FCP cheat sheet

Security Fabric components: FortiGate (core), FortiAnalyzer (logging/analytics), FortiManager (central management), FortiAuthenticator (identity), FortiSandbox (detonation), FortiClient (endpoint), FortiSwitch/FortiAP (access), FortiWeb/FortiMail/FortiSandbox (application security).

Fabric topology roles: root FortiGate aggregates downstream FortiGates; upstream FortiGate connects to external network; standalone FortiGate not joined to fabric. Only root can enable Fabric Connectors for central management.

Fabric Connectors: Security Fabric > Fabric Connectors. Examples: FortiGuard, FortiSandbox, FortiAnalyzer, Syslog, LDAP, RADIUS, TACACS+, Certificate, Cloud (AWS/Azure/GCP), SDN (VMware NSX, Cisco ACI).

FortiGuard subscription services: IPS, AntiVirus, Web Filtering, Application Control, DNS Filter, IP Reputation, Antispam, FortiSandbox Cloud, Industrial Security. Each service has its own license and update schedule.

Security Fabric rating: Security Fabric > Fabric Rating. Score is based on enabled features (e.g., AV, IPS, web filter, app control, logging, HA, MFA). Rating is advisory, not enforcement.

FortiGate operation modes: NAT mode (routed, most common), Transparent mode (bridge, no IP on interfaces except management), and Virtual Wire Pair (transparent pair). HA works in NAT and transparent modes.

Interface types: physical, VLAN subinterface, aggregate (LACP), redundant (active-passive), loopback, IPsec tunnel, SSL VPN, virtual wire pair, software switch, zone. Zones group interfaces for policy and simplify rules.

Firewall session table: sessions are stateful; reply traffic is allowed if session exists. Session table shows source/dest NAT, policy ID, and timeout. Use 'diagnose sys session list' and 'diagnose sys session filter' to inspect.

FortiGate default administrative access: HTTPS on port 443, SSH on port 22, HTTP on 80 (disabled by default), Telnet disabled. Trusted hosts restrict admin source IPs; admin profiles define read/write scope.

Policy evaluation is top-down, first match wins. Implicit deny at the bottom drops all traffic not matched. Policy order matters; use 'move' to reorder. Policy ID is assigned automatically but can be changed.

Policy match criteria: incoming interface, outgoing interface, source address, destination address, schedule, service, user/group, and optionally application, URL category, or ISDB. NAT is configured per policy.

NAT: source NAT (SNAT) via 'set nat enable' on policy, using outgoing interface address or IP pool. Destination NAT (DNAT) via VIP (virtual IP) or IP pool with port forwarding. Central NAT uses a separate NAT table instead of per-policy NAT.

Traffic shaping: shared shaper (per-policy bandwidth limit), per-IP shaper (limit per source IP), application shaper (limit per application). Shapers applied in firewall policy or shaping policy. Guaranteed bandwidth and priority (high/medium/low) affect queuing.

Traffic shaping policy (shaping-policy) matches on application, URL category, user, or address and applies shaper; evaluated before firewall policy for shaping decisions. Can be used for application-based shaping without firewall policy.

Policy routes (policy-based routing) override routing table for matching traffic; can set gateway, interface, or priority. Evaluated before routing table lookup. Useful for SD-WAN or dual-WAN failover.

Security profiles on policy: AV, IPS, web filter, app control, DNS filter, SSL inspection, DLP, email filter, VoIP. Profiles are applied in the order of the policy; multiple profiles can be combined. 'set utm-status enable' required.

Policy schedule: one-time or recurring (e.g., work hours). Schedule is evaluated at session start; existing sessions are not terminated when schedule expires unless 'set schedule-timeout enable' is set.

Policy lookup tools: 'diagnose firewall iprope lookup' and 'diagnose firewall policy lookup' show which policy matches a given 5-tuple. Use 'show firewall policy' and 'show firewall policy ' to view configuration.

Authentication methods: local password, LDAP, RADIUS, TACACS+, SAML (FortiAuthenticator or third-party IdP), PKI certificate, FSSO (Fortinet Single Sign-On), and RADIUS SSO (RSSO). Multiple methods can be combined in a user group.

User groups: firewall, FSSO, RADIUS, LDAP, TACACS+, PKI, guest, and directory groups. Firewall policy matches user or group; authentication is triggered when traffic matches a policy with a user/group and no existing authenticated session.

FSSO: collects login events from domain controllers (DC agent, collector agent, or FortiGate agent). Users are identified by IP address. FSSO groups are used in policies. Requires Fortinet FSSO agent or FortiAuthenticator.

LDAP configuration: Security Fabric > Fabric Connectors > LDAP or User & Authentication > LDAP. Specify server IP, port (389/636), bind DN, bind password, base DN, and user/group filters. Test connectivity before use.

RADIUS configuration: specify server IP, secret, port (1812 auth, 1813 accounting). FortiGate can act as RADIUS client for admin and user auth. RADIUS accounting can be used for RSSO.

MFA: FortiToken (hardware or mobile), email, SMS, or TOTP. Configure under User & Authentication > FortiTokens and enable two-factor in user settings or policy. MFA can be required for admin login and SSL VPN.

Admin authentication: local admin, RADIUS, LDAP, TACACS+, or PKI. Admin profiles define permissions (e.g., super_admin, prof_admin). Trusted hosts restrict source IPs. 'accprofile' binds profile to admin.

Certificate authentication: import CA and local certificate, create PKI user, and use in policy or SSL VPN. Certificate must be valid and not revoked (CRL/OCSP). 'set auth-cert' on SSL VPN settings.

Guest users: created manually or via guest portal; time-limited accounts. Guest groups can be used in policies. Self-registration requires a guest portal policy and email/SMS sponsor approval.

SSL VPN modes: web mode (bookmarks, clientless) and tunnel mode (full network access via FortiClient or web portal). Tunnel mode requires an IP pool for client addresses and a firewall policy from SSL VPN interface to internal.

SSL VPN settings: VPN > SSL-VPN Settings. Configure listening interface, port (default 443), tunnel IP range, authentication (local, LDAP, RADIUS, SAML), and portal mappings. 'set servercert' selects the certificate presented to clients.

SSL VPN portals: web mode, tunnel mode, or both. Configure split tunneling (enabled/disabled), source IP pools, DNS, and routes. Split tunneling disabled forces all client traffic through the tunnel; enabled only sends specified subnets.

SSL VPN firewall policy: incoming interface is the SSL VPN tunnel interface (ssl.root or ssl.), outgoing is internal. User/group must match. NAT may be required depending on routing. Add policy for web mode if needed.

IPsec phase 1 (IKE): defines authentication (pre-shared key or certificate), remote gateway, local interface, IKE version (v1/v2), encryption/integrity proposals, DH group, and dead peer detection (DPD). Aggressive vs main mode (v1).

IPsec phase 2: defines ESP proposals (encryption, integrity, PFS), local/remote subnet, and optional autokey keepalive. Phase 2 must match on both peers. Multiple phase 2 definitions can share one phase 1.

IPsec route-based vs policy-based: route-based uses a tunnel interface (e.g., ipsec1) and static routes; policy-based uses firewall policies with IPsec phase 1 as incoming/outgoing interface. Route-based is preferred for SD-WAN and dynamic routing.

IPsec troubleshooting: 'diagnose vpn ike gateway list', 'diagnose vpn tunnel list', 'diagnose debug application ike -1' and 'diagnose debug enable'. Check phase 1/phase 2 proposals, PSK, and routing. DPD can bring down stale tunnels.

SSL VPN troubleshooting: 'diagnose vpn ssl statistics', 'diagnose vpn ssl list', 'diagnose debug application sslvpn -1'. Check certificate validity, portal mapping, firewall policy, and routing. FortiClient logs show connection errors.

Web filter profiles: Security Profiles > Web Filter. Categories are FortiGuard-defined; local categories can be created. Actions: allow, block, monitor, warning, authenticate. Overrides can be set per category or per URL.

FortiGuard web filter categories are updated dynamically. If FortiGuard is unreachable, the FortiGate can use a local cache or fail open/closed depending on 'set fallback' and 'set rating-error' settings.

URL filter: explicit allow/block list by URL or pattern. Evaluated before category lookup. Supports wildcards and regular expressions. Can be applied in web filter profile or globally.

Web filter profile options: safe search (enforce), YouTube education filter, block invalid SSL certificates, allow/block HTTP methods (POST, GET), and file type filtering (e.g., block .exe downloads).

Application control: identifies applications by signature, not just port. Categories include P2P, VoIP, social media, business, etc. Actions: allow, block, monitor, or apply traffic shaping. Application signatures are updated via FortiGuard.

Application control profile can be applied to firewall policy. Application override: create custom application signature for unknown apps. Application control requires 'set utm-status enable' on policy.

SSL inspection: needed to inspect HTTPS traffic for web filter and application control. Certificate inspection (no decryption) vs full SSL inspection (decrypt/re-encrypt). Full inspection requires importing CA certificate to clients to avoid errors.

Web filter and app control interaction: web filter evaluates URL category; app control evaluates application signature. Both can be applied in same policy; order of evaluation is web filter then app control (or as configured).

Quota and timeout: web filter can enforce time quotas per category (e.g., 30 min/day for social media). Quota resets daily. Authentication may be required to track per-user quotas.

IPS profiles: Security Profiles > Intrusion Prevention. Signatures are FortiGuard-updated. Actions: pass, block, reset, monitor. Severity levels (info, low, medium, high, critical) can be filtered. IPS can be applied to firewall policy.

IPS signature overrides: individual signatures can be set to block, monitor, or disable. Custom signatures can be created for proprietary protocols. Signature IDs are numeric and updated regularly.

AntiVirus profiles: scan protocols (HTTP, FTP, SMTP, POP3, IMAP, SMB, NNTP). Actions: block, monitor, quarantine. Use FortiSandbox for unknown files. AV databases updated via FortiGuard. Flow-based vs proxy-based inspection.

Flow-based vs proxy-based inspection: flow-based (default) inspects packets as they pass, lower latency; proxy-based buffers and reassembles, more thorough but higher latency. Some features (e.g., DLP, some AV) require proxy-based.

FortiSandbox integration: suspicious files are sent to FortiSandbox for detonation. Results can block future downloads. Configure under Security Fabric > Fabric Connectors > FortiSandbox. Requires FortiSandbox appliance or cloud.

Anti-malware techniques: signature-based, heuristic, emulation, and sandboxing. FortiGate AV uses signature and heuristic. File quarantine stores infected files locally for later analysis.

SSL inspection for AV/IPS: without SSL inspection, encrypted traffic is not inspected. Full SSL inspection decrypts traffic, allowing AV and IPS to scan. Certificate inspection only checks certificate validity.

IPS sensor vs profile: sensor is the container for signatures and filters; profile binds sensor to policy. 'set ips-sensor' in firewall policy. Multiple sensors can be created for different traffic types.

Logging and alerting: IPS and AV events are logged to FortiAnalyzer or syslog. Configure log settings in profile (enable logging). Use 'diagnose test application ipsmonitor' to check IPS engine status.

Static routes: destination network, gateway, interface, distance (admin distance), priority. Lower distance preferred. Policy routes override static routes for matching traffic. Default route 0.0.0.0/0.

Dynamic routing protocols: OSPF, BGP, RIP, IS-IS. OSPF areas, cost, hello/dead timers. BGP AS numbers, neighbors, network statements, and route maps. FortiGate can redistribute static/connected routes.

SD-WAN: aggregates multiple WAN links. Members are interfaces with gateway and cost. SD-WAN rules (service rules) select member based on source/dest, application, or performance SLA. Health checks monitor latency, jitter, packet loss.

SD-WAN zones: group interfaces for SD-WAN. Firewall policies reference SD-WAN zone. SD-WAN rules can specify priority, load balancing, or best quality. 'config system sdwan' and 'config system virtual-wan-link'.

Health check: config under system sdwan health-check. SLA targets (latency, jitter, packet loss) determine member status. Violations trigger rule re-evaluation and failover. Logs show health check results.

Policy routes: 'config router policy'. Match on source, destination, protocol, port. Action: forward to gateway/interface or stop. Can be used for SD-WAN-like failover without SD-WAN. Evaluated before routing table.

Routing troubleshooting: 'get router info routing-table all', 'diagnose ip route list', 'get router info ospf neighbor', 'get router info bgp summary'. Check ARP table with 'get system arp'.

Reverse path forwarding (RPF): 'set rpf-check enable' on interface. Drops packets if source route does not point back to incoming interface. Useful for anti-spoofing but can break asymmetric routing.

Equal-cost multi-path (ECMP): multiple routes with same distance and priority. FortiGate can load balance across up to 10 paths. Configure 'set ecmp-max-paths' in system settings.

Log types: traffic, event, security, anomaly, VoIP, DLP, and others. Logs can be stored locally (memory/disk), sent to FortiAnalyzer, syslog, or FortiCloud. Configure under Log & Report > Log Settings.

Log severity levels: emergency, alert, critical, error, warning, notification, information, debug. Filter logs by severity. Log settings can be per-policy (enable/disable logging) and per-profile.

FortiAnalyzer: central log collection, analytics, and reporting. FortiGate registers to FortiAnalyzer via 'config log fortianalyzer setting'. Use 'diagnose log test' to verify connectivity. ADOMs separate administrative domains.

SNMP: configure SNMP v1/v2c/v3 for monitoring. Communities, traps, and queries. 'config system snmp community'. MIBs available from Fortinet. Use SNMP to monitor interface status, CPU, memory, sessions.

Packet capture: 'diagnose sniffer packet '. Filters use tcpdump syntax. Verbose levels 1-6. Can write to file with 'diagnose sniffer packet any "host 1.1.1.1" 4 0 l'. Use 'diagnose sniffer packet' with caution on busy networks.

Debug commands: 'diagnose debug enable', 'diagnose debug application -1', 'diagnose debug console timestamp enable', 'diagnose debug disable'. Common apps: ike, sslvpn, ipsmonitor, https, dns, authd.

Session troubleshooting: 'diagnose sys session filter' then 'diagnose sys session list'. Clear sessions with 'diagnose sys session clear'. Check session statistics with 'diagnose sys session stat'.

Performance monitoring: 'get system performance status', 'get system performance top', 'diagnose sys top'. Check CPU, memory, session count, and bandwidth. 'diagnose hardware sysinfo memory' for memory details.

Troubleshooting flow: identify symptom, check logs, verify policy/routing, capture packets, enable debugs, and isolate. Use 'execute ping' and 'execute traceroute' from FortiGate. Check FortiGuard connectivity with 'diagnose debug rating'.

HA modes: active-passive (default) and active-active. Active-passive: one primary, one or more secondaries. Active-active: all units process traffic; requires switch multicast or redundant interfaces. HA heartbeat on dedicated interface(s).

HA configuration: 'config system ha'. Set mode, group name, group ID, password, priority, and monitor interfaces. Priority determines primary (higher wins). Override enable allows preemption. Heartbeat interval and lost threshold tune failover.

HA synchronization: configuration is synchronized from primary to secondaries. Some settings are not synchronized (e.g., interface IPs in some cases, HA settings). Use 'diagnose sys ha checksum show' to verify configuration consistency.

Failover: triggered by monitored interface failure, heartbeat loss, or link failure. Session pickup (enable/disable) determines if sessions survive failover. 'set session-pickup enable' for stateful failover. Gratuitous ARP updates switches.

HA troubleshooting: 'get system ha status', 'diagnose sys ha checksum show', 'diagnose sys ha dump'. Check heartbeat connectivity, monitor interfaces, and checksum mismatches. Use 'execute ha manage' to access secondary CLI.

Firmware upgrade: backup configuration first. Use 'execute backup config' and 'execute restore config'. Upgrade via GUI or 'execute restore image'. In HA, upgrade secondaries first, then primary. Use FortiManager for centralized upgrades.

Configuration backup: local backup (GUI or 'execute backup config tftp/ftp/usb'). Scheduled backups via FortiManager or automation stitches. Backup includes full config, not logs. Encrypt backups with password.

Factory reset: 'execute factoryreset' (keeps management IP) or 'execute factoryreset2' (full reset). After reset, default admin no password on HTTPS. Use 'execute reboot' to restart.

System maintenance: 'diagnose sys flash list' to view partitions. 'execute formatlogdisk' to format log disk. 'diagnose hardware deviceinfo disk' for disk status. Check FortiGuard updates with 'execute update-now'.