Configure appropriate remote-gateway identity matching and IKEv2 network identifiers where supported could correct a different FortiGate problem, such as when two IPsec tunnels use the same outbound WAN port but should accept only one known partner identity per tunnel. The current case requires correct symmetric routing and firewall policies for the protected destination prefixes for its particular control path.

Align supported IKE version authentication and Phase 1 encryption and integrity proposals on both peers could correct a different FortiGate problem, such as when a branch FortiGate and a partner gateway fail IKE negotiation after administrators choose incompatible encryption proposals. The current case requires correct symmetric routing and firewall policies for the protected destination prefixes for its particular control path.

Configure eligible backup routes and monitored failover behavior across independent IPsec interfaces could correct a different FortiGate problem, such as when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. The current case requires correct symmetric routing and firewall policies for the protected destination prefixes for its particular control path.

An IP-only broad allow rule cannot substitute for authenticated department-based identity mapping can be a real concern elsewhere, such as when domain users should receive department internet access without entering another captive portal password. In the present scenario the key failure is that a stale authenticated session or obsolete group mapping can extend previously granted access.

An incompatible profile feature set may not operate as expected on the selected inspection mode can be a real concern elsewhere, such as when a firewall deployment must inspect traffic without sending the full HTTP request through proxy-based processing. In the present scenario the key failure is that a stale authenticated session or obsolete group mapping can extend previously granted access.

Assuming remote authentication always works during an internet outage can lock out support can be a real concern elsewhere, such as when a firewall deployment has local emergency users and a remote RADIUS service that may be unreachable. In the present scenario the key failure is that a stale authenticated session or obsolete group mapping can extend previously granted access.

Internal-to-internal traffic still requires a matching FortiGate policy when it traverses the firewall describes a distinct situation, for example when a new east-west segmentation policy needs internal traffic logged without exposing every application port. Here the relevant FortiOS behavior is that destination NAT and forwarding authorization must both apply for the public service to work.

Source NAT is optional per policy and may be inappropriate for private routed networks describes a distinct situation, for example when an internal application connecting to a partner VPN must preserve its original private source address. Here the relevant FortiOS behavior is that destination NAT and forwarding authorization must both apply for the public service to work.

Destination NAT via a FortiGate VIP maps the published address or port to the internal destination describes a distinct situation, for example when a public-facing server behind FortiGate must accept HTTPS on a fixed external address. Here the relevant FortiOS behavior is that destination NAT and forwarding authorization must both apply for the public service to work.

Review archive nesting and decompression limits under the supported antivirus profile settings could correct a different FortiGate problem, such as when an administrator needs to confirm whether nested archive files are scanned by a FortiGate antivirus profile. The current case requires deploy the appropriate trusted FortiGate inspection CA to managed endpoints before deep SSL inspection for its particular control path.

Select an inspection configuration that can observe the requested URL detail and respect privacy policy could correct a different FortiGate problem, such as when an administrator uses a certificate-inspection-only policy but expects a path-specific HTTPS URL rule to match. The current case requires deploy the appropriate trusted FortiGate inspection CA to managed endpoints before deep SSL inspection for its particular control path.

Check the matching firewall rule antivirus profile and log filtering options before changing the signature could correct a different FortiGate problem, such as when a scheduled threat exercise produces no antivirus event although the file has a supported signature. The current case requires deploy the appropriate trusted FortiGate inspection CA to managed endpoints before deep SSL inspection for its particular control path.

Application-control logs can correlate recognized protocol and application signatures with policy actions describes a distinct situation, for example when a security operations dashboard shows generic unknown applications and little useful detail for a new workload. Here the relevant FortiOS behavior is that encrypted HTTPS URL paths are generally hidden without approved decryption of application data.

Web filtering evaluates configured category decisions when the required URL classification is available describes a distinct situation, for example when a school wants to prevent students from visiting known malicious website categories on permitted web traffic. Here the relevant FortiOS behavior is that encrypted HTTPS URL paths are generally hidden without approved decryption of application data.

Deep TLS inspection reissues server certificates under a trusted inspection authority to expose encrypted content describes a distinct situation, for example when an outbound deep-inspection policy causes corporate browsers to reject every HTTPS certificate generated by FortiGate. Here the relevant FortiOS behavior is that encrypted HTTPS URL paths are generally hidden without approved decryption of application data.

Enable appropriate forward-traffic logging on the matched firewall policy and log destination could correct a different FortiGate problem, such as when security analysts cannot find allowed outbound flows because the matching policy records only security events. The current case requires use approved FortiSASE onboarding and centrally managed internet access policy profiles for its particular control path.

Configure supported dedicated HA management interfaces and per-unit access settings could correct a different FortiGate problem, such as when an administrator cannot reach the secondary FortiGate independently to diagnose its failed hardware sensor. The current case requires use approved FortiSASE onboarding and centrally managed internet access policy profiles for its particular control path.

Use the vendor-supported HA upgrade workflow with backups and post-upgrade sync validation could correct a different FortiGate problem, such as when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. The current case requires use approved FortiSASE onboarding and centrally managed internet access policy profiles for its particular control path.

An authorized workstation reaches the management login while an untrusted test host is denied could show improvement in a separate Fortinet case, for instance when a freshly installed FortiGate allows administrative HTTPS from an untrusted transit network. The actual verification here is that HA status shows both expected units with a designated primary and synchronized configuration.

Post-upgrade validation shows expected configuration and services after each required upgrade hop could show improvement in a separate Fortinet case, for instance when a firmware rollout has multiple supported intermediate upgrade steps that operations intends to skip. The actual verification here is that HA status shows both expected units with a designated primary and synchronized configuration.

A supported signature update and a test category query succeed with current entitlement information could show improvement in a separate Fortinet case, for instance when a FortiGate reports FortiGuard rating errors although the firewall appliance is registered. The actual verification here is that HA status shows both expected units with a designated primary and synchronized configuration.

The traffic flow matches the intended allow rule and unrelated connections are still denied could show improvement in a separate Fortinet case, for instance when a test packet has a matching route but FortiGate logs report an implicit firewall denial. The actual verification here is that a documented outage rehearsal still permits only the designated emergency role and records usage.

The corporate source matches the desired rule and a guest subnet with similar identity data is denied could show improvement in a separate Fortinet case, for instance when FortiGate shows FSSO identity for a workstation but a separate guest subnet should never inherit that access. The actual verification here is that a documented outage rehearsal still permits only the designated emergency role and records usage.

Sessions continue through healthy members of the designated zone while the expected policy matches could show improvement in a separate Fortinet case, for instance when a branch uses an SD-WAN zone with two WAN members but its firewall policy names only a member interface. The actual verification here is that a documented outage rehearsal still permits only the designated emergency role and records usage.

Check the matching firewall rule antivirus profile and log filtering options before changing the signature could correct a different FortiGate problem, such as when a scheduled threat exercise produces no antivirus event although the file has a supported signature. The current case requires review configured file size and oversize-file handling for the applicable antivirus inspection mode for its particular control path.

Test a new session and verify the active application-control policy and recognition events could correct a different FortiGate problem, such as when an administrator changes an application-control signature action but the client continues using an established session. The current case requires review configured file size and oversize-file handling for the applicable antivirus inspection mode for its particular control path.

Review application-identification visibility and supported encrypted-transport handling could correct a different FortiGate problem, such as when users bypass a prohibited application signature after switching clients to an alternative encrypted protocol. The current case requires review configured file size and oversize-file handling for the applicable antivirus inspection mode for its particular control path.

Archive inspection is bounded by supported size and recursion limits to protect device resources describes a distinct situation, for example when an administrator needs to confirm whether nested archive files are scanned by a FortiGate antivirus profile. Here the relevant FortiOS behavior is that antivirus efficacy depends in part on signatures and engines that are maintained through update services.

Established sessions can retain processing context and may not reflect every policy change immediately describes a distinct situation, for example when an administrator changes inspection profiles while old HTTPS sessions continue using previous trust behavior. Here the relevant FortiOS behavior is that antivirus efficacy depends in part on signatures and engines that are maintained through update services.

Inbound SSL server protection requires suitable certificate identity and key material for the protected service describes a distinct situation, for example when a bank requests inspection of its own HTTPS web server traffic entering through a FortiGate VIP. Here the relevant FortiOS behavior is that antivirus efficacy depends in part on signatures and engines that are maintained through update services.

The FortiGate routing table includes a usable default gateway and permitted external probes succeed could show improvement in a separate Fortinet case, for instance when a branch FortiGate has no configured default route after its WAN address is assigned. The actual verification here is that a staged compatible restore reproduces the intended rulebase and device settings in a lab.

A supported signature update and a test category query succeed with current entitlement information could show improvement in a separate Fortinet case, for instance when a FortiGate reports FortiGuard rating errors although the firewall appliance is registered. The actual verification here is that a staged compatible restore reproduces the intended rulebase and device settings in a lab.

The approved administrator authenticates on the management interface and unapproved paths stay closed could show improvement in a separate Fortinet case, for instance when a remote maintenance team wants SSH access but a FortiGate interface only permits ping. The actual verification here is that a staged compatible restore reproduces the intended rulebase and device settings in a lab.