FCP FortiGate Administrator cheat sheet

Policies are evaluated top-down by sequence number; the first matching policy is applied and evaluation stops unless a policy has no matching criteria left to check.

Implicit deny sits at the bottom of the policy table and drops all traffic not matched by an explicit policy; it cannot be edited or deleted.

A policy without NAT enabled forwards packets with original source addresses; enabling NAT typically translates to the outgoing interface address (overload).

Central SNAT and central DNAT tables are evaluated before per-policy NAT; central SNAT rules match on source/destination/interface and take precedence over policy NAT.

Virtual IPs (DNAT) map an external address/port to an internal address/port; the firewall policy must reference the VIP object as destination, not the real server IP.

Policy routes override the routing table for matching traffic and are evaluated before destination-based routing lookup.

Security profiles are applied per policy; a profile attached to a policy only inspects traffic that policy accepts.

Policy lookup order for a session: policy route, then firewall policy; session helpers may open related pinholes automatically.

NAT64/NAT46 and IP pool types (overload, one-to-one, fixed-port-range) determine how translated addresses and ports are allocated.

Static routes have a distance (administrative distance) and priority; lower distance wins, and priority breaks ties among equal-distance routes.

Connected routes are preferred over static and dynamic routes because connected interfaces have the lowest administrative distance.

Policy routes are checked before the routing table and can forward traffic out a different interface or gateway based on source, destination, protocol, or port.

Equal-cost multipath (ECMP) is enabled when multiple routes to the same destination share distance and priority; sessions are distributed by a hash.

OSPF uses cost derived from interface bandwidth reference; lower cost paths are preferred within an area, and areas must connect via the backbone (area 0).

BGP neighbors must have matching AS numbers and reachable TCP/179; eBGP peerings typically use directly connected interfaces while iBGP needs full mesh or route reflectors.

Interface modes include static (manual IP), DHCP client, and PPPoE; administrative access protocols (HTTPS, SSH, ping) are enabled per interface.

SD-WAN rules select member interfaces by SLA health checks; when an SLA fails, traffic fails over to the next eligible member.

VLAN sub-interfaces carry 802.1Q tags; the parent interface must be configured and the VLAN ID must match the peer switch.

Local users are stored on the device; remote users come from LDAP, RADIUS, TACACS+, or SAML/SSO servers configured under user definition.

Firewall policies can match user or user group, enforcing identity-based access; unknown users are treated as unauthenticated and may hit a different policy.

Authentication timeout and idle timeout control how long an authenticated session remains valid before re-authentication is required.

Two-factor authentication combines a password with a token (FortiToken, email, SMS); TOTP tokens are time-based and drift can cause failures.

FSSO (single sign-on) collects logon events from domain controllers or agents so users are authenticated without prompting.

Captive portal intercepts HTTP/HTTPS to collect credentials; it can use local or remote authentication and applies per-interface.

Admin accounts are separate from firewall users; admin profiles define read/write scope and trusthost restricts source addresses for admin login.

LDAP group matching maps directory groups to FortiGate user groups; the group filter must match the directory's group attribute.

RADIUS accounting can update user session state; without accounting, sessions rely on idle timeout to expire.

Antivirus scans files for malware using signatures and can be applied in flow or proxy inspection mode; proxy mode enables full file buffering.

IPS signatures detect exploits and anomalies; the action can be block, monitor, or reset, and custom signatures supplement the built-in set.

Web filter categorizes URLs and can allow, block, or warn; it can also enforce safe search and block malicious categories.

Application control identifies applications by signature regardless of port; it can allow, block, or shape traffic per application or category.

SSL/SSH inspection decrypts traffic using a forward-proxy certificate; certificate inspection (no decryption) only reads the server certificate.

DNS filter blocks domains by category or botnet list and can redirect to a block page; it operates on DNS queries.

File filter blocks or logs files by type and size, independent of antivirus signature matches.

Profile groups bundle multiple security profiles so one policy can apply antivirus, IPS, web filter, and app control together.

Flow-based inspection is faster with less buffering; proxy-based inspection allows deeper inspection and features like file quarantine.

IPsec phase 1 (IKE) negotiates authentication, encryption, and hashing; phase 2 (IPsec SA) negotiates the tunnel parameters and selectors.

Pre-shared key and certificate authentication are the two main phase 1 methods; both peers must agree on encryption, hash, DH group, and lifetime.

IKEv1 main mode hides identities; aggressive mode exposes them and is discouraged; IKEv2 is preferred for modern deployments.

The IPsec tunnel must have matching interesting traffic (selectors) on both peers; mismatched subnets cause phase 2 failures.

Route-based VPN uses a tunnel interface and routes; policy-based VPN matches traffic in a firewall policy with the tunnel as the action.

Dead peer detection (DPD) detects failed peers and can restart the tunnel; on-demand DPD only checks when traffic exists.

SSL VPN provides client or web-mode access; portal settings control which resources and split-tunnel routes clients receive.

NAT traversal (NAT-T) encapsulates ESP in UDP/4500 when a NAT device lies between peers; both peers must support it.

VPN monitor and logs show tunnel status, bytes, and phase failures; phase 1 failures are usually authentication or proposal mismatches.

Logging can be local (memory/disk) or remote (syslog, FortiAnalyzer, SNMP); log severity and filters determine what is recorded.

Traffic logs record sessions with source, destination, policy, and action; event logs record system and admin activity.

FortiAnalyzer provides centralized log storage, reporting, and correlation; FortiGate sends logs over OFTP (TCP/514) or syslog.

SNMP traps notify on events; SNMP polling reads interface and system counters; SNMPv3 adds authentication and encryption.

Backup and restore of configuration can be full or encrypted; a configuration backup captures policies, objects, and settings.

Firmware upgrades should follow the upgrade path; HA clusters upgrade with minimal downtime by upgrading secondary units first.

HA (FGCP) uses heartbeat and session synchronization; primary handles traffic and secondary takes over on failure.

Diagnose commands (diagnose sniffer, debug flow, diagnose sys session) troubleshoot traffic, sessions, and routing decisions.

Dashboard widgets, FortiView, and log filters provide real-time visibility into top sources, destinations, and threats.