Monitoring, Troubleshooting, and Maintenance
What this domain tests
Monitoring, Troubleshooting, and Maintenance tests whether you can observe FortiAuthenticator, isolate an authentication or SSO failure, and keep the appliance healthy through backups, upgrades, certificate renewal, and HA checks. Questions often present a symptom and ask for the first useful diagnostic.
Monitoring and logs
Use the dashboard for system health, authentication activity, and HA status. Authentication logs show accept or reject decisions; admin logs show configuration changes; event logs show system and service events. Send logs to syslog or a SIEM where required, and monitor certificate expiry, disk usage, and license status. Reports help with trends, but logs are better for a specific failed login.
Troubleshooting workflow
- Confirm the client can reach FortiAuthenticator on the required service port and that the client IP matches a configured RADIUS client entry.
- Verify the shared secret and authentication method, such as PAP versus MS-CHAP.
- Test LDAP bind and group lookup separately from FortiGate policy.
- Check that the token is assigned, activated, and time-synchronized.
- Use packet capture and service debug on FortiAuthenticator to see whether the request arrives and where it is rejected.
- For SAML or FSSO, check trust metadata, attribute names, group filters, and clock skew.
Maintenance
Take configuration backups before changes and before firmware upgrades. Follow the supported upgrade path rather than jumping major versions. In HA, verify synchronization and failover after changes. Renew certificates and review token assignments so stale objects do not cause confusing failures.
Worked example
A FortiGate reports RADIUS timeouts for VPN users. First confirm the FortiGate IP is defined as a RADIUS client and the shared secret matches. Then run a packet capture on FortiAuthenticator to see whether requests arrive. If requests arrive but are rejected, test the LDAP bind and inspect the authentication log. If the password succeeds but OTP fails, check token assignment and NTP. Reasoning: isolating transport, client definition, directory, and token stages prevents changing unrelated policy.
Traps that cost marks
- Leaving verbose debug enabled after troubleshooting and filling logs or affecting performance.
- Assuming a timeout is a bad password when the request never reached FortiAuthenticator.
- Ignoring expired certificates or SAML signing certificate changes.
- Restoring a backup from an incompatible firmware version without checking support.
- Failing to test HA failover after a configuration or certificate change.