The FortiGate routing table includes a usable default gateway and permitted external probes succeed could show improvement in a separate Fortinet case, for instance when a branch FortiGate has no configured default route after its WAN address is assigned. The actual verification here is that a staged compatible restore reproduces the intended rulebase and device settings in a lab.

A supported signature update and a test category query succeed with current entitlement information could show improvement in a separate Fortinet case, for instance when a FortiGate reports FortiGuard rating errors although the firewall appliance is registered. The actual verification here is that a staged compatible restore reproduces the intended rulebase and device settings in a lab.

The approved administrator authenticates on the management interface and unapproved paths stay closed could show improvement in a separate Fortinet case, for instance when a remote maintenance team wants SSH access but a FortiGate interface only permits ping. The actual verification here is that a staged compatible restore reproduces the intended rulebase and device settings in a lab.

A saved compatible profile scans the vendor's safe test content on the selected policy could show improvement in a separate Fortinet case, for instance when an administrator attaches a proxy-based antivirus profile to a flow-based firewall policy and sees a configuration conflict. The actual verification here is that a safe test generates an IPS event with signature source destination and policy evidence.

A known blocked category returns the expected denial page and a permitted category loads normally could show improvement in a separate Fortinet case, for instance when a school wants to prevent students from visiting known malicious website categories on permitted web traffic. The actual verification here is that a safe test generates an IPS event with signature source destination and policy evidence.

The saved policy accepts a compatible profile and category decisions appear in the traffic logs could show improvement in a separate Fortinet case, for instance when a proxy-based web filter profile cannot be applied to a policy configured for an incompatible flow inspection mode. The actual verification here is that a safe test generates an IPS event with signature source destination and policy evidence.

A successful directory bind does not prove the user belongs to the group permitted by the policy can be a real concern elsewhere, such as when an administrator cannot tell why a credential succeeds on LDAP but the firewall rejects access to a destination. In the present scenario the key failure is that a single collector failure can prevent fresh user mappings despite healthy directory controllers.

Translating the source before the IPsec path can break the peer's expected selectors and access rules can be a real concern elsewhere, such as when an internal application connecting to a partner VPN must preserve its original private source address. In the present scenario the key failure is that a single collector failure can prevent fresh user mappings despite healthy directory controllers.

Installing an agent alone does not associate every device IP with a user identity can be a real concern elsewhere, such as when a domain controller agent is forwarding events but FortiGate FSSO still marks several user IPs unknown. In the present scenario the key failure is that a single collector failure can prevent fresh user mappings despite healthy directory controllers.

Application-layer web filtering events provide classification detail distinct from session-level allow logs describes a distinct situation, for example when web-filter logs list only accepted network connections but the security administrator needs blocked category evidence. Here the relevant FortiOS behavior is that warning and blocking are different enforced actions even when they target the same URL category.

Antivirus efficacy depends in part on signatures and engines that are maintained through update services describes a distinct situation, for example when a FortiGate antivirus signature database has not been updated after the WAN was disconnected for weeks. Here the relevant FortiOS behavior is that warning and blocking are different enforced actions even when they target the same URL category.

Deep packet inspection consumes system processing resources according to traffic and sensor complexity describes a distinct situation, for example when a FortiGate shows unusually high CPU utilization following activation of broad IPS scanning. Here the relevant FortiOS behavior is that warning and blocking are different enforced actions even when they target the same URL category.

Application signatures require sufficient observable traffic characteristics for reliable identification describes a distinct situation, for example when users bypass a prohibited application signature after switching clients to an alternative encrypted protocol. Here the relevant FortiOS behavior is that FortiOS web filtering is applied by the security profile on the actual matched firewall policy.

Application-control logs can correlate recognized protocol and application signatures with policy actions describes a distinct situation, for example when a security operations dashboard shows generic unknown applications and little useful detail for a new workload. Here the relevant FortiOS behavior is that FortiOS web filtering is applied by the security profile on the actual matched firewall policy.

Logging malware identification and preventing content delivery are distinct antivirus outcomes describes a distinct situation, for example when an antivirus alert is shown in monitor mode but the malware test file still reaches the endpoint. Here the relevant FortiOS behavior is that FortiOS web filtering is applied by the security profile on the actual matched firewall policy.

Member selection policies can control cost-aware path use while honoring application performance requirements describes a distinct situation, for example when a managed branch sees more traffic on a costly metered link despite sufficient primary broadband capacity. Here the relevant FortiOS behavior is that stateful policy enforcement needs a consistent forward and return packet route for established sessions.

FortiGate can use multiple eligible routes for ECMP when route attributes support their simultaneous use describes a distinct situation, for example when a data center wants to distribute eligible flows over two same-cost internet links but only one is used. Here the relevant FortiOS behavior is that stateful policy enforcement needs a consistent forward and return packet route for established sessions.

Routing blackholes can discard destination prefixes while firewall policies enforce access boundaries describes a distinct situation, for example when an isolated guest subnet must not use a broad route to reach a prohibited private destination. Here the relevant FortiOS behavior is that stateful policy enforcement needs a consistent forward and return packet route for established sessions.

The upstream certificate chain passes expected validation and a forged test certificate is rejected could show improvement in a separate Fortinet case, for instance when an external server shows certificate chain errors only when TLS traffic traverses a newly enabled FortiGate profile. The actual verification here is that a test confirms hostname-level decisions work while full URL path content remains unavailable.

A fresh request matches the expected policy and records the correct web-filter action could show improvement in a separate Fortinet case, for instance when a web-filter policy is attached to the wrong firewall rule and blocked sites remain reachable. The actual verification here is that a test confirms hostname-level decisions work while full URL path content remains unavailable.

The device reports an updated package and safely detects a known test signature could show improvement in a separate Fortinet case, for instance when a FortiGate antivirus signature database has not been updated after the WAN was disconnected for weeks. The actual verification here is that a test confirms hostname-level decisions work while full URL path content remains unavailable.

Interface monitoring allows HA health calculations to include loss of specified physical connections describes a distinct situation, for example when a cluster fails to trigger high availability when its primary WAN physical interface loses carrier. Here the relevant FortiOS behavior is that FortiOS debug flow exposes packet processing and matching information for selected sessions.

User authorization and endpoint enrollment are separate decisions in cloud access service policies describes a distinct situation, for example when a remote laptop is registered in FortiSASE but is not assigned the correct user access entitlement. Here the relevant FortiOS behavior is that FortiOS debug flow exposes packet processing and matching information for selected sessions.

FGCP membership requires compatible members and shared HA configuration for election and synchronization describes a distinct situation, for example when two FortiGates refuse to join the same FGCP high-availability cluster after installation. Here the relevant FortiOS behavior is that FortiOS debug flow exposes packet processing and matching information for selected sessions.

The retained specific policy shows expected test hits and the redundant rule has no critical matches could show improvement in a separate Fortinet case, for instance when an administrator clones a broad outbound policy and later cannot identify which of the two is in use. The actual verification here is that the partner logs the approved pool IP and other destinations retain their intended translation.

Each tenant matches its own policy ID and denied cross-tenant services remain blocked could show improvement in a separate Fortinet case, for instance when two tenant VLANs share the same destination but must have different permitted services. The actual verification here is that the partner logs the approved pool IP and other destinations retain their intended translation.

The group appears in FortiGate monitoring and the authorized policy matches the test session could show improvement in a separate Fortinet case, for instance when an FSSO collector shows an active user but the FortiGate firewall policy cannot see the user's group. The actual verification here is that the partner logs the approved pool IP and other destinations retain their intended translation.

Policy order and actual session matching determine which apparently duplicate rule is effective describes a distinct situation, for example when an administrator clones a broad outbound policy and later cannot identify which of the two is in use. Here the relevant FortiOS behavior is that fine-grained firewall policy objects express least-privilege transport and address access boundaries.

RADIUS transactions require matching client-server authentication configuration and network delivery describes a distinct situation, for example when a remote RADIUS server accepts user credentials but FortiGate times out on every login attempt. Here the relevant FortiOS behavior is that fine-grained firewall policy objects express least-privilege transport and address access boundaries.

Policy schedules gate matching permission in addition to the address and service fields describes a distinct situation, for example when a weekend maintenance exception must expire when business traffic resumes on Monday. Here the relevant FortiOS behavior is that fine-grained firewall policy objects express least-privilege transport and address access boundaries.

Verify the collector group filters and FortiGate FSSO group mapping configuration could correct a different FortiGate problem, such as when an FSSO collector shows an active user but the FortiGate firewall policy cannot see the user's group. The current case requires use the SD-WAN zone as the relevant policy egress interface with the approved source and services for its particular control path.

Enable source NAT using the permitted outbound interface address on the matching policy could correct a different FortiGate problem, such as when multiple private office clients need internet access through a single FortiGate public WAN interface. The current case requires use the SD-WAN zone as the relevant policy egress interface with the approved source and services for its particular control path.

Configure supported backup collector connections and validate reachability and failover could correct a different FortiGate problem, such as when a branch FortiGate loses access to FSSO authentication when its primary collector service stops. The current case requires use the SD-WAN zone as the relevant policy egress interface with the approved source and services for its particular control path.