Having an installed firmware image does not guarantee a current web filtering rating database can be a real concern elsewhere, such as when a FortiGate reports FortiGuard rating errors although the firewall appliance is registered. In the present scenario the key failure is that an IPS security event is not a substitute for ordinary accepted-session traffic history.

A successful ICMP echo cannot establish that TCP ports or SSL application handshakes work can be a real concern elsewhere, such as when a server is reachable by ping but HTTPS sessions are reset across one FortiGate interface. In the present scenario the key failure is that an IPS security event is not a substitute for ordinary accepted-session traffic history.

Rebooting the collector does not restore events intentionally filtered at the sender can be a real concern elsewhere, such as when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. In the present scenario the key failure is that an IPS security event is not a substitute for ordinary accepted-session traffic history.

The FortiGuard status is active and a rated test URL receives the intended classification could show improvement in a separate Fortinet case, for instance when a firewall can access the internet but web category queries return unrated responses after license expiration. The actual verification here is that the approved artifact exception works while other files and destinations remain subject to scanning.

Protected medical sessions remain exempt while unrelated malicious test traffic is still inspected could show improvement in a separate Fortinet case, for instance when a FortiGate is configured for deep inspection but legal policy forbids decryption of selected medical services. The actual verification here is that the approved artifact exception works while other files and destinations remain subject to scanning.

A safe IPS test generates the sensor event on the correct policy and prohibited traffic is dropped could show improvement in a separate Fortinet case, for instance when an IPS sensor is configured globally but no firewall rule references it for a protected subnet. The actual verification here is that the approved artifact exception works while other files and destinations remain subject to scanning.

An interface IP address does not itself supply a next hop for destinations outside connected subnets describes a distinct situation, for example when a branch FortiGate has no configured default route after its WAN address is assigned. Here the relevant FortiOS behavior is that administrative access protocols and source restrictions control exposure of the FortiGate management plane.

Central log collection requires a reachable supported collector and an approved device relationship describes a distinct situation, for example when a FortiGate forwards logs to FortiAnalyzer but the analytics appliance shows the device as unauthorized. Here the relevant FortiOS behavior is that administrative access protocols and source restrictions control exposure of the FortiGate management plane.

A FortiGate VLAN interface receives packets only for its configured tag carried over the parent link describes a distinct situation, for example when a FortiGate is connected to a trunk switch but a new department tag never reaches its firewall policy. Here the relevant FortiOS behavior is that administrative access protocols and source restrictions control exposure of the FortiGate management plane.

A scheduled test succeeds only during the authorized period and fails outside it could show improvement in a separate Fortinet case, for instance when a weekend maintenance exception must expire when business traffic resumes on Monday. The actual verification here is that a new external connection matches the VIP and specified policy and reaches the backend.

Each tenant matches its own policy ID and denied cross-tenant services remain blocked could show improvement in a separate Fortinet case, for instance when two tenant VLANs share the same destination but must have different permitted services. The actual verification here is that a new external connection matches the VIP and specified policy and reaches the backend.

A newly logged-on test user appears in the FortiGate monitor and matches the right group rule could show improvement in a separate Fortinet case, for instance when domain users should receive department internet access without entering another captive portal password. The actual verification here is that a new external connection matches the VIP and specified policy and reaches the backend.

A physically up primary interface can be unusable beyond its next hop without path monitoring can be a real concern elsewhere, such as when a server subnet needs redundant internet routes but the backup should activate only when primary path fails. In the present scenario the key failure is that assuming different administrative distances provide true equal-cost balancing is incorrect.

An unconditional top rule can capture all sessions before the finance-specific rule is evaluated can be a real concern elsewhere, such as when a branch wants to use cheap broadband for routine web browsing and reserve its private circuit for finance apps. In the present scenario the key failure is that assuming different administrative distances provide true equal-cost balancing is incorrect.

Using one unreliable monitoring endpoint can make health status misleading for all applications can be a real concern elsewhere, such as when a secondary ISP's SLA health stays green after its upstream provider disconnects a remote destination. In the present scenario the key failure is that assuming different administrative distances provide true equal-cost balancing is incorrect.

Review installed route types and administrative distances rather than creation chronology could correct a different FortiGate problem, such as when an administrator assumes routing favors a manually added static prefix over a connected prefix of equal specificity. The current case requires use SD-WAN rule priority and bandwidth monitoring to enforce the documented economic preference for its particular control path.

Validate equal-cost route eligibility and supported per-session path selection could correct a different FortiGate problem, such as when a data center wants to distribute eligible flows over two same-cost internet links but only one is used. The current case requires use SD-WAN rule priority and bandwidth monitoring to enforce the documented economic preference for its particular control path.

Add both supported WAN interfaces as SD-WAN members and assign the appropriate zone could correct a different FortiGate problem, such as when a branch has two ISP connections but its SD-WAN member configuration includes only the primary WAN interface. The current case requires use SD-WAN rule priority and bandwidth monitoring to enforce the documented economic preference for its particular control path.

Finance traffic uses the designated circuit and ordinary web sessions use permitted broadband could show improvement in a separate Fortinet case, for instance when a branch wants to use cheap broadband for routine web browsing and reserve its private circuit for finance apps. The actual verification here is that voice test sessions select the lower-jitter eligible link while performance SLA measurements stay in bounds.

The routing table selects the VPN interface for the branch prefix and the test application works could show improvement in a separate Fortinet case, for instance when a FortiGate has a default route to WAN but a specific branch network should use a site-to-site tunnel. The actual verification here is that voice test sessions select the lower-jitter eligible link while performance SLA measurements stay in bounds.

A staged member removal leaves only valid active routes and permitted flows still work could show improvement in a separate Fortinet case, for instance when an administrator removes a WAN link from the SD-WAN zone without updating route and policy dependencies. The actual verification here is that voice test sessions select the lower-jitter eligible link while performance SLA measurements stay in bounds.

A static route cannot refresh an expired upstream translation mapping by itself can be a real concern elsewhere, such as when an IPsec tunnel drops after an idle period because an upstream NAT device expires its UDP mapping. In the present scenario the key failure is that a second tunnel on the same failing underlay cannot guarantee independent disaster recovery.

Changing many encryption settings without log evidence can introduce new interoperability problems can be a real concern elsewhere, such as when a FortiGate reports repeated IKE negotiation errors but the network operations team lacks diagnostic evidence. In the present scenario the key failure is that a second tunnel on the same failing underlay cannot guarantee independent disaster recovery.

Expecting unmodified ESP forwarding through an arbitrary NAT device can prevent tunnel establishment can be a real concern elsewhere, such as when a remote office behind an ISP NAT device cannot establish an IPsec connection to the headquarters FortiGate. In the present scenario the key failure is that a second tunnel on the same failing underlay cannot guarantee independent disaster recovery.

Verify RADIUS server reachability shared secret and authentication request settings could correct a different FortiGate problem, such as when a remote RADIUS server accepts user credentials but FortiGate times out on every login attempt. The current case requires use distinct source interface or address matches to separate tenant firewall policies for its particular control path.

Inspect traffic session policy IDs and rule hit counters before removing redundant policies could correct a different FortiGate problem, such as when an administrator clones a broad outbound policy and later cannot identify which of the two is in use. The current case requires use distinct source interface or address matches to separate tenant firewall policies for its particular control path.

Inspect actual session policy IDs central NAT rules and source IP pool selection could correct a different FortiGate problem, such as when a firewall source address remains unexpectedly translated when traffic traverses a second policy. The current case requires use distinct source interface or address matches to separate tenant firewall policies for its particular control path.

Disabling deep inspection for every destination to solve one pinned client greatly reduces coverage can be a real concern elsewhere, such as when managed endpoints trust FortiGate deep inspection but certificate pinning breaks one critical finance application. In the present scenario the key failure is that importing the corporate inspection CA cannot repair an unrelated expired remote-server certificate.

A payload that remains encrypted cannot be reliably scanned as ordinary plaintext by the antivirus engine can be a real concern elsewhere, such as when an outbound policy has antivirus enabled but a harmless EICAR test downloaded over HTTPS is not detected. In the present scenario the key failure is that importing the corporate inspection CA cannot repair an unrelated expired remote-server certificate.

Assuming a destination port identifies an application across every encryption method is unreliable can be a real concern elsewhere, such as when users bypass a prohibited application signature after switching clients to an alternative encrypted protocol. In the present scenario the key failure is that importing the corporate inspection CA cannot repair an unrelated expired remote-server certificate.

Cloud-managed policy administration decouples remote-user inspection from branch firewall administrator access describes a distinct situation, for example when a business wants to enforce consistent web security for contractors without making them administrators of local FortiGates. Here the relevant FortiOS behavior is that layer-one errors and negotiated link parameters can degrade packets without any firewall policy mismatch.

Coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift describes a distinct situation, for example when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. Here the relevant FortiOS behavior is that layer-one errors and negotiated link parameters can degrade packets without any firewall policy mismatch.

FGCP election considers cluster priority and health conditions rather than simply device hostname describes a distinct situation, for example when a FortiGate cluster elects the wrong preferred primary after a power recovery. Here the relevant FortiOS behavior is that layer-one errors and negotiated link parameters can degrade packets without any firewall policy mismatch.