Application recognition and traffic shaping can enforce differentiated treatment of supported traffic classes describes a distinct situation, for example when a research group wants to limit streaming media bandwidth but preserve interactive meeting traffic. Here the relevant FortiOS behavior is that profile feature-set compatibility determines which flow-based and proxy-based filtering capabilities are usable.

IPS sensors use signature categories and selected detection actions rather than blanket application denial describes a distinct situation, for example when an enterprise wants to block only verified high-severity exploit signatures rather than all unknown web requests. Here the relevant FortiOS behavior is that profile feature-set compatibility determines which flow-based and proxy-based filtering capabilities are usable.

Scanner limits influence whether oversized content can be fully processed before an allow decision describes a distinct situation, for example when a large file transfer bypasses antivirus checks because the configured inspection limits are exceeded. Here the relevant FortiOS behavior is that profile feature-set compatibility determines which flow-based and proxy-based filtering capabilities are usable.

FortiGate logging records matching context that can distinguish the policy responsible for a session describes a distinct situation, for example when an administrator sees a deny event but cannot determine which firewall policy matched the connection. Here the relevant FortiOS behavior is that cloud-managed policy administration decouples remote-user inspection from branch firewall administrator access.

Cloud-native firewall controls require both explicit traffic steering and correct security policy enforcement describes a distinct situation, for example when a cloud team plans to use a FortiGate CNF deployment but omits workload association and route checks. Here the relevant FortiOS behavior is that cloud-managed policy administration decouples remote-user inspection from branch firewall administrator access.

Stateful session entries retain forwarding information while an established session remains in service describes a distinct situation, for example when a FortiGate still matches an established session after an administrator edits the relevant firewall rule. Here the relevant FortiOS behavior is that cloud-managed policy administration decouples remote-user inspection from branch firewall administrator access.

IPsec NAT traversal encapsulates ESP in UDP where intermediate address translation requires it describes a distinct situation, for example when a remote office behind an ISP NAT device cannot establish an IPsec connection to the headquarters FortiGate. Here the relevant FortiOS behavior is that IPsec IKE negotiation requires contact with the intended reachable peer network endpoint.

Dynamic routing protocol setup is separate from establishing an encrypted route-based IPsec channel describes a distinct situation, for example when a customer switches from static VPN routes to BGP and assumes the IPsec tunnel automatically starts advertising every prefix. Here the relevant FortiOS behavior is that IPsec IKE negotiation requires contact with the intended reachable peer network endpoint.

Phase 2 builds IPsec security associations using compatible selectors and cryptographic policies describes a distinct situation, for example when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. Here the relevant FortiOS behavior is that IPsec IKE negotiation requires contact with the intended reachable peer network endpoint.

Switch the specific prohibited application signature to the intended block action after testing could correct a different FortiGate problem, such as when a new application-control policy is in monitor mode and administrators mistake its detection logs for blocking. The current case requires move or refine the intended rule so inspected traffic matches the policy with the correct profile for its particular control path.

Open new controlled TLS sessions after policy changes and check actual SSL profile log events could correct a different FortiGate problem, such as when an administrator changes inspection profiles while old HTTPS sessions continue using previous trust behavior. The current case requires move or refine the intended rule so inspected traffic matches the policy with the correct profile for its particular control path.

Apply relevant application-control actions and approved traffic shaping rather than broad network blocks could correct a different FortiGate problem, such as when a research group wants to limit streaming media bandwidth but preserve interactive meeting traffic. The current case requires move or refine the intended rule so inspected traffic matches the policy with the correct profile for its particular control path.

New-session diagnostics display the expected pre-NAT and post-NAT source addresses could show improvement in a separate Fortinet case, for instance when a firewall source address remains unexpectedly translated when traffic traverses a second policy. The actual verification here is that a permitted group can reach the tool while an authenticated disallowed group is denied.

The traffic flow matches the intended allow rule and unrelated connections are still denied could show improvement in a separate Fortinet case, for instance when a test packet has a matching route but FortiGate logs report an implicit firewall denial. The actual verification here is that a permitted group can reach the tool while an authenticated disallowed group is denied.

The trusted management workstation reaches the GUI and an unauthorized source remains blocked could show improvement in a separate Fortinet case, for instance when an admin cannot connect to the FortiGate GUI even though a transit firewall policy permits HTTPS packets. The actual verification here is that a permitted group can reach the tool while an authenticated disallowed group is denied.

Select an inspection configuration that can observe the requested URL detail and respect privacy policy could correct a different FortiGate problem, such as when an administrator uses a certificate-inspection-only policy but expects a path-specific HTTPS URL rule to match. The current case requires identify the exact IPS signature and create a narrowly scoped documented exception where justified for its particular control path.

Check the matching firewall rule antivirus profile and log filtering options before changing the signature could correct a different FortiGate problem, such as when a scheduled threat exercise produces no antivirus event although the file has a supported signature. The current case requires identify the exact IPS signature and create a narrowly scoped documented exception where justified for its particular control path.

Add a narrowly justified SSL inspection exemption for the pinned application and assess residual risk could correct a different FortiGate problem, such as when managed endpoints trust FortiGate deep inspection but certificate pinning breaks one critical finance application. The current case requires identify the exact IPS signature and create a narrowly scoped documented exception where justified for its particular control path.

Add a narrowly justified SSL inspection exemption for the pinned application and assess residual risk could correct a different FortiGate problem, such as when managed endpoints trust FortiGate deep inspection but certificate pinning breaks one critical finance application. The current case requires determine the matched policy ID and associate the correct flow or proxy web-filter profile for its particular control path.

Configure relevant IPS event logging and correlate with forward-traffic source and policy IDs could correct a different FortiGate problem, such as when an IPS detection event is present but analysts cannot determine which internal host initiated the suspicious traffic. The current case requires determine the matched policy ID and associate the correct flow or proxy web-filter profile for its particular control path.

Identify the exact IPS signature and create a narrowly scoped documented exception where justified could correct a different FortiGate problem, such as when an IPS signature causes disruption of a legitimate custom application during a production deployment. The current case requires determine the matched policy ID and associate the correct flow or proxy web-filter profile for its particular control path.

The known test peer maps to the designated tunnel while an unknown identity is rejected could show improvement in a separate Fortinet case, for instance when two IPsec tunnels use the same outbound WAN port but should accept only one known partner identity per tunnel. The actual verification here is that the routing table learns the approved remote CIDRs and permitted protected traffic succeeds.

The approved subnet exchanges data and denied subnets fail under the selected policy could show improvement in a separate Fortinet case, for instance when a FortiGate IPsec interface has an active route but private traffic is denied when it enters the VPN. The actual verification here is that the routing table learns the approved remote CIDRs and permitted protected traffic succeeds.

Each branch successfully negotiates the approved new proposal and weak ones are rejected could show improvement in a separate Fortinet case, for instance when a security group wants to deprecate weak IKE proposals without disconnecting all branch tunnels at once. The actual verification here is that the routing table learns the approved remote CIDRs and permitted protected traffic succeeds.

A safe test generates an IPS event with signature source destination and policy evidence could show improvement in a separate Fortinet case, for instance when an IPS detection event is present but analysts cannot determine which internal host initiated the suspicious traffic. The actual verification here is that the FortiGuard status is active and a rated test URL receives the intended classification.

A harmless test file is prevented from arriving and the log records the configured enforcement could show improvement in a separate Fortinet case, for instance when an antivirus alert is shown in monitor mode but the malware test file still reaches the endpoint. The actual verification here is that the FortiGuard status is active and a rated test URL receives the intended classification.

The authorized EICAR test download is blocked and an antivirus event is recorded could show improvement in a separate Fortinet case, for instance when an outbound policy has antivirus enabled but a harmless EICAR test downloaded over HTTPS is not detected. The actual verification here is that the FortiGuard status is active and a rated test URL receives the intended classification.

VPN redundancy requires both usable negotiated tunnels and a routing mechanism to choose alternatives describes a distinct situation, for example when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. Here the relevant FortiOS behavior is that IPsec NAT traversal encapsulates ESP in UDP where intermediate address translation requires it.

IPsec Phase 1 negotiates a compatible secure IKE association before establishing protected data traffic describes a distinct situation, for example when a branch FortiGate and a partner gateway fail IKE negotiation after administrators choose incompatible encryption proposals. Here the relevant FortiOS behavior is that IPsec NAT traversal encapsulates ESP in UDP where intermediate address translation requires it.

Dynamic routing protocol setup is separate from establishing an encrypted route-based IPsec channel describes a distinct situation, for example when a customer switches from static VPN routes to BGP and assumes the IPsec tunnel automatically starts advertising every prefix. Here the relevant FortiOS behavior is that IPsec NAT traversal encapsulates ESP in UDP where intermediate address translation requires it.

Each approved site pair exchanges traffic across its configured direct tunnel without central hairpinning could show improvement in a separate Fortinet case, for instance when a regional enterprise wants direct private connectivity between every pair of its small number of sites. The actual verification here is that a primary-path outage results in approved branch traffic flowing through the secondary tunnel.

Both peers report matching child SAs and permitted private traffic is encrypted could show improvement in a separate Fortinet case, for instance when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. The actual verification here is that a primary-path outage results in approved branch traffic flowing through the secondary tunnel.

A repeatable failed test shows its precise IKE error and the validated correction clears it could show improvement in a separate Fortinet case, for instance when a FortiGate reports repeated IKE negotiation errors but the network operations team lacks diagnostic evidence. The actual verification here is that a primary-path outage results in approved branch traffic flowing through the secondary tunnel.