Fortinet FCA cheat sheet

FortiOS is the shared operating system underlying FortiGate, FortiManager, FortiAnalyzer, FortiWeb, FortiMail, and FortiProxy; the FortiASIC chips (NP, CP, SP) accelerate packet, content, and SSL processing respectively.

FortiGate is the NGFW line; hardware models range from desktop (40F/60F/70G) to chassis (7000 series), and virtual appliances are named FortiGate-VM with FGV prefixes.

FortiManager provides centralized policy and device management; FortiAnalyzer provides log collection, reporting, and SIEM-like analytics. Both are available as hardware, VM, and cloud-hosted offerings.

FortiGuard Labs is the threat research arm that produces signatures, IP reputation, and machine-learning models consumed by FortiGuard subscription services.

FortiClient is the endpoint agent (VPN, ZTNA, telemetry); FortiClient EMS is the management server that deploys profiles and licenses to endpoints.

FortiSwitch and FortiAP are FortiLink-managed by FortiGate, meaning the FortiGate acts as the wireless and switching controller without a separate appliance.

FortiWeb (WAF), FortiMail (email security), FortiSandbox (sandboxing), FortiNAC (network access control), and FortiSIEM (SIEM) are distinct product families, not FortiGate features.

Naming convention: the numeric portion of a FortiGate model indicates throughput tier and the trailing letter indicates hardware generation (D, E, F, G), with higher letters being newer.

FortiGate policy evaluation is top-down, first-match; traffic that matches no policy hits the implicit deny. Policy order therefore determines behavior.

A firewall policy is stateful: once a session is permitted, return traffic is allowed by the session table without a reverse policy.

NAT is configured inside the policy: SNAT via 'NAT enable' plus IP pool, DNAT via a virtual IP (VIP) object as destination address.

Security profiles (AV, IPS, web filter, application control, DNS filter, SSL inspection) attach to policies; profiles only inspect traffic that the policy permits.

Zones group interfaces so a single policy can reference multiple ports; inter-zone traffic still requires explicit policies unless intra-zone is permitted.

FortiOS VDOMs partition a single device into independent virtual firewalls, each with its own routing table, policies, and administrators.

Flow-based inspection passes traffic through the IPS engine with pattern matching; proxy-based inspection buffers and reconstructs content for deeper inspection.

SSL deep inspection requires installing the FortiGate CA certificate on clients; certificate inspection alone only reads the SNI and certificate fields.

Routing lookup precedes policy lookup; a packet with no route is dropped before any policy is evaluated.

FortiGuard subscription services include AV, IPS, web filtering, DNS filtering, application control, antispam, and IoT detection; each has its own license and update channel.

FortiGuard updates are pulled from the FortiGuard Distribution Network (FDN); FortiManager can act as a local FortiGuard server to distribute updates to managed FortiGates.

Outbreak Protection and IoT Detection are separate services layered on the base IPS/web-filtering licenses.

FortiAnalyzer stores logs and correlates events; FortiSIEM aggregates multi-vendor telemetry and applies correlation rules for incident creation.

FortiSandbox detonates suspicious files and returns verdicts to FortiGate via a fabric connector, allowing retroactive blocking of files already delivered.

Security Fabric connectors (FortiSandbox, FortiClient EMS, FortiNAC, syslog, SDN) let FortiGate share threat context with other products.

FortiGuard web filter categories are used both for blocking and for reporting; the category override list allows per-URL exceptions.

Log severity levels in FortiOS run from emergency (0) to debug (7); alert and critical events trigger automated actions in FortiAnalyzer playbooks.

FortiSASE is a cloud-delivered service combining secure web gateway, firewall-as-a-service, CASB, DLP, and ZTNA in one console.

FortiGate-VM is deployable in AWS, Azure, GCP, and OCI; licensing can be BYOL or on-demand via the marketplace.

FortiCNP and FortiCWP provide cloud workload and posture protection, scanning cloud accounts for misconfigurations and workload risks.

ZTNA in FortiOS uses an access proxy with application-based rules; users authenticate via SAML or local auth before any application access is granted.

FortiClient EMS acts as the ZTNA broker, issuing device certificates and enforcing device posture before tunnel or proxy access.

Zero Trust principles: verify explicitly, use least privilege, and assume breach; network location alone never grants access.

SD-WAN on FortiGate uses performance SLAs and rules to steer traffic across multiple WAN links, with ADVPN enabling on-demand tunnels between branches.

Security Fabric rating and FortiGate Cloud provide centralized visibility across cloud and on-premises FortiGates from a single pane.

FortiGate models differ in firewall throughput, IPS throughput, and SSL inspection throughput; sizing must use the SSL-inspection figure for encrypted traffic.

FortiManager ADOMs (Administrative Domains) partition managed devices and objects by administrative scope, similar in concept to VDOMs on a FortiGate.

FortiAnalyzer log storage is sized by GB/day ingestion; the appliance model determines maximum sustained log rate.

FortiGate Cloud is a hosted management and logging service for small deployments; FortiManager Cloud is the hosted version of FortiManager.

FortiEDR and FortiXDR extend endpoint detection and response beyond the FortiClient agent's basic antivirus and VPN functions.

FortiToken provides MFA tokens, either hardware or mobile, integrated with FortiAuthenticator and FortiGate two-factor authentication.

FortiAuthenticator centralizes RADIUS, LDAP, and SAML identity services and can act as a certificate authority for ZTNA device certificates.

Fabric connectors and the Security Fabric rating score indicate how fully a FortiGate deployment is integrated with other Fortinet products.

FortiGate interface types include physical, VLAN subinterface, aggregate (LAG), zone, and tunnel; each can be referenced in policies by name.

Static routes, policy routes, and SD-WAN rules can all influence forwarding; policy routes take precedence over static routes for matching traffic.

HA on FortiGate supports active-passive and active-active; FGCP synchronizes sessions, and session pickup must be enabled for failover continuity.

FortiOS supports NAT64 and NAT46, plus IPv6 in policies, routing, and security profiles on supported models.

Application control identifies applications by signature regardless of port, so it can block or shape traffic that port-based policies would miss.

FortiGate DNS filter can block malicious domains and botnet C2 lookups; it works with or without SSL inspection.

The FortiGate session table shows source, destination, policy ID, and NAT translation, and is the primary tool for verifying policy matches.

Antivirus profiles on FortiGate scan files in flow mode or proxy mode; proxy mode enables archive decompression and larger file inspection.

FortiGuard IP reputation feeds block known malicious sources at the firewall before content inspection, reducing load on IPS.

FortiGuard web filter ratings are queried in real time; local cache and FortiManager-distributed ratings reduce latency and dependency on the cloud.

FortiAnalyzer reports can be scheduled and emailed; datasets use SQL-like queries against the log database.

FortiSIEM uses supervisors, collectors, and workers; collectors receive logs, workers process and correlate, supervisors store and present.

Automation stitches (FortiGate) and playbooks (FortiAnalyzer/FortiSOAR) trigger actions such as quarantining a host or blocking an IP when a trigger fires.

FortiSandbox integrates via fabric connectors and can submit files automatically from FortiGate, FortiMail, and FortiWeb.

FortiGuard service licenses are per-device and expire; expired licenses stop signature updates but do not disable the firewall.

Log forwarding from FortiGate to FortiAnalyzer uses OFTP over TCP/514 or syslog; the FortiAnalyzer device must be registered and authorized.

FortiSASE connects branches and remote users through PoPs; FortiClient and FortiGate IPsec tunnels terminate at the nearest PoP.

CASB in FortiSASE discovers sanctioned and unsanctioned SaaS usage and can apply inline controls to cloud applications.

FortiGate-VM in public cloud supports autoscaling via cloud-native templates and FortiManager for configuration sync.

ZTNA rules match on user group, device posture, and application; the access proxy terminates the client connection and forwards only authorized traffic.

FortiClient ZTNA uses per-application tunnels rather than full-network VPN, so unapproved applications are never reachable.

FortiNAC provides device profiling and dynamic VLAN assignment, a common enforcement point for Zero Trust network segmentation.

SD-WAN rules can select links by measured latency, jitter, or packet loss, and can fail over when an SLA is not met.

FortiGate Cloud Sandbox and FortiSASE share FortiGuard threat intelligence, so verdicts learned in one product inform the other.

FortiGate configuration backups can be automated to FortiManager or FortiGate Cloud; revisions allow rollback to a prior config.

Firmware upgrades should follow the upgrade path documented for the model; skipping major versions can break configuration compatibility.

FortiManager scripts and provisioning templates push configuration to many FortiGates at once, reducing per-device manual work.

FortiAnalyzer and FortiManager can be deployed in HA pairs for redundancy; FortiGate HA is separate and configured on the firewalls themselves.

The FortiGate CLI uses 'config' and 'edit' blocks; 'show full-configuration' displays defaults, while 'show' displays only non-default values.

FortiGate REST API and FortiManager JSON-RPC allow automation of policy, object, and monitoring tasks.

FortiConverter migrates configurations from third-party firewalls to FortiOS, mapping policies and objects where possible.

FortiCare support tiers determine access to firmware downloads, FortiGuard updates, and technical support response times.

SSL inspection modes: certificate inspection reads only the server certificate and SNI; deep inspection decrypts and re-encrypts traffic using the FortiGate CA.

Deep inspection can break certificate-pinned applications; exceptions are added per destination in the SSL inspection profile.

IPS signatures are grouped by severity and category; the profile action can be block, monitor, or reset, and per-signature overrides are possible.

Web filter profiles support category-based blocking, URL override lists, and safe-search enforcement for search engines.

Application control can apply per-application actions including block, allow, or traffic shaping, and can control application sub-features.

Antivirus profiles support scan modes and can quarantine infected files; sandbox integration adds dynamic analysis for unknown files.

Security profile groups bundle profiles for reuse and are applied to policies in a single step.

FortiGate DoS policies rate-limit anomalous traffic (SYN floods, ICMP floods) before it reaches normal firewall policies.

FortiView on FortiGate provides real-time dashboards for top sources, destinations, applications, and threats.

FortiAnalyzer event handlers trigger alerts or actions when log patterns match defined conditions.

FortiSIEM correlation rules combine multiple events across sources; a single event rarely triggers an incident without a rule.

FortiSOAR playbooks orchestrate response across tools; they consume incidents from FortiSIEM, FortiAnalyzer, or third-party sources.

FortiGuard outbreak alerts are delivered through the FortiGuard service and can be viewed in the FortiGate FortiGuard console.

Log retention on FortiAnalyzer depends on licensed storage and daily log volume; archiving to external storage is supported.

Threat feeds and IoC lists can be imported into FortiGate as external threat feeds for policy matching.

Quarantine and captive portal actions let FortiGate or FortiNAC isolate a compromised endpoint pending remediation.

SASE converges networking (SD-WAN, WAN optimization) and security (SWG, FWaaS, CASB, ZTNA, DLP) into a cloud-delivered service.

SSE is the security-only subset of SASE; FortiSASE delivers both networking and security functions.

Zero Trust Network Access replaces full-tunnel VPN with application-level access brokered by an access proxy and identity provider.

Device posture checks in ZTNA can require OS patch level, antivirus status, or domain membership before granting access.

FortiSASE integrates with FortiClient EMS for endpoint posture and with FortiAuthenticator or external IdPs for SAML identity.

Cloud-native firewalls in FortiGate-VM can be deployed as gateways in VPCs/VNets, with routing tables directing traffic through them.

FortiCWP and FortiCNP scan cloud accounts for public storage buckets, overly permissive IAM, and unpatched workloads.

Microsegmentation in Zero Trust limits east-west traffic; FortiGate VDOMs, FortiNAC, and security groups in the cloud can enforce it.

FortiGate bundles: UTP bundles include AV, IPS, web filtering, application control, and FortiCare; Enterprise bundles add more services such as DLP and sandboxing.

FortiGuard licenses are tied to the device serial number and expire; renewal is separate from hardware support.

FortiClient EMS licenses are per-endpoint; FortiClient VPN-only use may not require an EMS license.

FortiSASE is licensed per user, with tiers based on the number of users and the services enabled.

FortiManager and FortiAnalyzer licenses are based on the number of managed devices or log volume, depending on the model.

FortiSandbox licensing is by appliance or VM capacity; cloud sandbox is available as a subscription.

FortiToken licenses are per token; FortiAuthenticator licenses are by user count.

FortiCare registration is required before firmware downloads and FortiGuard updates are available on a device.

Static routes have a distance and priority; lower distance wins, and priority breaks ties among equal distances.

Policy routes override the routing table for matching traffic and can specify a gateway or interface.

Source NAT with an IP pool can use overload (PAT), one-to-one, or fixed-port-range modes.

Destination NAT uses a VIP object; port forwarding maps an external port to an internal host and port.

Central NAT (in FortiOS) moves NAT configuration out of policies into dedicated NAT rules, evaluated independently of policy order.

Hairpin NAT is required when internal clients access an internal server via its public VIP address.

Reverse path forwarding checks can drop asymmetric traffic; disabling it is sometimes required in multi-path designs.

SD-WAN rules can perform source NAT per link and choose the egress interface based on SLA or application.

Incident response phases: preparation, detection and analysis, containment, eradication, recovery, and lessons learned.

FortiAnalyzer playbooks can quarantine a host, block an IP, or send notifications when an event handler fires.

FortiSIEM watchlists track entities of interest across events and can trigger notifications when an entity appears.

FortiSOAR connectors integrate with ticketing, email, and endpoint tools to automate response steps.

Compromise indicators include unusual outbound traffic, new admin accounts, and repeated authentication failures; FortiView surfaces these.

FortiGuard Labs publishes threat intelligence and IoCs that can be imported as external threat feeds.

Log correlation across FortiGate, FortiMail, and FortiWeb is done in FortiAnalyzer or FortiSIEM, not on the FortiGate alone.

Post-incident review should verify that detection rules and playbooks were effective and update them if gaps are found.

FortiSASE PoPs are distributed globally; users connect to the nearest PoP for lower latency.

Branch deployments can use FortiGate with an IPsec tunnel to FortiSASE, or FortiExtender for cellular connectivity.

Remote users connect via FortiClient with ZTNA or full-tunnel VPN depending on policy.

FortiGate-VM in AWS supports HA across availability zones using cloud-native failover mechanisms.

FortiGate-VM in Azure supports availability sets and load balancers for HA.

Terraform and CloudFormation templates automate FortiGate-VM deployment in public clouds.

FortiSASE can enforce DLP and CASB policies on SaaS traffic without backhauling to a data center.

ZTNA access proxy rules can be scoped to specific applications and user groups, enabling least-privilege access.

FortiCare support tiers include 24x7 and enhanced options; the tier determines response time and access to advanced support.

Firmware downloads require a registered device with active FortiCare.

FortiGuard updates require active FortiGuard licenses; expired licenses stop updates but the device keeps running.

FortiManager and FortiAnalyzer have their own FortiCare contracts, separate from the managed FortiGates.

FortiCloud accounts link devices for FortiGate Cloud and FortiClient EMS cloud services.

RMA replacement of hardware requires an active support contract and a support ticket.

Fortinet documentation and the Fortinet Training Institute provide product documentation and certification paths.

The Fortinet support portal provides firmware images, release notes, and known-issue lists.

FGCP HA uses heartbeat and hello interfaces; the hello interval and failover threshold determine failover speed.

HA synchronization includes sessions, routing, and configuration; session pickup must be enabled for session continuity.

Active-passive HA has one primary and one or more secondaries; active-active distributes sessions across members.

HA override controls whether a higher-priority device takes over when it rejoins; disabled by default in many designs to avoid flapping.

Split-brain occurs when heartbeat is lost; monitor interfaces and heartbeat links must be redundant.

Virtual MAC addresses are used in HA so that failover does not require ARP updates from peers.

HA status can be verified with 'get system ha status' on the FortiGate CLI.

Firmware versions must match across HA members for FGCP to form.

FortiGate logs include traffic, event, security, and anomaly logs; each has its own subtype and fields.

FortiAnalyzer datasets query these logs with SQL-like syntax; reports are built from datasets.

FortiSIEM parses logs from many vendors using parsers; incorrect parsers cause missing or misattributed events.

Syslog forwarding sends logs to third-party SIEMs; the format and facility are configurable.

FortiGate can send logs to FortiAnalyzer, syslog, or both; local logging is limited by disk size.

FortiSandbox returns verdicts to FortiGate, which logs them as security events and can block the file retroactively.

FortiGuard web filter logs include category and rating, which feed reporting and policy tuning.

Log retention and archiving must be planned before deployment; FortiAnalyzer storage is finite.

SAML is the common identity federation protocol for ZTNA and FortiSASE; FortiAuthenticator or an external IdP can act as the identity provider.

FortiAuthenticator can act as a RADIUS server, LDAP proxy, and certificate authority.

FortiToken provides OTP MFA; TOTP and push modes are supported depending on the token type.

Device certificates issued by FortiAuthenticator or FortiClient EMS bind identity to device for ZTNA posture checks.

FortiNAC can integrate with Active Directory to identify users and devices and apply dynamic network policies.

Zero Trust requires continuous verification; a one-time login is not sufficient, so posture is re-evaluated.

FortiClient EMS can enforce compliance checks such as antivirus status and OS patch level before granting ZTNA access.

FortiGate can authenticate users via LDAP, RADIUS, or SAML for firewall policies and VPN.

FortiGate-VM runs on VMware, KVM, Hyper-V, Xen, and public clouds; the VM license is tied to the VM and its resources.

FortiGate-VM licensing can be BYOL (perpetual or subscription) or on-demand via cloud marketplaces.

FortiGate-VM resource limits (vCPU, RAM) are set by the license tier; exceeding them is not permitted.

FortiManager and FortiAnalyzer are available as VMs with licensed device or log-volume limits.

FortiWeb, FortiMail, and FortiSandbox are also available as VMs.

FortiGate-VM supports HA in virtualization platforms using FGCP over heartbeat interfaces.

FortiGate-VM in public clouds uses cloud-native HA mechanisms such as AWS autoscaling groups and Azure load balancers.

FortiGate-VM can be deployed with Terraform and cloud-native templates for repeatable builds.

Application control identifies applications by signature, not port, and can block or shape them.

Application control can control sub-features such as file transfer or chat within an application.

Web filtering uses FortiGuard categories and can be overridden per URL.

Safe search enforcement forces search engines into safe mode for protected users.

YouTube education filter restricts content on YouTube for education environments.

Web filter profiles can be applied per policy and per user group.

DNS filter blocks malicious domains and botnet C2 lookups without SSL inspection.

SSL inspection is required for full URL filtering of HTTPS traffic; certificate inspection only reveals the domain.

FortiGuard Labs produces signatures, IP reputation, and ML models consumed by FortiGuard services.

IP reputation feeds block known malicious sources before content inspection.

Outbreak alerts notify of active threats and can trigger enhanced protection.

External threat feeds can be imported into FortiGate as IoC lists for policy matching.

FortiSandbox detonates unknown files and returns verdicts to FortiGate for retroactive blocking.

FortiSIEM and FortiAnalyzer can consume IoC feeds for correlation and hunting.

Threat intelligence sharing across the Security Fabric lets one product's verdict inform others.

FortiGuard ratings for URLs and domains are queried in real time, with local caching to reduce latency.

SWG filters web traffic, enforces acceptable use, and blocks malicious sites.

FWaaS provides firewall policy in the cloud for branch and remote traffic.

CASB discovers and controls SaaS usage, including shadow IT.

DLP inspects content for sensitive data and can block or log exfiltration.

ZTNA brokers application access with identity and posture checks.

SD-WAN optimizes WAN traffic and steers it across links based on SLA.

FortiSASE combines these into one cloud-delivered service managed from a single console.

SSE is the security-only subset of SASE and excludes the networking functions.

The Security Fabric links FortiGate, FortiManager, FortiAnalyzer, FortiClient EMS, FortiSandbox, FortiNAC, and other products.

Fabric connectors let FortiGate share threat context with connected products.

The Security Fabric rating score indicates how fully a deployment is integrated.

FortiManager can act as a local FortiGuard server to distribute updates to managed devices.

FortiAnalyzer stores logs and correlates events across the fabric.

FortiSandbox returns verdicts to FortiGate via a fabric connector for retroactive blocking.

FortiClient EMS provides endpoint telemetry and ZTNA posture to the fabric.

FortiNAC enforces network access based on device and user identity.

IPsec site-to-site VPN uses IKE to negotiate SAs and ESP to encrypt traffic.

SSL VPN provides remote access via a web portal or tunnel mode.

ADVPN enables on-demand tunnels between branches using shortcut messages.

IKEv2 is preferred over IKEv1 for modern deployments.

VPN policies and firewall policies are separate; traffic must be permitted by a firewall policy after decryption.

Dial-up VPN uses a dynamic gateway and can authenticate users via LDAP, RADIUS, or local accounts.

VPN tunnels can be referenced in policies by tunnel interface name.

SSL VPN can enforce host checks before granting access.

Automation stitches on FortiGate trigger actions when an event occurs.

FortiAnalyzer playbooks trigger actions when event handlers fire.

FortiSOAR playbooks orchestrate response across multiple tools.

FortiSIEM correlation rules combine events across sources to create incidents.

Automation can quarantine a host, block an IP, or send notifications.

Playbooks and stitches should be tested before production use.

Automation reduces response time and manual effort.

Post-incident review should update automation rules if gaps are found.

FortiCWP and FortiCNP scan cloud accounts for misconfigurations and workload risks.

Public storage buckets, overly permissive IAM, and unpatched workloads are common findings.

FortiGate-VM can act as a cloud gateway in VPCs and VNets.

Cloud-native HA uses autoscaling groups and load balancers.

Terraform and CloudFormation templates automate deployment.

Microsegmentation limits east-west traffic using security groups, VDOMs, or FortiNAC.

FortiSASE can enforce DLP and CASB policies on SaaS traffic.

Cloud posture findings should feed into incident response workflows.

FortiManager centralizes policy and device management.

FortiAnalyzer centralizes log collection, reporting, and analytics.

ADOMs partition managed devices and objects by administrative scope.

FortiGate Cloud is a hosted management and logging service for small deployments.

FortiManager Cloud is the hosted version of FortiManager.

Scripts and provisioning templates push configuration to many devices at once.

Configuration backups can be automated to FortiManager or FortiGate Cloud.

The FortiGate REST API and FortiManager JSON-RPC allow automation.

FortiOS is the shared operating system underlying FortiGate and other products.

The CLI uses 'config' and 'edit' blocks; 'show full-configuration' displays defaults.

VDOMs partition a device into independent virtual firewalls.

Zones group interfaces so one policy can reference multiple ports.

Policy evaluation is top-down and first-match.

The session table shows source, destination, policy ID, and NAT translation.

FortiView provides real-time dashboards.

Firmware upgrades should follow the documented upgrade path.

FortiGate logs include traffic, event, security, and anomaly logs.

FortiAnalyzer datasets use SQL-like queries against the log database.

Reports can be scheduled and emailed.

Log forwarding uses OFTP over TCP/514 or syslog.

FortiAnalyzer must be registered and authorized before logs are accepted.

Log retention depends on licensed storage and daily log volume.

Archiving to external storage is supported.

FortiSIEM uses supervisors, collectors, and workers.

Verify explicitly: authenticate and authorize every request.

Use least privilege: grant only the access needed.

Assume breach: design as if the network is already compromised.

Network location alone never grants access.

Continuous verification is required; one-time login is not sufficient.

Device posture checks include OS patch level, antivirus status, and domain membership.

ZTNA uses an access proxy with application-based rules.

Microsegmentation limits east-west traffic.

FortiGate is the NGFW line, available as hardware and VM.

FortiManager and FortiAnalyzer provide management and logging.

FortiWeb is a WAF; FortiMail is email security; FortiSandbox is sandboxing.

FortiNAC provides network access control; FortiSIEM is a SIEM.

FortiClient is the endpoint agent; FortiClient EMS manages endpoints.

FortiSwitch and FortiAP are managed by FortiGate via FortiLink.

FortiToken provides MFA; FortiAuthenticator centralizes identity.

FortiEDR and FortiXDR extend endpoint detection and response.

Security profiles include AV, IPS, web filter, application control, DNS filter, and SSL inspection.

Profiles only inspect traffic that the policy permits.

SSL deep inspection decrypts and re-encrypts traffic using the FortiGate CA.

Certificate inspection reads only the server certificate and SNI.

IPS signatures are grouped by severity and category.

Web filter profiles support category-based blocking and URL overrides.

Application control can shape or block applications by signature.

Security profile groups bundle profiles for reuse.

FortiGuard services include AV, IPS, web filtering, DNS filtering, application control, antispam, and IoT detection.

FortiGuard updates are pulled from the FDN.

FortiManager can act as a local FortiGuard server.

Outbreak Protection and IoT Detection are separate services.

IP reputation feeds block known malicious sources.

FortiGuard web filter ratings are queried in real time.

FortiGuard licenses are per-device and expire.

Expired licenses stop updates but do not disable the firewall.

FortiSASE is a cloud-delivered service combining SWG, FWaaS, CASB, DLP, and ZTNA.

PoPs are distributed globally; users connect to the nearest PoP.

Branch deployments use IPsec tunnels to FortiSASE.

Remote users connect via FortiClient with ZTNA or full-tunnel VPN.

FortiSASE integrates with FortiClient EMS for posture and with IdPs for SAML.

CASB discovers sanctioned and unsanctioned SaaS usage.

DLP inspects content for sensitive data.

FortiSASE is licensed per user.

FortiASIC chips (NP, CP, SP) accelerate packet, content, and SSL processing.

FortiGate models range from desktop to chassis.

FortiSwitch and FortiAP are managed by FortiGate via FortiLink.

FortiExtender provides cellular connectivity.

FortiToken is available as hardware or mobile.

FortiSandbox is available as an appliance or VM.

FortiManager and FortiAnalyzer are available as hardware, VM, and cloud.

Sizing must use the SSL-inspection throughput figure for encrypted traffic.

Policy evaluation is top-down and first-match.

The implicit deny drops traffic that matches no policy.

SNAT is configured via 'NAT enable' plus an IP pool.

DNAT uses a VIP object as the destination address.

Central NAT moves NAT configuration into dedicated rules.

Hairpin NAT is required for internal clients accessing an internal server via its public VIP.

Policy routes override the routing table for matching traffic.

Source NAT with an IP pool can use overload, one-to-one, or fixed-port-range modes.

FortiSIEM aggregates multi-vendor telemetry and applies correlation rules.

FortiSIEM uses supervisors, collectors, and workers.

Correlation rules combine multiple events across sources.

FortiSOAR playbooks orchestrate response across tools.

FortiSOAR consumes incidents from FortiSIEM, FortiAnalyzer, or third-party sources.

Watchlists track entities of interest across events.

Connectors integrate with ticketing, email, and endpoint tools.

Parsers must be correct or events are missing or misattributed.

ZTNA uses an access proxy with application-based rules.

Users authenticate via SAML or local auth before access is granted.

FortiClient EMS acts as the ZTNA broker.

Device certificates bind identity to device.

Posture checks include OS patch level, antivirus status, and domain membership.

Per-application tunnels replace full-network VPN.

Unapproved applications are never reachable.

ZTNA access rules can be scoped to specific applications and user groups.