Application payload signatures cannot inspect bytes concealed inside an undecrypted TLS session describes a distinct situation, for example when a known malicious HTTP payload passes although its IPS sensor exists and the firewall policy uses no SSL decryption. Here the relevant FortiOS behavior is that session state may preserve earlier policy decisions until a new traffic flow is evaluated.

Logging malware identification and preventing content delivery are distinct antivirus outcomes describes a distinct situation, for example when an antivirus alert is shown in monitor mode but the malware test file still reaches the endpoint. Here the relevant FortiOS behavior is that session state may preserve earlier policy decisions until a new traffic flow is evaluated.

An IPS can recognize signatures and enforce a drop action when attached to an active inspection policy describes a distinct situation, for example when a test server receives traffic matching a known remote exploit signature but FortiGate only logs the event. Here the relevant FortiOS behavior is that session state may preserve earlier policy decisions until a new traffic flow is evaluated.

An authorized synthetic exploit test is blocked and the IPS signature event identifies the action could show improvement in a separate Fortinet case, for instance when a test server receives traffic matching a known remote exploit signature but FortiGate only logs the event. The actual verification here is that the inspected traffic is associated with the expected application or a documented unsupported signature.

The approved training URL works and other sites in the blocked category still fail could show improvement in a separate Fortinet case, for instance when a specific legitimate training site is wrongly categorized as prohibited in the organization's web-filter rules. The actual verification here is that the inspected traffic is associated with the expected application or a documented unsupported signature.

CPU returns to the agreed baseline while required intrusion signatures remain enforced could show improvement in a separate Fortinet case, for instance when a FortiGate shows unusually high CPU utilization following activation of broad IPS scanning. The actual verification here is that the inspected traffic is associated with the expected application or a documented unsupported signature.

Patching one member arbitrarily and returning it without checks can disrupt HA synchronization can be a real concern elsewhere, such as when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. In the present scenario the key failure is that relying solely on a small volatile local log buffer can discard incident records.

Assuming every existing connection is immediately reevaluated as a new session can mislead troubleshooting can be a real concern elsewhere, such as when a FortiGate still matches an established session after an administrator edits the relevant firewall rule. In the present scenario the key failure is that relying solely on a small volatile local log buffer can discard incident records.

A forward-traffic firewall allow policy alone does not turn on FortiGate management-plane SSH can be a real concern elsewhere, such as when a remote maintenance team wants SSH access but a FortiGate interface only permits ping. In the present scenario the key failure is that relying solely on a small volatile local log buffer can discard incident records.

Route installation preference uses attributes including administrative distance before ECMP decisions describes a distinct situation, for example when a network engineer configures two equal destination routes but one has a lower administrative distance. Here the relevant FortiOS behavior is that longest-prefix route matching selects a specific destination route over a less-specific default route.

SD-WAN zones and members participate in routing and policy references that survive interface changes describes a distinct situation, for example when an administrator removes a WAN link from the SD-WAN zone without updating route and policy dependencies. Here the relevant FortiOS behavior is that longest-prefix route matching selects a specific destination route over a less-specific default route.

FortiGate can use multiple eligible routes for ECMP when route attributes support their simultaneous use describes a distinct situation, for example when a data center wants to distribute eligible flows over two same-cost internet links but only one is used. Here the relevant FortiOS behavior is that longest-prefix route matching selects a specific destination route over a less-specific default route.

Assuming branch-to-branch traffic is automatically permitted through the hub ignores policy and routing can be a real concern elsewhere, such as when a business must connect three branches to headquarters while limiting unnecessary branch-to-branch connections. In the present scenario the key failure is that an unscoped wildcard peer configuration may accept or route unexpected incoming negotiations.

A static route cannot refresh an expired upstream translation mapping by itself can be a real concern elsewhere, such as when an IPsec tunnel drops after an idle period because an upstream NAT device expires its UDP mapping. In the present scenario the key failure is that an unscoped wildcard peer configuration may accept or route unexpected incoming negotiations.

Removing every legacy transform before peer readiness can disconnect legitimate branches can be a real concern elsewhere, such as when a security group wants to deprecate weak IKE proposals without disconnecting all branch tunnels at once. In the present scenario the key failure is that an unscoped wildcard peer configuration may accept or route unexpected incoming negotiations.

Review identity group mapping and the FortiSASE policy assignment for the endpoint could correct a different FortiGate problem, such as when a remote laptop is registered in FortiSASE but is not assigned the correct user access entitlement. The current case requires add a valid default route toward the upstream gateway and verify interface addressing for its particular control path.

Configure an authorized external syslog or FortiAnalyzer destination with retention controls could correct a different FortiGate problem, such as when the firewall has limited local storage but auditors require logs beyond the appliance retention window. The current case requires add a valid default route toward the upstream gateway and verify interface addressing for its particular control path.

Enable appropriate forward-traffic logging on the matched firewall policy and log destination could correct a different FortiGate problem, such as when security analysts cannot find allowed outbound flows because the matching policy records only security events. The current case requires add a valid default route toward the upstream gateway and verify interface addressing for its particular control path.

SD-WAN service evaluation combines rule matches with current eligible link and route state describes a distinct situation, for example when a firewall routes to an SD-WAN zone but a new service rule never selects the preferred member. Here the relevant FortiOS behavior is that routing blackholes can discard destination prefixes while firewall policies enforce access boundaries.

Backup path selection needs a health condition or withdrawn preferred route in addition to a route entry describes a distinct situation, for example when a server subnet needs redundant internet routes but the backup should activate only when primary path fails. Here the relevant FortiOS behavior is that routing blackholes can discard destination prefixes while firewall policies enforce access boundaries.

Configured static entries enter the forwarding table only when relevant interface and route conditions are met describes a distinct situation, for example when an administrator created a static route for a cloud subnet but the route remains inactive in the routing monitor. Here the relevant FortiOS behavior is that routing blackholes can discard destination prefixes while firewall policies enforce access boundaries.

A permitted test flow creates a searchable forward-traffic log with policy and interface details could show improvement in a separate Fortinet case, for instance when security analysts cannot find allowed outbound flows because the matching policy records only security events. The actual verification here is that a controlled individual heartbeat-path outage leaves the cluster stable and reports the expected state.

A controlled threat log and a routine traffic event appear under the approved filter selection could show improvement in a separate Fortinet case, for instance when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. The actual verification here is that a controlled individual heartbeat-path outage leaves the cluster stable and reports the expected state.

A contractor test session is inspected under its restricted policy without network device admin rights could show improvement in a separate Fortinet case, for instance when a business wants to enforce consistent web security for contractors without making them administrators of local FortiGates. The actual verification here is that a controlled individual heartbeat-path outage leaves the cluster stable and reports the expected state.

A safe category test creates an event showing the matched rule category and enforcement action could show improvement in a separate Fortinet case, for instance when web-filter logs list only accepted network connections but the security administrator needs blocked category evidence. The actual verification here is that a known blocked category returns the expected denial page and a permitted category loads normally.

The chosen known-exploit test is denied while normal permitted requests continue could show improvement in a separate Fortinet case, for instance when an enterprise wants to block only verified high-severity exploit signatures rather than all unknown web requests. The actual verification here is that a known blocked category returns the expected denial page and a permitted category loads normally.

The saved policy accepts a compatible profile and category decisions appear in the traffic logs could show improvement in a separate Fortinet case, for instance when a proxy-based web filter profile cannot be applied to a policy configured for an incompatible flow inspection mode. The actual verification here is that a known blocked category returns the expected denial page and a permitted category loads normally.

Configure a secure LDAP authentication server and map permitted groups into policy could correct a different FortiGate problem, such as when employees authenticate with a corporate directory but FortiGate has no LDAP server connector configured. The current case requires enable supported per-policy traffic logging and verify event fields from a fresh session for its particular control path.

Use the SD-WAN zone as the relevant policy egress interface with the approved source and services could correct a different FortiGate problem, such as when a branch uses an SD-WAN zone with two WAN members but its firewall policy names only a member interface. The current case requires enable supported per-policy traffic logging and verify event fields from a fresh session for its particular control path.

Check interface administrative access and management-plane local-in restrictions could correct a different FortiGate problem, such as when an admin cannot connect to the FortiGate GUI even though a transit firewall policy permits HTTPS packets. The current case requires enable supported per-policy traffic logging and verify event fields from a fresh session for its particular control path.

A logging destination can be reachable while configuration excludes particular event classes describes a distinct situation, for example when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. Here the relevant FortiOS behavior is that coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift.

Session-state synchronization can preserve eligible established connections across FGCP failover events describes a distinct situation, for example when an active-passive FortiGate pair drops established sessions when a primary unit fails unexpectedly. Here the relevant FortiOS behavior is that coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift.

FortiOS conserve mode protects resources when memory pressure passes defined operating thresholds describes a distinct situation, for example when users report intermittent internet outage while the FortiGate memory is near conserve-mode thresholds. Here the relevant FortiOS behavior is that coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift.