Identity-aware policies can distinguish authenticated groups beyond network source-address criteria describes a distinct situation, for example when two user groups share a subnet but must receive different access privileges to an internal tool. Here the relevant FortiOS behavior is that source interface and source address criteria distinguish traffic from otherwise similar destinations.

Passive identity mappings can become stale when workstation and logoff events are missed describes a distinct situation, for example when an employee changes computers and FSSO grants the old workstation the same access for an extended period. Here the relevant FortiOS behavior is that source interface and source address criteria distinguish traffic from otherwise similar destinations.

Policy-specific traffic logs provide evidence of access decisions in addition to the configured rule text describes a distinct situation, for example when a developer wants to inspect why an allow policy is matched but session logs contain no policy IDs. Here the relevant FortiOS behavior is that source interface and source address criteria distinguish traffic from otherwise similar destinations.

IKE and data traffic use the supported NAT-T path and private connectivity succeeds could show improvement in a separate Fortinet case, for instance when a remote office behind an ISP NAT device cannot establish an IPsec connection to the headquarters FortiGate. The actual verification here is that the known test peer maps to the designated tunnel while an unknown identity is rejected.

Bidirectional captures show both directions protected by the intended VPN security associations could show improvement in a separate Fortinet case, for instance when an IPsec tunnel encrypts traffic but a routing misconfiguration sends return packets over the public WAN. The actual verification here is that the known test peer maps to the designated tunnel while an unknown identity is rejected.

Each approved site pair exchanges traffic across its configured direct tunnel without central hairpinning could show improvement in a separate Fortinet case, for instance when a regional enterprise wants direct private connectivity between every pair of its small number of sites. The actual verification here is that the known test peer maps to the designated tunnel while an unknown identity is rejected.

A staged compatible restore reproduces the intended rulebase and device settings in a lab could show improvement in a separate Fortinet case, for instance when an administrator must restore a firewall after a hardware failure without rebuilding hundreds of objects. The actual verification here is that the captured diagnostic output identifies the policy or route decision responsible for the drop.

A long-lived eligible application connection survives a tested primary failover as configured could show improvement in a separate Fortinet case, for instance when an active-passive FortiGate pair drops established sessions when a primary unit fails unexpectedly. The actual verification here is that the captured diagnostic output identifies the policy or route decision responsible for the drop.

A test client receives the expected address gateway and DNS options on the intended VLAN could show improvement in a separate Fortinet case, for instance when a new internal VLAN needs addresses from the FortiGate but clients are using stale manual settings. The actual verification here is that the captured diagnostic output identifies the policy or route decision responsible for the drop.

Use explicit source destination service criteria with forward-traffic logging for the approved segment could correct a different FortiGate problem, such as when a new east-west segmentation policy needs internal traffic logged without exposing every application port. The current case requires integrate a supported FSSO collector with directory logon events and identity-based firewall rules for its particular control path.

Configure an approved captive-portal authentication flow on the restricted firewall policy could correct a different FortiGate problem, such as when guest internet access must require interactive sign-in instead of silently trusting any client source. The current case requires integrate a supported FSSO collector with directory logon events and identity-based firewall rules for its particular control path.

Use distinct source interface or address matches to separate tenant firewall policies could correct a different FortiGate problem, such as when two tenant VLANs share the same destination but must have different permitted services. The current case requires integrate a supported FSSO collector with directory logon events and identity-based firewall rules for its particular control path.

Routing reachability and an authorized FortiGate forwarding policy are independent requirements describes a distinct situation, for example when a test packet has a matching route but FortiGate logs report an implicit firewall denial. Here the relevant FortiOS behavior is that traffic destined for the FortiGate itself uses management-plane controls separate from normal transit firewall rules.

Destination NAT via a FortiGate VIP maps the published address or port to the internal destination describes a distinct situation, for example when a public-facing server behind FortiGate must accept HTTPS on a fixed external address. Here the relevant FortiOS behavior is that traffic destined for the FortiGate itself uses management-plane controls separate from normal transit firewall rules.

Passive identity mappings can become stale when workstation and logoff events are missed describes a distinct situation, for example when an employee changes computers and FSSO grants the old workstation the same access for an extended period. Here the relevant FortiOS behavior is that traffic destined for the FortiGate itself uses management-plane controls separate from normal transit firewall rules.

The captured diagnostic output identifies the policy or route decision responsible for the drop could show improvement in a separate Fortinet case, for instance when a branch FortiGate denies a new connection although the engineer believes a broad accept rule covers it. The actual verification here is that the approved test path traverses supported cloud-native inspection and produces expected security telemetry.

A controlled threat log and a routine traffic event appear under the approved filter selection could show improvement in a separate Fortinet case, for instance when after changing the logging severity filter FortiGate threat events stop appearing in a syslog collector. The actual verification here is that the approved test path traverses supported cloud-native inspection and produces expected security telemetry.

The management station connects to the specified unit while normal cluster traffic remains stable could show improvement in a separate Fortinet case, for instance when an administrator cannot reach the secondary FortiGate independently to diagnose its failed hardware sensor. The actual verification here is that the approved test path traverses supported cloud-native inspection and produces expected security telemetry.

An established IPsec session does not mean a BGP neighbor is exchanging the desired private prefixes can be a real concern elsewhere, such as when a customer switches from static VPN routes to BGP and assumes the IPsec tunnel automatically starts advertising every prefix. In the present scenario the key failure is that using one headquarters relay when direct paths are required can create unnecessary transit latency.

One-way encryption cannot ensure end-to-end access when the peer returns traffic outside the tunnel can be a real concern elsewhere, such as when an IPsec tunnel encrypts traffic but a routing misconfiguration sends return packets over the public WAN. In the present scenario the key failure is that using one headquarters relay when direct paths are required can create unnecessary transit latency.

A healthy IKE Phase 1 by itself does not guarantee any encrypted application packets can traverse can be a real concern elsewhere, such as when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. In the present scenario the key failure is that using one headquarters relay when direct paths are required can create unnecessary transit latency.

Add a valid default route toward the upstream gateway and verify interface addressing could correct a different FortiGate problem, such as when a branch FortiGate has no configured default route after its WAN address is assigned. The current case requires use the vendor-supported HA upgrade workflow with backups and post-upgrade sync validation for its particular control path.

Configure HA monitored interfaces so critical uplinks influence the device failover decision could correct a different FortiGate problem, such as when a cluster fails to trigger high availability when its primary WAN physical interface loses carrier. The current case requires use the vendor-supported HA upgrade workflow with backups and post-upgrade sync validation for its particular control path.

Design independent supported heartbeat paths and verify failover detection timing could correct a different FortiGate problem, such as when a FortiGate cluster uses two heartbeat cables but both share an unreliable aggregation switch. The current case requires use the vendor-supported HA upgrade workflow with backups and post-upgrade sync validation for its particular control path.

IPsec NAT traversal encapsulates ESP in UDP where intermediate address translation requires it describes a distinct situation, for example when a remote office behind an ISP NAT device cannot establish an IPsec connection to the headquarters FortiGate. Here the relevant FortiOS behavior is that vPN redundancy requires both usable negotiated tunnels and a routing mechanism to choose alternatives.

IPsec routing and FortiGate forwarding policy authorizations are separate controls describes a distinct situation, for example when a FortiGate IPsec interface has an active route but private traffic is denied when it enters the VPN. Here the relevant FortiOS behavior is that vPN redundancy requires both usable negotiated tunnels and a routing mechanism to choose alternatives.

Periodic NAT-T keepalives and peer detection maintain or reestablish idle tunnel reachability describes a distinct situation, for example when an IPsec tunnel drops after an idle period because an upstream NAT device expires its UDP mapping. Here the relevant FortiOS behavior is that vPN redundancy requires both usable negotiated tunnels and a routing mechanism to choose alternatives.

One subnet-wide allow policy cannot implement per-user group separation on its own can be a real concern elsewhere, such as when two user groups share a subnet but must receive different access privileges to an internal tool. In the present scenario the key failure is that binding policy only to one member can break desired failover as sessions change links.

An incompatible profile feature set may not operate as expected on the selected inspection mode can be a real concern elsewhere, such as when a firewall deployment must inspect traffic without sending the full HTTP request through proxy-based processing. In the present scenario the key failure is that binding policy only to one member can break desired failover as sessions change links.

Correct username and password values do not compensate for a mismatched shared secret can be a real concern elsewhere, such as when a remote RADIUS server accepts user credentials but FortiGate times out on every login attempt. In the present scenario the key failure is that binding policy only to one member can break desired failover as sessions change links.

Use narrowly justified antivirus exceptions with an explicit risk and expiration review could correct a different FortiGate problem, such as when a trusted software vendor distributes digitally signed executables and analysts want to bypass all antivirus scans for that domain. The current case requires create a narrowly scoped approved local URL or rating override for that site for its particular control path.

Apply a FortiGuard web-filter profile with appropriate category blocking on the matching policy could correct a different FortiGate problem, such as when a school wants to prevent students from visiting known malicious website categories on permitted web traffic. The current case requires create a narrowly scoped approved local URL or rating override for that site for its particular control path.

Move or refine the intended rule so inspected traffic matches the policy with the correct profile could correct a different FortiGate problem, such as when an organization applies an application-control profile but traffic follows an earlier broad allow rule without it. The current case requires create a narrowly scoped approved local URL or rating override for that site for its particular control path.