Use narrowly justified antivirus exceptions with an explicit risk and expiration review could correct a different FortiGate problem, such as when a trusted software vendor distributes digitally signed executables and analysts want to bypass all antivirus scans for that domain. The current case requires create a narrowly scoped approved local URL or rating override for that site for its particular control path.

Apply a FortiGuard web-filter profile with appropriate category blocking on the matching policy could correct a different FortiGate problem, such as when a school wants to prevent students from visiting known malicious website categories on permitted web traffic. The current case requires create a narrowly scoped approved local URL or rating override for that site for its particular control path.

Move or refine the intended rule so inspected traffic matches the policy with the correct profile could correct a different FortiGate problem, such as when an organization applies an application-control profile but traffic follows an earlier broad allow rule without it. The current case requires create a narrowly scoped approved local URL or rating override for that site for its particular control path.

The routing table learns the approved remote CIDRs and permitted protected traffic succeeds could show improvement in a separate Fortinet case, for instance when a customer switches from static VPN routes to BGP and assumes the IPsec tunnel automatically starts advertising every prefix. The actual verification here is that each approved site pair exchanges traffic across its configured direct tunnel without central hairpinning.

Negotiated selectors and encrypted ingress egress counters increase during the test flow could show improvement in a separate Fortinet case, for instance when an operator mistakes the route-based tunnel interface being enabled for proof that its child SA is active. The actual verification here is that each approved site pair exchanges traffic across its configured direct tunnel without central hairpinning.

Large packet and application tests complete below the verified effective tunnel MTU could show improvement in a separate Fortinet case, for instance when a datacenter tunnel carries pings but large application transfers repeatedly stall after enabling an overlay. The actual verification here is that each approved site pair exchanges traffic across its configured direct tunnel without central hairpinning.

Flow and proxy inspection modes differ in traffic processing and available feature behavior describes a distinct situation, for example when a firewall deployment must inspect traffic without sending the full HTTP request through proxy-based processing. Here the relevant FortiOS behavior is that FSSO identity lookup depends on timely authenticated-user events and accurate IP mappings.

FortiGate evaluates matching firewall policies in configured sequence and uses the selected policy action describes a distinct situation, for example when a new firewall rule permits an accounting subnet but earlier broad deny policy blocks the same destination. Here the relevant FortiOS behavior is that FSSO identity lookup depends on timely authenticated-user events and accurate IP mappings.

Identity-aware policies can distinguish authenticated groups beyond network source-address criteria describes a distinct situation, for example when two user groups share a subnet but must receive different access privileges to an internal tool. Here the relevant FortiOS behavior is that FSSO identity lookup depends on timely authenticated-user events and accurate IP mappings.

A controlled individual heartbeat-path outage leaves the cluster stable and reports the expected state could show improvement in a separate Fortinet case, for instance when a FortiGate cluster uses two heartbeat cables but both share an unreliable aggregation switch. The actual verification here is that the chosen supported instance passes a representative traffic and security-profile workload test.

A test FortiGate event is received under the registered device and searchable in FortiAnalyzer could show improvement in a separate Fortinet case, for instance when a FortiGate forwards logs to FortiAnalyzer but the analytics appliance shows the device as unauthorized. The actual verification here is that the chosen supported instance passes a representative traffic and security-profile workload test.

Disconnecting the monitored WAN interface causes the expected peer selection and restored traffic could show improvement in a separate Fortinet case, for instance when a cluster fails to trigger high availability when its primary WAN physical interface loses carrier. The actual verification here is that the chosen supported instance passes a representative traffic and security-profile workload test.

The routing table selects the VPN interface for the branch prefix and the test application works could show improvement in a separate Fortinet case, for instance when a FortiGate has a default route to WAN but a specific branch network should use a site-to-site tunnel. The actual verification here is that a controlled set of new sessions uses eligible links under the intended routing behavior.

The desired route appears active with its expected interface and permitted branch traffic succeeds could show improvement in a separate Fortinet case, for instance when an administrator created a static route for a cloud subnet but the route remains inactive in the routing monitor. The actual verification here is that a controlled set of new sessions uses eligible links under the intended routing behavior.

A controlled upstream fault marks the link out of SLA and moves eligible sessions to a healthy path could show improvement in a separate Fortinet case, for instance when a health check marks an ISP usable because its gateway replies but a critical SaaS service is unreachable beyond it. The actual verification here is that a controlled set of new sessions uses eligible links under the intended routing behavior.

TLS interception may validate the destination's certificate separately from the inspection certificate presented to clients describes a distinct situation, for example when an external server shows certificate chain errors only when TLS traffic traverses a newly enabled FortiGate profile. Here the relevant FortiOS behavior is that HTTP over QUIC follows a different transport negotiation path from ordinary TLS over TCP.

Logging malware identification and preventing content delivery are distinct antivirus outcomes describes a distinct situation, for example when an antivirus alert is shown in monitor mode but the malware test file still reaches the endpoint. Here the relevant FortiOS behavior is that HTTP over QUIC follows a different transport negotiation path from ordinary TLS over TCP.

Selective IPS exclusions can address verified false positives without disabling the entire prevention service describes a distinct situation, for example when an IPS signature causes disruption of a legitimate custom application during a production deployment. Here the relevant FortiOS behavior is that HTTP over QUIC follows a different transport negotiation path from ordinary TLS over TCP.

Enable appropriate application-control event monitoring and inspect session protocol characteristics could correct a different FortiGate problem, such as when a security operations dashboard shows generic unknown applications and little useful detail for a new workload. The current case requires test a new session and verify the active application-control policy and recognition events for its particular control path.

Use per-process diagnostics and IPS sensor tuning to narrow required signatures and traffic scope could correct a different FortiGate problem, such as when a FortiGate shows unusually high CPU utilization following activation of broad IPS scanning. The current case requires test a new session and verify the active application-control policy and recognition events for its particular control path.

Verify antivirus and deep SSL inspection profiles are both effective on the matching rule could correct a different FortiGate problem, such as when an outbound policy has antivirus enabled but a harmless EICAR test downloaded over HTTPS is not detected. The current case requires test a new session and verify the active application-control policy and recognition events for its particular control path.

The new flow allocation favors broadband and metered-link usage remains within the approved budget could show improvement in a separate Fortinet case, for instance when a managed branch sees more traffic on a costly metered link despite sufficient primary broadband capacity. The actual verification here is that the measured flow distribution and utilization track the documented WAN bandwidth strategy.

The desired route appears active with its expected interface and permitted branch traffic succeeds could show improvement in a separate Fortinet case, for instance when an administrator created a static route for a cloud subnet but the route remains inactive in the routing monitor. The actual verification here is that the measured flow distribution and utilization track the documented WAN bandwidth strategy.

A tested failover documents which flows reconnect and which supported sessions remain stable could show improvement in a separate Fortinet case, for instance when an application requires session persistence but users are disconnected when a monitored SD-WAN link changes state. The actual verification here is that the measured flow distribution and utilization track the documented WAN bandwidth strategy.

Restore the required FortiGuard web-filter entitlement and update access to rating services could correct a different FortiGate problem, such as when a firewall can access the internet but web category queries return unrated responses after license expiration. The current case requires add a narrowly justified SSL inspection exemption for the pinned application and assess residual risk for its particular control path.

Review supported QUIC handling and required SSL inspection strategy for that traffic type could correct a different FortiGate problem, such as when a policy claims to decrypt HTTPS traffic but QUIC over UDP is traversing the path unexpectedly. The current case requires add a narrowly justified SSL inspection exemption for the pinned application and assess residual risk for its particular control path.

Review configured file size and oversize-file handling for the applicable antivirus inspection mode could correct a different FortiGate problem, such as when a large file transfer bypasses antivirus checks because the configured inspection limits are exceeded. The current case requires add a narrowly justified SSL inspection exemption for the pinned application and assess residual risk for its particular control path.

The installed forwarding entry matches the documented preference and a route lookup confirms it could show improvement in a separate Fortinet case, for instance when an administrator assumes routing favors a manually added static prefix over a connected prefix of equal specificity. The actual verification here is that a simulated upstream outage removes the failed preferred path and traffic takes the approved backup.

A tested failover documents which flows reconnect and which supported sessions remain stable could show improvement in a separate Fortinet case, for instance when an application requires session persistence but users are disconnected when a monitored SD-WAN link changes state. The actual verification here is that a simulated upstream outage removes the failed preferred path and traffic takes the approved backup.

New controlled traffic matches the desired service rule and the selected member is recorded could show improvement in a separate Fortinet case, for instance when a firewall routes to an SD-WAN zone but a new service rule never selects the preferred member. The actual verification here is that a simulated upstream outage removes the failed preferred path and traffic takes the approved backup.

Create the narrow outbound and return firewall policies allowing traffic between relevant zones and tunnel interfaces could correct a different FortiGate problem, such as when a FortiGate IPsec interface has an active route but private traffic is denied when it enters the VPN. The current case requires add the required static or dynamic route to the route-based IPsec tunnel interface for its particular control path.

Measure effective path MTU and adjust supported TCP MSS or encapsulation settings could correct a different FortiGate problem, such as when a datacenter tunnel carries pings but large application transfers repeatedly stall after enabling an overlay. The current case requires add the required static or dynamic route to the route-based IPsec tunnel interface for its particular control path.

Configure explicit route preference and validated independent IPsec paths for critical services could correct a different FortiGate problem, such as when a partially redundant VPN deployment sends some applications through a single shared head-office tunnel despite another path being available. The current case requires add the required static or dynamic route to the route-based IPsec tunnel interface for its particular control path.