FortiGate VLAN interface receives packets only for its configured tag carried over the parent link.

The test flow records the required security-profile decision on the actual matching policy could show improvement in a separate Fortinet case, for instance when a security profile was attached to a policy but does not inspect a flow that hits another earlier allow policy. The actual verification here is that the corporate source matches the desired rule and a guest subnet with similar identity data is denied.

Testing each external port reaches only its assigned internal application could show improvement in a separate Fortinet case, for instance when two applications behind one public IP must expose different TCP ports to different backend servers. The actual verification here is that the corporate source matches the desired rule and a guest subnet with similar identity data is denied.

An unauthenticated guest is challenged and an approved user obtains only limited internet service could show improvement in a separate Fortinet case, for instance when guest internet access must require interactive sign-in instead of silently trusting any client source. The actual verification here is that the corporate source matches the desired rule and a guest subnet with similar identity data is denied.

Enable and verify NAT traversal support and the necessary UDP negotiation paths could correct a different FortiGate problem, such as when a remote office behind an ISP NAT device cannot establish an IPsec connection to the headquarters FortiGate. The current case requires configure supported NAT-T keepalives and dead-peer detection appropriate to the network for its particular control path.

Configure eligible backup routes and monitored failover behavior across independent IPsec interfaces could correct a different FortiGate problem, such as when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. The current case requires configure supported NAT-T keepalives and dead-peer detection appropriate to the network for its particular control path.

Configure appropriate remote-gateway identity matching and IKEv2 network identifiers where supported could correct a different FortiGate problem, such as when two IPsec tunnels use the same outbound WAN port but should accept only one known partner identity per tunnel. The current case requires configure supported NAT-T keepalives and dead-peer detection appropriate to the network for its particular control path.

A server that replies through an alternate router can bypass reverse NAT and break clients can be a real concern elsewhere, such as when an application expects symmetric return sessions after publishing a private web server via DNAT. In the present scenario the key failure is that an unencrypted or unvalidated directory connection exposes credentials to interception or spoofing.

Creating an allow rule below an earlier matching deny does not change the denial outcome can be a real concern elsewhere, such as when a new firewall rule permits an accounting subnet but earlier broad deny policy blocks the same destination. In the present scenario the key failure is that an unencrypted or unvalidated directory connection exposes credentials to interception or spoofing.

A successful directory bind does not prove the user belongs to the group permitted by the policy can be a real concern elsewhere, such as when an administrator cannot tell why a credential succeeds on LDAP but the firewall rejects access to a destination. In the present scenario the key failure is that an unencrypted or unvalidated directory connection exposes credentials to interception or spoofing.

Monitored media traffic meets the intended handling while meeting calls remain usable could show improvement in a separate Fortinet case, for instance when a research group wants to limit streaming media bandwidth but preserve interactive meeting traffic. The actual verification here is that the authorized EICAR test download is blocked and an antivirus event is recorded.

A safe antivirus test file delivered by HTTPS triggers the configured profile on the correct firewall rule could show improvement in a separate Fortinet case, for instance when an administrator enables deep SSL inspection but HTTPS downloads pass through antivirus without file scans. The actual verification here is that the authorized EICAR test download is blocked and an antivirus event is recorded.

A safe IPS test generates the sensor event on the correct policy and prohibited traffic is dropped could show improvement in a separate Fortinet case, for instance when an IPS sensor is configured globally but no firewall rule references it for a protected subnet. The actual verification here is that the authorized EICAR test download is blocked and an antivirus event is recorded.

Packet capture distinguishes transport handshakes from ICMP reachability and policy routing effects describes a distinct situation, for example when a server is reachable by ping but HTTPS sessions are reset across one FortiGate interface. Here the relevant FortiOS behavior is that traffic log generation depends on policy logging choices separately from threat detection alerts.

FortiGuard signatures and category queries depend on valid service entitlements and update connectivity describes a distinct situation, for example when a FortiGate reports FortiGuard rating errors although the firewall appliance is registered. Here the relevant FortiOS behavior is that traffic log generation depends on policy logging choices separately from threat detection alerts.

FortiOS debug flow exposes packet processing and matching information for selected sessions describes a distinct situation, for example when a branch FortiGate denies a new connection although the engineer believes a broad accept rule covers it. Here the relevant FortiOS behavior is that traffic log generation depends on policy logging choices separately from threat detection alerts.

Equal distribution over two unequal circuits may saturate the slower link unnecessarily can be a real concern elsewhere, such as when a business expects bandwidth-aware load distribution but FortiGate uses an equal-weight algorithm under asymmetric link speeds. In the present scenario the key failure is that a deny policy alone does not explain every forwarding decision if untrusted alternate paths exist.

Assuming all TCP sessions survive a public source-IP change can break stateful applications can be a real concern elsewhere, such as when an application requires session persistence but users are disconnected when a monitored SD-WAN link changes state. In the present scenario the key failure is that a deny policy alone does not explain every forwarding decision if untrusted alternate paths exist.

A physically up primary interface can be unusable beyond its next hop without path monitoring can be a real concern elsewhere, such as when a server subnet needs redundant internet routes but the backup should activate only when primary path fails. In the present scenario the key failure is that a deny policy alone does not explain every forwarding decision if untrusted alternate paths exist.