Inspect traffic session policy IDs and rule hit counters before removing redundant policies could correct a different FortiGate problem, such as when an administrator clones a broad outbound policy and later cannot identify which of the two is in use. The current case requires inspect actual session policy IDs central NAT rules and source IP pool selection for its particular control path.

Verify the VIP external mapping and matching firewall policy destination interface and service could correct a different FortiGate problem, such as when an inbound HTTPS VIP is configured but the public client receives a TCP timeout. The current case requires inspect actual session policy IDs central NAT rules and source IP pool selection for its particular control path.

Choose the supported flow-based inspection policy and compatible security profiles could correct a different FortiGate problem, such as when a firewall deployment must inspect traffic without sending the full HTTP request through proxy-based processing. The current case requires inspect actual session policy IDs central NAT rules and source IP pool selection for its particular control path.

Treating logged monitor matches as dropped sessions can leave a prohibited application available can be a real concern elsewhere, such as when a new application-control policy is in monitor mode and administrators mistake its detection logs for blocking. In the present scenario the key failure is that a payload that remains encrypted cannot be reliably scanned as ordinary plaintext by the antivirus engine.

Blocking all traffic to one entire application port would exceed the stated exploit-specific goal can be a real concern elsewhere, such as when an enterprise wants to block only verified high-severity exploit signatures rather than all unknown web requests. In the present scenario the key failure is that a payload that remains encrypted cannot be reliably scanned as ordinary plaintext by the antivirus engine.

Assuming every deeply nested encrypted archive is fully unpacked may overstate inspection coverage can be a real concern elsewhere, such as when an administrator needs to confirm whether nested archive files are scanned by a FortiGate antivirus profile. In the present scenario the key failure is that a payload that remains encrypted cannot be reliably scanned as ordinary plaintext by the antivirus engine.

Both peers report matching child SAs and permitted private traffic is encrypted could show improvement in a separate Fortinet case, for instance when two IPsec peers show Phase 1 established but FortiGate cannot create a usable Phase 2 child security association. The actual verification here is that the route lookup resolves to the tunnel and a permitted remote host responds.

Each branch successfully negotiates the approved new proposal and weak ones are rejected could show improvement in a separate Fortinet case, for instance when a security group wants to deprecate weak IKE proposals without disconnecting all branch tunnels at once. The actual verification here is that the route lookup resolves to the tunnel and a permitted remote host responds.

Large packet and application tests complete below the verified effective tunnel MTU could show improvement in a separate Fortinet case, for instance when a datacenter tunnel carries pings but large application transfers repeatedly stall after enabling an overlay. The actual verification here is that the route lookup resolves to the tunnel and a permitted remote host responds.

Selecting antivirus alone cannot inspect application payloads that remain opaque inside TLS can be a real concern elsewhere, such as when an administrator enables deep SSL inspection but HTTPS downloads pass through antivirus without file scans. In the present scenario the key failure is that a web filter configured but never referenced by active traffic does not enforce the category policy.

Assuming every deeply nested encrypted archive is fully unpacked may overstate inspection coverage can be a real concern elsewhere, such as when an administrator needs to confirm whether nested archive files are scanned by a FortiGate antivirus profile. In the present scenario the key failure is that a web filter configured but never referenced by active traffic does not enforce the category policy.

A global no-inspection policy would disable intended TLS content controls for unrelated sites can be a real concern elsewhere, such as when a FortiGate is configured for deep inspection but legal policy forbids decryption of selected medical services. In the present scenario the key failure is that a web filter configured but never referenced by active traffic does not enforce the category policy.

The controlled destination cannot be opened after the block action and the log records denial could show improvement in a separate Fortinet case, for instance when a web-filter policy is set to warn for a sensitive category but management requires outright denial. The actual verification here is that the chosen known-exploit test is denied while normal permitted requests continue.

The FortiGuard status is active and a rated test URL receives the intended classification could show improvement in a separate Fortinet case, for instance when a firewall can access the internet but web category queries return unrated responses after license expiration. The actual verification here is that the chosen known-exploit test is denied while normal permitted requests continue.

The harmless detection test logs the expected signature action source and matched firewall rule could show improvement in a separate Fortinet case, for instance when a scheduled threat exercise produces no antivirus event although the file has a supported signature. The actual verification here is that the chosen known-exploit test is denied while normal permitted requests continue.

Bidirectional capture shows requests and responses flowing through the expected security gateway could show improvement in a separate Fortinet case, for instance when a FortiGate routes inbound traffic to a server but the server returns replies through a different upstream router. The actual verification here is that a staged member removal leaves only valid active routes and permitted flows still work.

The desired route appears active with its expected interface and permitted branch traffic succeeds could show improvement in a separate Fortinet case, for instance when an administrator created a static route for a cloud subnet but the route remains inactive in the routing monitor. The actual verification here is that a staged member removal leaves only valid active routes and permitted flows still work.

The routing table selects the VPN interface for the branch prefix and the test application works could show improvement in a separate Fortinet case, for instance when a FortiGate has a default route to WAN but a specific branch network should use a site-to-site tunnel. The actual verification here is that a staged member removal leaves only valid active routes and permitted flows still work.

FGCP membership requires compatible members and shared HA configuration for election and synchronization describes a distinct situation, for example when two FortiGates refuse to join the same FGCP high-availability cluster after installation. Here the relevant FortiOS behavior is that central log collection requires a reachable supported collector and an approved device relationship.

FortiGate logging records matching context that can distinguish the policy responsible for a session describes a distinct situation, for example when an administrator sees a deny event but cannot determine which firewall policy matched the connection. Here the relevant FortiOS behavior is that central log collection requires a reachable supported collector and an approved device relationship.

Coordinated cluster firmware upgrades minimize inconsistent member versions and configuration drift describes a distinct situation, for example when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. Here the relevant FortiOS behavior is that central log collection requires a reachable supported collector and an approved device relationship.

A second tunnel on the same failing underlay cannot guarantee independent disaster recovery can be a real concern elsewhere, such as when a partially redundant VPN deployment sends some applications through a single shared head-office tunnel despite another path being available. In the present scenario the key failure is that expecting unmodified ESP forwarding through an arbitrary NAT device can prevent tunnel establishment.

A static route cannot refresh an expired upstream translation mapping by itself can be a real concern elsewhere, such as when an IPsec tunnel drops after an idle period because an upstream NAT device expires its UDP mapping. In the present scenario the key failure is that expecting unmodified ESP forwarding through an arbitrary NAT device can prevent tunnel establishment.

Creating a second tunnel without route selection can leave the standby unused during outages can be a real concern elsewhere, such as when a secondary IPsec tunnel never carries traffic when a branch's primary internet link fails. In the present scenario the key failure is that expecting unmodified ESP forwarding through an arbitrary NAT device can prevent tunnel establishment.

Review central NAT mode and modify the appropriate central SNAT map entries could correct a different FortiGate problem, such as when a service uses central SNAT controls but an administrator edits policy NAT and sees no expected change. The current case requires create user-aware firewall policy matches using validated authentication groups for its particular control path.

Configure a permitted source NAT IP pool for the matching outbound policy could correct a different FortiGate problem, such as when a partner requires the organization to use one known public IP that differs from the FortiGate WAN address. The current case requires create user-aware firewall policy matches using validated authentication groups for its particular control path.

Integrate a supported FSSO collector with directory logon events and identity-based firewall rules could correct a different FortiGate problem, such as when domain users should receive department internet access without entering another captive portal password. The current case requires create user-aware firewall policy matches using validated authentication groups for its particular control path.

Identity group information complements rather than replaces network segmentation and source restrictions describes a distinct situation, for example when FortiGate shows FSSO identity for a workstation but a separate guest subnet should never inherit that access. Here the relevant FortiOS behavior is that FortiOS central SNAT uses a separate mapping table when the central NAT feature is enabled.

Internal-to-internal traffic still requires a matching FortiGate policy when it traverses the firewall describes a distinct situation, for example when a new east-west segmentation policy needs internal traffic logged without exposing every application port. Here the relevant FortiOS behavior is that FortiOS central SNAT uses a separate mapping table when the central NAT feature is enabled.

Stateful DNAT depends on response packets returning through the translation session path describes a distinct situation, for example when an application expects symmetric return sessions after publishing a private web server via DNAT. Here the relevant FortiOS behavior is that FortiOS central SNAT uses a separate mapping table when the central NAT feature is enabled.

IPsec NAT traversal encapsulates ESP in UDP where intermediate address translation requires it describes a distinct situation, for example when a remote office behind an ISP NAT device cannot establish an IPsec connection to the headquarters FortiGate. Here the relevant FortiOS behavior is that periodic NAT-T keepalives and peer detection maintain or reestablish idle tunnel reachability.

Logical interface state and negotiated IPsec security association state are different operational signals describes a distinct situation, for example when an operator mistakes the route-based tunnel interface being enabled for proof that its child SA is active. Here the relevant FortiOS behavior is that periodic NAT-T keepalives and peer detection maintain or reestablish idle tunnel reachability.

IKE diagnostics distinguish initial connectivity authentication and Phase 2 proposal failures describes a distinct situation, for example when a FortiGate reports repeated IKE negotiation errors but the network operations team lacks diagnostic evidence. Here the relevant FortiOS behavior is that periodic NAT-T keepalives and peer detection maintain or reestablish idle tunnel reachability.