Equal distribution over two unequal circuits may saturate the slower link unnecessarily can be a real concern elsewhere, such as when a business expects bandwidth-aware load distribution but FortiGate uses an equal-weight algorithm under asymmetric link speeds. In the present scenario the key failure is that a deny policy alone does not explain every forwarding decision if untrusted alternate paths exist.

Assuming all TCP sessions survive a public source-IP change can break stateful applications can be a real concern elsewhere, such as when an application requires session persistence but users are disconnected when a monitored SD-WAN link changes state. In the present scenario the key failure is that a deny policy alone does not explain every forwarding decision if untrusted alternate paths exist.

A physically up primary interface can be unusable beyond its next hop without path monitoring can be a real concern elsewhere, such as when a server subnet needs redundant internet routes but the backup should activate only when primary path fails. In the present scenario the key failure is that a deny policy alone does not explain every forwarding decision if untrusted alternate paths exist.

Check the matching firewall rule antivirus profile and log filtering options before changing the signature could correct a different FortiGate problem, such as when a scheduled threat exercise produces no antivirus event although the file has a supported signature. The current case requires review FortiGate SSL inspection certificate validation and the actual upstream server trust chain for its particular control path.

Align the web-filter feature set and firewall inspection mode with the required supported behavior could correct a different FortiGate problem, such as when a proxy-based web filter profile cannot be applied to a policy configured for an incompatible flow inspection mode. The current case requires review FortiGate SSL inspection certificate validation and the actual upstream server trust chain for its particular control path.

Configure relevant IPS event logging and correlate with forward-traffic source and policy IDs could correct a different FortiGate problem, such as when an IPS detection event is present but analysts cannot determine which internal host initiated the suspicious traffic. The current case requires review FortiGate SSL inspection certificate validation and the actual upstream server trust chain for its particular control path.

SD-WAN service evaluation combines rule matches with current eligible link and route state describes a distinct situation, for example when a firewall routes to an SD-WAN zone but a new service rule never selects the preferred member. Here the relevant FortiOS behavior is that route installation preference uses attributes including administrative distance before ECMP decisions.

FortiOS firewall policies refer to SD-WAN zones while service rules select members inside the zone describes a distinct situation, for example when an SD-WAN zone contains two links but a forward firewall policy references the physical port instead of the zone. Here the relevant FortiOS behavior is that route installation preference uses attributes including administrative distance before ECMP decisions.

Longest-prefix route matching selects a specific destination route over a less-specific default route describes a distinct situation, for example when a FortiGate has a default route to WAN but a specific branch network should use a site-to-site tunnel. Here the relevant FortiOS behavior is that route installation preference uses attributes including administrative distance before ECMP decisions.

Verify antivirus and deep SSL inspection profiles are both effective on the matching rule could correct a different FortiGate problem, such as when an outbound policy has antivirus enabled but a harmless EICAR test downloaded over HTTPS is not detected. The current case requires apply narrow approved SSL exemption categories and document remaining visibility limitations for its particular control path.

Enable appropriate application-control event monitoring and inspect session protocol characteristics could correct a different FortiGate problem, such as when a security operations dashboard shows generic unknown applications and little useful detail for a new workload. The current case requires apply narrow approved SSL exemption categories and document remaining visibility limitations for its particular control path.

Review archive nesting and decompression limits under the supported antivirus profile settings could correct a different FortiGate problem, such as when an administrator needs to confirm whether nested archive files are scanned by a FortiGate antivirus profile. The current case requires apply narrow approved SSL exemption categories and document remaining visibility limitations for its particular control path.

A staged compatible restore reproduces the intended rulebase and device settings in a lab could show improvement in a separate Fortinet case, for instance when an administrator must restore a firewall after a hardware failure without rebuilding hundreds of objects. The actual verification here is that the approved administrator authenticates on the management interface and unapproved paths stay closed.

Both units report the intended build and synchronized healthy status after the documented upgrade could show improvement in a separate Fortinet case, for instance when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. The actual verification here is that the approved administrator authenticates on the management interface and unapproved paths stay closed.

The repaired link shows stable negotiated parameters and falling error rates during a load test could show improvement in a separate Fortinet case, for instance when an engineer sees retransmissions on one WAN circuit after a replacement SFP optic was installed. The actual verification here is that the approved administrator authenticates on the management interface and unapproved paths stay closed.

A working heartbeat alone does not mean upstream interface failures are covered by failover logic can be a real concern elsewhere, such as when a cluster fails to trigger high availability when its primary WAN physical interface loses carrier. In the present scenario the key failure is that rebooting the collector does not restore events intentionally filtered at the sender.

A successful ICMP echo cannot establish that TCP ports or SSL application handshakes work can be a real concern elsewhere, such as when a server is reachable by ping but HTTPS sessions are reset across one FortiGate interface. In the present scenario the key failure is that rebooting the collector does not restore events intentionally filtered at the sender.

A screenshot of policy names does not recover address objects certificates or system interfaces can be a real concern elsewhere, such as when an administrator must restore a firewall after a hardware failure without rebuilding hundreds of objects. In the present scenario the key failure is that rebooting the collector does not restore events intentionally filtered at the sender.

Disabling all IPS protection without identifying the expensive workload creates avoidable exposure can be a real concern elsewhere, such as when a FortiGate shows unusually high CPU utilization following activation of broad IPS scanning. In the present scenario the key failure is that disabling the entire risk category for one business tool can unnecessarily permit unrelated applications.

Ignoring size limits can silently create an inspection exception for large downloaded payloads can be a real concern elsewhere, such as when a large file transfer bypasses antivirus checks because the configured inspection limits are exceeded. In the present scenario the key failure is that disabling the entire risk category for one business tool can unnecessarily permit unrelated applications.

Assigning a mismatched mode profile may prevent the intended security configuration from operating can be a real concern elsewhere, such as when a proxy-based web filter profile cannot be applied to a policy configured for an incompatible flow inspection mode. In the present scenario the key failure is that disabling the entire risk category for one business tool can unnecessarily permit unrelated applications.

Ordinary interface-address SNAT can violate a partner allowlist tied to the approved pool address can be a real concern elsewhere, such as when a partner requires the organization to use one known public IP that differs from the FortiGate WAN address. In the present scenario the key failure is that an agent connection alone does not guarantee matching domain group information is available.

Treating private addresses as implicitly trusted can allow unintended lateral communication can be a real concern elsewhere, such as when a new east-west segmentation policy needs internal traffic logged without exposing every application port. In the present scenario the key failure is that an agent connection alone does not guarantee matching domain group information is available.

Adding another inter-interface forward policy cannot enable disabled interface HTTPS administration can be a real concern elsewhere, such as when an admin cannot connect to the FortiGate GUI even though a transit firewall policy permits HTTPS packets. In the present scenario the key failure is that an agent connection alone does not guarantee matching domain group information is available.

FSSO group membership must be passed or retrieved in a form the firewall's policy understands describes a distinct situation, for example when an FSSO collector shows an active user but the FortiGate firewall policy cannot see the user's group. Here the relevant FortiOS behavior is that flow and proxy inspection modes differ in traffic processing and available feature behavior.

Fine-grained firewall policy objects express least-privilege transport and address access boundaries describes a distinct situation, for example when an internal accounting application should use only TCP 443 to a defined partner subnet. Here the relevant FortiOS behavior is that flow and proxy inspection modes differ in traffic processing and available feature behavior.

FortiOS SD-WAN firewall policies reference the zone instead of individual SD-WAN member interfaces describes a distinct situation, for example when a branch uses an SD-WAN zone with two WAN members but its firewall policy names only a member interface. Here the relevant FortiOS behavior is that flow and proxy inspection modes differ in traffic processing and available feature behavior.

Both peers report matching child SAs and permitted private traffic is encrypted could show improvement in a separate Fortinet case, for instance when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. The actual verification here is that the new peer establishes the intended IKE and child SAs while the obsolete endpoint is unused.

The approved subnet exchanges data and denied subnets fail under the selected policy could show improvement in a separate Fortinet case, for instance when a FortiGate IPsec interface has an active route but private traffic is denied when it enters the VPN. The actual verification here is that the new peer establishes the intended IKE and child SAs while the obsolete endpoint is unused.

Every approved branch reaches central services and direct branch bypass is restricted as required could show improvement in a separate Fortinet case, for instance when a business must connect three branches to headquarters while limiting unnecessary branch-to-branch connections. The actual verification here is that the new peer establishes the intended IKE and child SAs while the obsolete endpoint is unused.

A second tunnel on the same failing underlay cannot guarantee independent disaster recovery can be a real concern elsewhere, such as when a partially redundant VPN deployment sends some applications through a single shared head-office tunnel despite another path being available. In the present scenario the key failure is that removing every legacy transform before peer readiness can disconnect legitimate branches.

Changing only the local tunnel description cannot redirect IKE packets to the new peer can be a real concern elsewhere, such as when a backup IPsec peer remains configured after the retired partner gateway changes its public address. In the present scenario the key failure is that removing every legacy transform before peer readiness can disconnect legitimate branches.

Increasing application retries cannot reliably repair blocked path-MTU discovery can be a real concern elsewhere, such as when a datacenter tunnel carries pings but large application transfers repeatedly stall after enabling an overlay. In the present scenario the key failure is that removing every legacy transform before peer readiness can disconnect legitimate branches.