A valid route or Phase 2 selector cannot resolve mismatched peer authentication identity can be a real concern elsewhere, such as when an IKEv2 tunnel to a partner fails authentication despite both sides agreeing on encryption suites. In the present scenario the key failure is that changing many encryption settings without log evidence can introduce new interoperability problems.

An enabled tunnel object with no child SA cannot secure ordinary private packets can be a real concern elsewhere, such as when an operator mistakes the route-based tunnel interface being enabled for proof that its child SA is active. In the present scenario the key failure is that changing many encryption settings without log evidence can introduce new interoperability problems.

Assuming branch-to-branch traffic is automatically permitted through the hub ignores policy and routing can be a real concern elsewhere, such as when a business must connect three branches to headquarters while limiting unnecessary branch-to-branch connections. In the present scenario the key failure is that changing many encryption settings without log evidence can introduce new interoperability problems.

Review central NAT mode and modify the appropriate central SNAT map entries could correct a different FortiGate problem, such as when a service uses central SNAT controls but an administrator edits policy NAT and sees no expected change. The current case requires move or refine the specific approved allow rule relative to the earlier matching policy for its particular control path.

Inspect traffic session policy IDs and rule hit counters before removing redundant policies could correct a different FortiGate problem, such as when an administrator clones a broad outbound policy and later cannot identify which of the two is in use. The current case requires move or refine the specific approved allow rule relative to the earlier matching policy for its particular control path.

Verify RADIUS server reachability shared secret and authentication request settings could correct a different FortiGate problem, such as when a remote RADIUS server accepts user credentials but FortiGate times out on every login attempt. The current case requires move or refine the specific approved allow rule relative to the earlier matching policy for its particular control path.

Finance traffic uses the designated circuit and ordinary web sessions use permitted broadband could show improvement in a separate Fortinet case, for instance when a branch wants to use cheap broadband for routine web browsing and reserve its private circuit for finance apps. The actual verification here is that bidirectional capture shows requests and responses flowing through the expected security gateway.

Voice test sessions select the lower-jitter eligible link while performance SLA measurements stay in bounds could show improvement in a separate Fortinet case, for instance when a voice application suffers jitter when FortiGate distributes sessions between a low-latency and overloaded WAN link. The actual verification here is that bidirectional capture shows requests and responses flowing through the expected security gateway.

A staged member removal leaves only valid active routes and permitted flows still work could show improvement in a separate Fortinet case, for instance when an administrator removes a WAN link from the SD-WAN zone without updating route and policy dependencies. The actual verification here is that bidirectional capture shows requests and responses flowing through the expected security gateway.

Assuming different administrative distances provide true equal-cost balancing is incorrect can be a real concern elsewhere, such as when a data center wants to distribute eligible flows over two same-cost internet links but only one is used. In the present scenario the key failure is that a healthy expensive circuit need not be used for every ordinary session simply because it is eligible.

An unconditional top rule can capture all sessions before the finance-specific rule is evaluated can be a real concern elsewhere, such as when a branch wants to use cheap broadband for routine web browsing and reserve its private circuit for finance apps. In the present scenario the key failure is that a healthy expensive circuit need not be used for every ordinary session simply because it is eligible.

Configuration entry order alone is not the basis of FortiGate route installation can be a real concern elsewhere, such as when an administrator assumes routing favors a manually added static prefix over a connected prefix of equal specificity. In the present scenario the key failure is that a healthy expensive circuit need not be used for every ordinary session simply because it is eligible.

Redundant collectors reduce dependence on one Windows identity-collection service for passive authentication describes a distinct situation, for example when a branch FortiGate loses access to FSSO authentication when its primary collector service stops. Here the relevant FortiOS behavior is that passive identity mappings can become stale when workstation and logoff events are missed.

FortiGate security profiles operate on traffic selected by the relevant enabled firewall policy describes a distinct situation, for example when a security profile was attached to a policy but does not inspect a flow that hits another earlier allow policy. Here the relevant FortiOS behavior is that passive identity mappings can become stale when workstation and logoff events are missed.

LDAP integration lets FortiGate validate supported directory identities through the specified server describes a distinct situation, for example when employees authenticate with a corporate directory but FortiGate has no LDAP server connector configured. Here the relevant FortiOS behavior is that passive identity mappings can become stale when workstation and logoff events are missed.

Follow the vendor-supported FortiOS upgrade path and take verified backups before changing firmware could correct a different FortiGate problem, such as when a firmware rollout has multiple supported intermediate upgrade steps that operations intends to skip. The current case requires verify supported private-access connector topology user group entitlement and destination routing for its particular control path.

Configure supported dedicated HA management interfaces and per-unit access settings could correct a different FortiGate problem, such as when an administrator cannot reach the secondary FortiGate independently to diagnose its failed hardware sensor. The current case requires verify supported private-access connector topology user group entitlement and destination routing for its particular control path.

Restrict management access to a dedicated interface and administrator trusted hosts could correct a different FortiGate problem, such as when a freshly installed FortiGate allows administrative HTTPS from an untrusted transit network. The current case requires verify supported private-access connector topology user group entitlement and destination routing for its particular control path.

Turning off all security profiles without identifying the workload can weaken protection unnecessarily can be a real concern elsewhere, such as when a firewall dashboard shows high CPU but operators cannot tell whether inspection or logging drives it. In the present scenario the key failure is that adding a WAN NAT rule does not provide DHCP option values or local client leases.

Replacing endpoint credentials alone cannot repair an absent private application forwarding path can be a real concern elsewhere, such as when a FortiSASE user can log in but cannot reach a private application behind a branch FortiGate. In the present scenario the key failure is that adding a WAN NAT rule does not provide DHCP option values or local client leases.

A standby device without synchronized sessions may require clients to reconnect after failover can be a real concern elsewhere, such as when an active-passive FortiGate pair drops established sessions when a primary unit fails unexpectedly. In the present scenario the key failure is that adding a WAN NAT rule does not provide DHCP option values or local client leases.

Member selection policies can control cost-aware path use while honoring application performance requirements describes a distinct situation, for example when a managed branch sees more traffic on a costly metered link despite sufficient primary broadband capacity. Here the relevant FortiOS behavior is that SD-WAN policies can choose routes based on measured latency jitter and packet loss.

Route installation preference uses attributes including administrative distance before ECMP decisions describes a distinct situation, for example when a network engineer configures two equal destination routes but one has a lower administrative distance. Here the relevant FortiOS behavior is that SD-WAN policies can choose routes based on measured latency jitter and packet loss.

SD-WAN link selection operates over configured members and their health or service rules describes a distinct situation, for example when a branch has two ISP connections but its SD-WAN member configuration includes only the primary WAN interface. Here the relevant FortiOS behavior is that SD-WAN policies can choose routes based on measured latency jitter and packet loss.

A FortiGate VLAN interface receives packets only for its configured tag carried over the parent link describes a distinct situation, for example when a FortiGate is connected to a trunk switch but a new department tag never reaches its firewall policy. Here the relevant FortiOS behavior is that reliable FGCP heartbeats are required to distinguish a failed peer from temporary network loss.

FGCP membership requires compatible members and shared HA configuration for election and synchronization describes a distinct situation, for example when two FortiGates refuse to join the same FGCP high-availability cluster after installation. Here the relevant FortiOS behavior is that reliable FGCP heartbeats are required to distinguish a failed peer from temporary network loss.

FGCP election considers cluster priority and health conditions rather than simply device hostname describes a distinct situation, for example when a FortiGate cluster elects the wrong preferred primary after a power recovery. Here the relevant FortiOS behavior is that reliable FGCP heartbeats are required to distinguish a failed peer from temporary network loss.

Installing more IPS signatures does not necessarily expose encrypted application request bodies can be a real concern elsewhere, such as when a known malicious HTTP payload passes although its IPS sensor exists and the firewall policy uses no SSL decryption. In the present scenario the key failure is that enabling logging on a different policy does not create evidence for an uninspected flow.

Relying only on forward traffic acceptance can hide a blocked URL within the permitted connection can be a real concern elsewhere, such as when web-filter logs list only accepted network connections but the security administrator needs blocked category evidence. In the present scenario the key failure is that enabling logging on a different policy does not create evidence for an uninspected flow.

Disabling all IPS protection without identifying the expensive workload creates avoidable exposure can be a real concern elsewhere, such as when a FortiGate shows unusually high CPU utilization following activation of broad IPS scanning. In the present scenario the key failure is that enabling logging on a different policy does not create evidence for an uninspected flow.

Verify antivirus and deep SSL inspection profiles are both effective on the matching rule could correct a different FortiGate problem, such as when an outbound policy has antivirus enabled but a harmless EICAR test downloaded over HTTPS is not detected. The current case requires refine URL filtering patterns and inspect the requested hostnames before widening an exemption for its particular control path.

Open new controlled TLS sessions after policy changes and check actual SSL profile log events could correct a different FortiGate problem, such as when an administrator changes inspection profiles while old HTTPS sessions continue using previous trust behavior. The current case requires refine URL filtering patterns and inspect the requested hostnames before widening an exemption for its particular control path.

Move or refine the intended rule so inspected traffic matches the policy with the correct profile could correct a different FortiGate problem, such as when an organization applies an application-control profile but traffic follows an earlier broad allow rule without it. The current case requires refine URL filtering patterns and inspect the requested hostnames before widening an exemption for its particular control path.