A scheduled test succeeds only during the authorized period and fails outside it could show improvement in a separate Fortinet case, for instance when a weekend maintenance exception must expire when business traffic resumes on Monday. The actual verification here is that each tenant matches its own policy ID and denied cross-tenant services remain blocked.

The corporate source matches the desired rule and a guest subnet with similar identity data is denied could show improvement in a separate Fortinet case, for instance when FortiGate shows FSSO identity for a workstation but a separate guest subnet should never inherit that access. The actual verification here is that each tenant matches its own policy ID and denied cross-tenant services remain blocked.

An external HTTPS request reaches the intended private server through the configured VIP could show improvement in a separate Fortinet case, for instance when a public-facing server behind FortiGate must accept HTTPS on a fixed external address. The actual verification here is that each tenant matches its own policy ID and denied cross-tenant services remain blocked.

FortiGate security profiles operate on traffic selected by the relevant enabled firewall policy describes a distinct situation, for example when a security profile was attached to a policy but does not inspect a flow that hits another earlier allow policy. Here the relevant FortiOS behavior is that identity-aware policies can distinguish authenticated groups beyond network source-address criteria.

Secure directory authentication protects credential transmission and server authenticity describes a distinct situation, for example when a business wants external identity verification but does not want plaintext directory passwords sent across the WAN. Here the relevant FortiOS behavior is that identity-aware policies can distinguish authenticated groups beyond network source-address criteria.

Stateful DNAT depends on response packets returning through the translation session path describes a distinct situation, for example when an application expects symmetric return sessions after publishing a private web server via DNAT. Here the relevant FortiOS behavior is that identity-aware policies can distinguish authenticated groups beyond network source-address criteria.

FortiOS web filtering is applied by the security profile on the actual matched firewall policy describes a distinct situation, for example when a web-filter policy is attached to the wrong firewall rule and blocked sites remain reachable. Here the relevant FortiOS behavior is that antivirus event generation depends on inspection path profile selection and log delivery configuration.

Category lookup depends on valid FortiGuard subscription status and reachable rating resources describes a distinct situation, for example when a firewall can access the internet but web category queries return unrated responses after license expiration. Here the relevant FortiOS behavior is that antivirus event generation depends on inspection path profile selection and log delivery configuration.

Antivirus efficacy depends in part on signatures and engines that are maintained through update services describes a distinct situation, for example when a FortiGate antivirus signature database has not been updated after the WAN was disconnected for weeks. Here the relevant FortiOS behavior is that antivirus event generation depends on inspection path profile selection and log delivery configuration.

Adding a broad allow-all policy cannot eliminate CRC errors on a damaged physical interface can be a real concern elsewhere, such as when an engineer sees retransmissions on one WAN circuit after a replacement SFP optic was installed. In the present scenario the key failure is that pointing to a collector address alone does not guarantee log acceptance and retention.

Jumping arbitrarily between major builds can lose configuration compatibility or leave features unavailable can be a real concern elsewhere, such as when a firmware rollout has multiple supported intermediate upgrade steps that operations intends to skip. In the present scenario the key failure is that pointing to a collector address alone does not guarantee log acceptance and retention.

Successful installation of an endpoint agent does not automatically authorize every private application can be a real concern elsewhere, such as when a remote laptop is registered in FortiSASE but is not assigned the correct user access entitlement. In the present scenario the key failure is that pointing to a collector address alone does not guarantee log acceptance and retention.

Blocking all traffic to one entire application port would exceed the stated exploit-specific goal can be a real concern elsewhere, such as when an enterprise wants to block only verified high-severity exploit signatures rather than all unknown web requests. In the present scenario the key failure is that assuming all HTTPS requests use TCP port 443 can leave alternative encrypted transports uninspected.

A standalone IPS sensor object without an active policy reference does not protect packet flows can be a real concern elsewhere, such as when an IPS sensor is configured globally but no firewall rule references it for a protected subnet. In the present scenario the key failure is that assuming all HTTPS requests use TCP port 443 can leave alternative encrypted transports uninspected.

Labeling all unknown sessions malicious without checking classification evidence can create false positives can be a real concern elsewhere, such as when a security operations dashboard shows generic unknown applications and little useful detail for a new workload. In the present scenario the key failure is that assuming all HTTPS requests use TCP port 443 can leave alternative encrypted transports uninspected.

Filter forward-traffic logs by source destination service and policy identifier could correct a different FortiGate problem, such as when an administrator sees a deny event but cannot determine which firewall policy matched the connection. The current case requires design FortiSASE user onboarding and secure access policies for supported endpoint connectivity for its particular control path.

Review HA priority override and monitored-interface selection using the documented election model could correct a different FortiGate problem, such as when a FortiGate cluster elects the wrong preferred primary after a power recovery. The current case requires design FortiSASE user onboarding and secure access policies for supported endpoint connectivity for its particular control path.

Add a valid default route toward the upstream gateway and verify interface addressing could correct a different FortiGate problem, such as when a branch FortiGate has no configured default route after its WAN address is assigned. The current case requires design FortiSASE user onboarding and secure access policies for supported endpoint connectivity for its particular control path.

The IKE authentication succeeds with the verified expected peer identity and shared secret or certificate could show improvement in a separate Fortinet case, for instance when an IKEv2 tunnel to a partner fails authentication despite both sides agreeing on encryption suites. The actual verification here is that negotiated selectors and encrypted ingress egress counters increase during the test flow.

Every approved branch reaches central services and direct branch bypass is restricted as required could show improvement in a separate Fortinet case, for instance when a business must connect three branches to headquarters while limiting unnecessary branch-to-branch connections. The actual verification here is that negotiated selectors and encrypted ingress egress counters increase during the test flow.

The routing table learns the approved remote CIDRs and permitted protected traffic succeeds could show improvement in a separate Fortinet case, for instance when a customer switches from static VPN routes to BGP and assumes the IPsec tunnel automatically starts advertising every prefix. The actual verification here is that negotiated selectors and encrypted ingress egress counters increase during the test flow.

SD-WAN service evaluation combines rule matches with current eligible link and route state describes a distinct situation, for example when a firewall routes to an SD-WAN zone but a new service rule never selects the preferred member. Here the relevant FortiOS behavior is that SD-WAN link selection operates over configured members and their health or service rules.

SD-WAN service rules select eligible links for traffic classes independently of simple interface naming describes a distinct situation, for example when a branch wants to use cheap broadband for routine web browsing and reserve its private circuit for finance apps. Here the relevant FortiOS behavior is that SD-WAN link selection operates over configured members and their health or service rules.

Stateful policy enforcement needs a consistent forward and return packet route for established sessions describes a distinct situation, for example when a FortiGate routes inbound traffic to a server but the server returns replies through a different upstream router. Here the relevant FortiOS behavior is that SD-WAN link selection operates over configured members and their health or service rules.

An interface IP address does not itself supply a next hop for destinations outside connected subnets describes a distinct situation, for example when a branch FortiGate has no configured default route after its WAN address is assigned. Here the relevant FortiOS behavior is that user authorization and endpoint enrollment are separate decisions in cloud access service policies.

FGCP membership requires compatible members and shared HA configuration for election and synchronization describes a distinct situation, for example when two FortiGates refuse to join the same FGCP high-availability cluster after installation. Here the relevant FortiOS behavior is that user authorization and endpoint enrollment are separate decisions in cloud access service policies.

FortiGuard signatures and category queries depend on valid service entitlements and update connectivity describes a distinct situation, for example when a FortiGate reports FortiGuard rating errors although the firewall appliance is registered. Here the relevant FortiOS behavior is that user authorization and endpoint enrollment are separate decisions in cloud access service policies.

SD-WAN policies can choose routes based on measured latency jitter and packet loss describes a distinct situation, for example when a voice application suffers jitter when FortiGate distributes sessions between a low-latency and overloaded WAN link. Here the relevant FortiOS behavior is that backup path selection needs a health condition or withdrawn preferred route in addition to a route entry.

A usable static route needs a reachable next hop through the appropriate outgoing interface describes a distinct situation, for example when an office network cannot leave through a new internet circuit because its static default route references an unreachable gateway. Here the relevant FortiOS behavior is that backup path selection needs a health condition or withdrawn preferred route in addition to a route entry.

Longest-prefix route matching selects a specific destination route over a less-specific default route describes a distinct situation, for example when a FortiGate has a default route to WAN but a specific branch network should use a site-to-site tunnel. Here the relevant FortiOS behavior is that backup path selection needs a health condition or withdrawn preferred route in addition to a route entry.

Disabling deep inspection for every destination to solve one pinned client greatly reduces coverage can be a real concern elsewhere, such as when managed endpoints trust FortiGate deep inspection but certificate pinning breaks one critical finance application. In the present scenario the key failure is that blocking all traffic to one entire application port would exceed the stated exploit-specific goal.

Relying only on forward traffic acceptance can hide a blocked URL within the permitted connection can be a real concern elsewhere, such as when web-filter logs list only accepted network connections but the security administrator needs blocked category evidence. In the present scenario the key failure is that blocking all traffic to one entire application port would exceed the stated exploit-specific goal.

A global no-inspection policy would disable intended TLS content controls for unrelated sites can be a real concern elsewhere, such as when a FortiGate is configured for deep inspection but legal policy forbids decryption of selected medical services. In the present scenario the key failure is that blocking all traffic to one entire application port would exceed the stated exploit-specific goal.