Application control identifies supported application behavior beyond the transport port used by a session describes a distinct situation, for example when a company wants to prevent peer-to-peer file sharing without blocking all outbound TCP 443 traffic. Here the relevant FortiOS behavior is that TLS interception may validate the destination's certificate separately from the inspection certificate presented to clients.

Certificate-only TLS inspection exposes some certificate and handshake metadata without decrypting full content describes a distinct situation, for example when a firewall team wants URL-domain filtering of encrypted web sessions without inspecting application payloads. Here the relevant FortiOS behavior is that TLS interception may validate the destination's certificate separately from the inspection certificate presented to clients.

Application overrides allow narrow exceptions while retaining broader category-based control describes a distinct situation, for example when an application signature detects a business-approved conferencing tool as high risk and blocks important calls. Here the relevant FortiOS behavior is that TLS interception may validate the destination's certificate separately from the inspection certificate presented to clients.

The remote private server observes the approved original subnet source and replies successfully could show improvement in a separate Fortinet case, for instance when an internal application connecting to a partner VPN must preserve its original private source address. The actual verification here is that a permitted test authentication returns a timely accept response associated with the right group.

External test traffic shows the approved translated source and response packets reach the right client could show improvement in a separate Fortinet case, for instance when multiple private office clients need internet access through a single FortiGate public WAN interface. The actual verification here is that a permitted test authentication returns a timely accept response associated with the right group.

The trusted management workstation reaches the GUI and an unauthorized source remains blocked could show improvement in a separate Fortinet case, for instance when an admin cannot connect to the FortiGate GUI even though a transit firewall policy permits HTTPS packets. The actual verification here is that a permitted test authentication returns a timely accept response associated with the right group.

A second tunnel on the same failing underlay cannot guarantee independent disaster recovery can be a real concern elsewhere, such as when a partially redundant VPN deployment sends some applications through a single shared head-office tunnel despite another path being available. In the present scenario the key failure is that encrypted transport being available does not imply every subnet is authorized to use the VPN.

Expecting unmodified ESP forwarding through an arbitrary NAT device can prevent tunnel establishment can be a real concern elsewhere, such as when a remote office behind an ISP NAT device cannot establish an IPsec connection to the headquarters FortiGate. In the present scenario the key failure is that encrypted transport being available does not imply every subnet is authorized to use the VPN.

A static route cannot refresh an expired upstream translation mapping by itself can be a real concern elsewhere, such as when an IPsec tunnel drops after an idle period because an upstream NAT device expires its UDP mapping. In the present scenario the key failure is that encrypted transport being available does not imply every subnet is authorized to use the VPN.

Memory metrics return below the relevant threshold and new permitted sessions establish normally could show improvement in a separate Fortinet case, for instance when users report intermittent internet outage while the FortiGate memory is near conserve-mode thresholds. The actual verification here is that a controlled authorized user session reaches the private app and the associated security logs appear.

Both units report the intended build and synchronized healthy status after the documented upgrade could show improvement in a separate Fortinet case, for instance when a firmware patch must be applied to an active-passive FortiGate pair with minimal outage. The actual verification here is that a controlled authorized user session reaches the private app and the associated security logs appear.

A scoped traffic probe traverses the CNF policy path and appears in the expected service log could show improvement in a separate Fortinet case, for instance when a cloud team plans to use a FortiGate CNF deployment but omits workload association and route checks. The actual verification here is that a controlled authorized user session reaches the private app and the associated security logs appear.

Jumping arbitrarily between major builds can lose configuration compatibility or leave features unavailable can be a real concern elsewhere, such as when a firmware rollout has multiple supported intermediate upgrade steps that operations intends to skip. In the present scenario the key failure is that a working heartbeat alone does not mean upstream interface failures are covered by failover logic.

Guessing firmware version from a device hostname may lead to unsuitable remediation instructions can be a real concern elsewhere, such as when a FortiGate administrator needs the interface status and build version before opening a troubleshooting case. In the present scenario the key failure is that a working heartbeat alone does not mean upstream interface failures are covered by failover logic.

Assuming every existing connection is immediately reevaluated as a new session can mislead troubleshooting can be a real concern elsewhere, such as when a FortiGate still matches an established session after an administrator edits the relevant firewall rule. In the present scenario the key failure is that a working heartbeat alone does not mean upstream interface failures are covered by failover logic.

CPU returns to the agreed baseline while required intrusion signatures remain enforced could show improvement in a separate Fortinet case, for instance when a FortiGate shows unusually high CPU utilization following activation of broad IPS scanning. The actual verification here is that protected medical sessions remain exempt while unrelated malicious test traffic is still inspected.

A test confirms hostname-level decisions work while full URL path content remains unavailable could show improvement in a separate Fortinet case, for instance when a firewall team wants URL-domain filtering of encrypted web sessions without inspecting application payloads. The actual verification here is that protected medical sessions remain exempt while unrelated malicious test traffic is still inspected.

The FortiGuard status is active and a rated test URL receives the intended classification could show improvement in a separate Fortinet case, for instance when a firewall can access the internet but web category queries return unrated responses after license expiration. The actual verification here is that protected medical sessions remain exempt while unrelated malicious test traffic is still inspected.

A known blocked category returns the expected denial page and a permitted category loads normally could show improvement in a separate Fortinet case, for instance when a school wants to prevent students from visiting known malicious website categories on permitted web traffic. The actual verification here is that the approved training URL works and other sites in the blocked category still fail.

Fresh sessions show the expected inspection certificate and new security-profile decisions could show improvement in a separate Fortinet case, for instance when an administrator changes inspection profiles while old HTTPS sessions continue using previous trust behavior. The actual verification here is that the approved training URL works and other sites in the blocked category still fail.

The FortiGuard status is active and a rated test URL receives the intended classification could show improvement in a separate Fortinet case, for instance when a firewall can access the internet but web category queries return unrated responses after license expiration. The actual verification here is that the approved training URL works and other sites in the blocked category still fail.

Check backend gateway and FortiGate session return path for the VIP translation could correct a different FortiGate problem, such as when an application expects symmetric return sessions after publishing a private web server via DNAT. The current case requires review central NAT mode and modify the appropriate central SNAT map entries for its particular control path.

Use the SD-WAN zone as the relevant policy egress interface with the approved source and services could correct a different FortiGate problem, such as when a branch uses an SD-WAN zone with two WAN members but its firewall policy names only a member interface. The current case requires review central NAT mode and modify the appropriate central SNAT map entries for its particular control path.

Integrate a supported FSSO collector with directory logon events and identity-based firewall rules could correct a different FortiGate problem, such as when domain users should receive department internet access without entering another captive portal password. The current case requires review central NAT mode and modify the appropriate central SNAT map entries for its particular control path.

An authorized workstation reaches the management login while an untrusted test host is denied could show improvement in a separate Fortinet case, for instance when a freshly installed FortiGate allows administrative HTTPS from an untrusted transit network. The actual verification here is that memory metrics return below the relevant threshold and new permitted sessions establish normally.

The management station connects to the specified unit while normal cluster traffic remains stable could show improvement in a separate Fortinet case, for instance when an administrator cannot reach the secondary FortiGate independently to diagnose its failed hardware sensor. The actual verification here is that memory metrics return below the relevant threshold and new permitted sessions establish normally.

A long-lived eligible application connection survives a tested primary failover as configured could show improvement in a separate Fortinet case, for instance when an active-passive FortiGate pair drops established sessions when a primary unit fails unexpectedly. The actual verification here is that memory metrics return below the relevant threshold and new permitted sessions establish normally.

Per-member policy references are not a substitute for the appropriate zone-level policy can be a real concern elsewhere, such as when an SD-WAN zone contains two links but a forward firewall policy references the physical port instead of the zone. In the present scenario the key failure is that an unconditional top rule can capture all sessions before the finance-specific rule is evaluated.

A deny policy alone does not explain every forwarding decision if untrusted alternate paths exist can be a real concern elsewhere, such as when an isolated guest subnet must not use a broad route to reach a prohibited private destination. In the present scenario the key failure is that an unconditional top rule can capture all sessions before the finance-specific rule is evaluated.

A correct rule displayed in GUI may not be used if earlier matches or health exclusions apply can be a real concern elsewhere, such as when a firewall routes to an SD-WAN zone but a new service rule never selects the preferred member. In the present scenario the key failure is that an unconditional top rule can capture all sessions before the finance-specific rule is evaluated.

The approved subnet exchanges data and denied subnets fail under the selected policy could show improvement in a separate Fortinet case, for instance when a FortiGate IPsec interface has an active route but private traffic is denied when it enters the VPN. The actual verification here is that every approved branch reaches central services and direct branch bypass is restricted as required.

The route lookup resolves to the tunnel and a permitted remote host responds could show improvement in a separate Fortinet case, for instance when a site-to-site tunnel remains listed as up but its local subnet has no route toward the remote protected prefix. The actual verification here is that every approved branch reaches central services and direct branch bypass is restricted as required.

A failure-injection drill preserves permitted critical flows through a separately monitored alternate path could show improvement in a separate Fortinet case, for instance when a partially redundant VPN deployment sends some applications through a single shared head-office tunnel despite another path being available. The actual verification here is that every approved branch reaches central services and direct branch bypass is restricted as required.