A logging destination can be reachable while configuration excludes particular event classes describes a distinct situation, for example when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. Here the relevant FortiOS behavior is that coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift.

Session-state synchronization can preserve eligible established connections across FGCP failover events describes a distinct situation, for example when an active-passive FortiGate pair drops established sessions when a primary unit fails unexpectedly. Here the relevant FortiOS behavior is that coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift.

FortiOS conserve mode protects resources when memory pressure passes defined operating thresholds describes a distinct situation, for example when users report intermittent internet outage while the FortiGate memory is near conserve-mode thresholds. Here the relevant FortiOS behavior is that coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift.

LDAP integration lets FortiGate validate supported directory identities through the specified server describes a distinct situation, for example when employees authenticate with a corporate directory but FortiGate has no LDAP server connector configured. Here the relevant FortiOS behavior is that FortiGate security profiles operate on traffic selected by the relevant enabled firewall policy.

FSSO group membership must be passed or retrieved in a form the firewall's policy understands describes a distinct situation, for example when an FSSO collector shows an active user but the FortiGate firewall policy cannot see the user's group. Here the relevant FortiOS behavior is that FortiGate security profiles operate on traffic selected by the relevant enabled firewall policy.

Source NAT rewrites internal source addresses so public return traffic reaches the firewall session describes a distinct situation, for example when multiple private office clients need internet access through a single FortiGate public WAN interface. Here the relevant FortiOS behavior is that FortiGate security profiles operate on traffic selected by the relevant enabled firewall policy.

Use the vendor-supported HA upgrade workflow with backups and post-upgrade sync validation could correct a different FortiGate problem, such as when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. The current case requires inspect the session table and evaluate clearing only affected sessions after approved policy changes for its particular control path.

Inspect memory utilization conserve-mode status and high-consuming processes before remediation could correct a different FortiGate problem, such as when users report intermittent internet outage while the FortiGate memory is near conserve-mode thresholds. The current case requires inspect the session table and evaluate clearing only affected sessions after approved policy changes for its particular control path.

Use approved FortiSASE onboarding and centrally managed internet access policy profiles could correct a different FortiGate problem, such as when a business wants to enforce consistent web security for contractors without making them administrators of local FortiGates. The current case requires inspect the session table and evaluate clearing only affected sessions after approved policy changes for its particular control path.

A successful directory bind does not prove the user belongs to the group permitted by the policy can be a real concern elsewhere, such as when an administrator cannot tell why a credential succeeds on LDAP but the firewall rejects access to a destination. In the present scenario the key failure is that creating a firewall group name without functional LDAP connectivity cannot prove user credentials.

Creating an allow rule below an earlier matching deny does not change the denial outcome can be a real concern elsewhere, such as when a new firewall rule permits an accounting subnet but earlier broad deny policy blocks the same destination. In the present scenario the key failure is that creating a firewall group name without functional LDAP connectivity cannot prove user credentials.

Two broad conflicting VIP mappings on the same public address and port cannot distinguish services can be a real concern elsewhere, such as when two applications behind one public IP must expose different TCP ports to different backend servers. In the present scenario the key failure is that creating a firewall group name without functional LDAP connectivity cannot prove user credentials.

A scoped traffic probe traverses the CNF policy path and appears in the expected service log could show improvement in a separate Fortinet case, for instance when a cloud team plans to use a FortiGate CNF deployment but omits workload association and route checks. The actual verification here is that post-upgrade validation shows expected configuration and services after each required upgrade hop.

The chosen supported instance passes a representative traffic and security-profile workload test could show improvement in a separate Fortinet case, for instance when a public cloud change uses an unsupported instance type for the intended FortiGate VM throughput. The actual verification here is that post-upgrade validation shows expected configuration and services after each required upgrade hop.

A controlled threat log and a routine traffic event appear under the approved filter selection could show improvement in a separate Fortinet case, for instance when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. The actual verification here is that post-upgrade validation shows expected configuration and services after each required upgrade hop.

A managed test browser trusts the inspection chain and the security profile can inspect approved HTTPS payloads could show improvement in a separate Fortinet case, for instance when an outbound deep-inspection policy causes corporate browsers to reject every HTTPS certificate generated by FortiGate. The actual verification here is that a saved compatible profile scans the vendor's safe test content on the selected policy.

A controlled browser test uses the approved transport and triggers the expected inspection result could show improvement in a separate Fortinet case, for instance when a policy claims to decrypt HTTPS traffic but QUIC over UDP is traversing the path unexpectedly. The actual verification here is that a saved compatible profile scans the vendor's safe test content on the selected policy.

A safe nested archive test produces the expected logged scan or policy fallback behavior could show improvement in a separate Fortinet case, for instance when an administrator needs to confirm whether nested archive files are scanned by a FortiGate antivirus profile. The actual verification here is that a saved compatible profile scans the vendor's safe test content on the selected policy.

Connected and static routes have distinct preference attributes when destinations overlap describes a distinct situation, for example when an administrator assumes routing favors a manually added static prefix over a connected prefix of equal specificity. Here the relevant FortiOS behavior is that SD-WAN zones and members participate in routing and policy references that survive interface changes.

A new SD-WAN member choice does not automatically preserve every existing transport session across different NAT IPs describes a distinct situation, for example when an application requires session persistence but users are disconnected when a monitored SD-WAN link changes state. Here the relevant FortiOS behavior is that SD-WAN zones and members participate in routing and policy references that survive interface changes.

Member selection policies can control cost-aware path use while honoring application performance requirements describes a distinct situation, for example when a managed branch sees more traffic on a costly metered link despite sufficient primary broadband capacity. Here the relevant FortiOS behavior is that SD-WAN zones and members participate in routing and policy references that survive interface changes.

A static route cannot refresh an expired upstream translation mapping by itself can be a real concern elsewhere, such as when an IPsec tunnel drops after an idle period because an upstream NAT device expires its UDP mapping. In the present scenario the key failure is that an enabled tunnel object with no child SA cannot secure ordinary private packets.

An established IKE SA alone does not create every required destination route automatically can be a real concern elsewhere, such as when a site-to-site tunnel remains listed as up but its local subnet has no route toward the remote protected prefix. In the present scenario the key failure is that an enabled tunnel object with no child SA cannot secure ordinary private packets.

One-way encryption cannot ensure end-to-end access when the peer returns traffic outside the tunnel can be a real concern elsewhere, such as when an IPsec tunnel encrypts traffic but a routing misconfiguration sends return packets over the public WAN. In the present scenario the key failure is that an enabled tunnel object with no child SA cannot secure ordinary private packets.

One subnet-wide allow policy cannot implement per-user group separation on its own can be a real concern elsewhere, such as when two user groups share a subnet but must receive different access privileges to an internal tool. In the present scenario the key failure is that granting ALL services to every destination unnecessarily expands reachable attack surface.

Treating private addresses as implicitly trusted can allow unintended lateral communication can be a real concern elsewhere, such as when a new east-west segmentation policy needs internal traffic logged without exposing every application port. In the present scenario the key failure is that granting ALL services to every destination unnecessarily expands reachable attack surface.

Creating an allow rule below an earlier matching deny does not change the denial outcome can be a real concern elsewhere, such as when a new firewall rule permits an accounting subnet but earlier broad deny policy blocks the same destination. In the present scenario the key failure is that granting ALL services to every destination unnecessarily expands reachable attack surface.

Add both supported WAN interfaces as SD-WAN members and assign the appropriate zone could correct a different FortiGate problem, such as when a branch has two ISP connections but its SD-WAN member configuration includes only the primary WAN interface. The current case requires use performance SLA probes toward representative reachable targets with relevant latency and loss thresholds for its particular control path.

Validate equal-cost route eligibility and supported per-session path selection could correct a different FortiGate problem, such as when a data center wants to distribute eligible flows over two same-cost internet links but only one is used. The current case requires use performance SLA probes toward representative reachable targets with relevant latency and loss thresholds for its particular control path.

Use SD-WAN rule priority and bandwidth monitoring to enforce the documented economic preference could correct a different FortiGate problem, such as when a managed branch sees more traffic on a costly metered link despite sufficient primary broadband capacity. The current case requires use performance SLA probes toward representative reachable targets with relevant latency and loss thresholds for its particular control path.

Adding another firewall allow rule cannot make an invalid next-hop address reachable can be a real concern elsewhere, such as when an office network cannot leave through a new internet circuit because its static default route references an unreachable gateway. In the present scenario the key failure is that a physically up primary interface can be unusable beyond its next hop without path monitoring.

Equal distribution over two unequal circuits may saturate the slower link unnecessarily can be a real concern elsewhere, such as when a business expects bandwidth-aware load distribution but FortiGate uses an equal-weight algorithm under asymmetric link speeds. In the present scenario the key failure is that a physically up primary interface can be unusable beyond its next hop without path monitoring.

A correct rule displayed in GUI may not be used if earlier matches or health exclusions apply can be a real concern elsewhere, such as when a firewall routes to an SD-WAN zone but a new service rule never selects the preferred member. In the present scenario the key failure is that a physically up primary interface can be unusable beyond its next hop without path monitoring.