FCP flashcards
FCP · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Security Fabric root FortiGate
- The root FortiGate aggregates downstream FortiGates in the Security Fabric and manages Fabric Connectors. It is the central point for topology and rating.
- Transparent mode
- FortiGate operates as a bridge without IP addresses on data interfaces except management. Policies still apply. Supported in HA. Used for insertion into existing networks.
- Session table
- Stateful table tracking active connections. Reply traffic allowed if session exists. Shows policy ID, NAT, timeout. Inspect with diagnose sys session list.
- Policy first-match rule
- Firewall policies are evaluated top-down; first matching policy is applied. Implicit deny at bottom drops unmatched traffic. Order is critical.
- Central NAT
- NAT configured in a separate NAT table instead of per-policy. Policies reference NAT rules. Simplifies management for many policies needing same NAT.
- Per-IP shaper
- Traffic shaping that limits bandwidth per source IP address. Applied in firewall policy or shaping policy. Prevents a single host from consuming all bandwidth.
- FSSO
- Fortinet Single Sign-On collects domain login events to identify users by IP. Uses DC agent, collector agent, or FortiAuthenticator. Groups used in policies.
- RADIUS SSO
- Uses RADIUS accounting messages to identify users by IP address. FortiGate acts as RADIUS accounting client. Users matched in policies without explicit login.
- Admin profile
- Defines permissions for administrative accounts (e.g., super_admin, prof_admin). Bound to admin user. Trusted hosts further restrict source IPs.
- SSL VPN tunnel mode
- Provides full network access via FortiClient or web portal. Requires tunnel IP range and firewall policy from SSL VPN interface to internal network.
- IPsec phase 1
- IKE negotiation defining authentication (PSK/cert), remote gateway, proposals, DH group, and DPD. Must match on both peers. Can host multiple phase 2 definitions.
- Route-based IPsec
- Uses a tunnel interface and static routes instead of policy-based VPN. Preferred for SD-WAN and dynamic routing. Firewall policies reference tunnel interface.
- Web filter category action
- Per-category action: allow, block, monitor, warning, or authenticate. Overrides can be set per URL. FortiGuard categories updated dynamically.
- Application control signature
- Identifies applications by traffic signature, not just port. Actions include allow, block, monitor, or shape. Signatures updated via FortiGuard.
- Full SSL inspection
- Decrypts and re-encrypts HTTPS traffic to inspect content. Requires importing FortiGate CA certificate to clients. Enables web filter and app control on HTTPS.
- IPS signature override
- Individual IPS signatures can be set to block, monitor, or disable. Custom signatures can be created. Overrides are configured in the IPS sensor.
- Flow-based inspection
- Inspects packets as they pass without buffering. Lower latency than proxy-based. Some advanced features require proxy-based inspection.
- FortiSandbox integration
- Sends suspicious files to FortiSandbox for detonation. Results can block future downloads. Configured as a Fabric Connector. Requires appliance or cloud.
- SD-WAN health check
- Monitors latency, jitter, and packet loss per WAN member. SLA targets determine member status. Violations trigger rule re-evaluation and failover.
- Policy route
- Overrides routing table for matching traffic. Matches source, destination, protocol, port. Action forward to gateway/interface or stop. Evaluated before routing table.
- ECMP
- Equal-cost multi-path: multiple routes with same distance and priority. FortiGate load balances across up to 10 paths. Configure ecmp-max-paths.
- FortiAnalyzer registration
- FortiGate sends logs to FortiAnalyzer after registration. Configure under log fortianalyzer setting. Verify with diagnose log test. ADOMs separate domains.
- Packet capture command
- diagnose sniffer packet <interface> <filter> <verbose> <count>. Uses tcpdump syntax. Verbose levels 1-6. Can write to file for analysis.
- Debug application command
- diagnose debug application <name> -1 enables debug for a specific daemon (ike, sslvpn, ipsmonitor). Use diagnose debug enable and disable to control output.
- HA active-passive
- One primary processes traffic; secondaries standby. Heartbeat on dedicated interface. Failover on monitored interface failure or heartbeat loss. Session pickup optional.
- HA checksum
- Verifies configuration consistency across HA members. diagnose sys ha checksum show. Mismatch indicates unsynchronized settings; check HA status and sync.
- Configuration backup
- Save full configuration via GUI or execute backup config tftp/ftp/usb. Encrypt with password. Does not include logs. Essential before firmware upgrade.
- Factory reset
- execute factoryreset keeps management IP; factoryreset2 full reset. After reset, default admin no password on HTTPS. Use execute reboot to restart.
- Virtual wire pair
- Transparent pair of interfaces that passes traffic without routing. Policies can be applied. Useful for inline inspection without changing IP addressing.
- Traffic shaping policy
- Matches application, URL category, user, or address to apply shaper. Evaluated before firewall policy for shaping. Enables application-based shaping without policy.
- Certificate authentication
- Uses PKI user and local certificate for authentication. Requires CA import and valid certificate. Used in policies and SSL VPN. CRL/OCSP checks revocation.
- IPsec DPD
- Dead Peer Detection detects unreachable peers and tears down stale tunnels. Configured in phase 1. Modes: on-idle, on-demand, disable. Helps failover.