FCP FortiGate Administrator flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Implicit deny policy

A permanent rule at the bottom of the firewall policy table that drops all traffic not matched by an explicit policy; it cannot be edited or deleted.

Central SNAT

A NAT table evaluated before per-policy NAT that matches source, destination, and interface to apply source translation globally across policies.

Virtual IP (VIP)

A destination NAT object mapping an external address and port to an internal server address and port; the firewall policy references the VIP as destination.

Policy route

A route evaluated before the routing table that forwards matching traffic based on source, destination, protocol, or port, overriding normal destination lookup.

Overload NAT pool

A dynamic IP pool that translates many internal addresses to one external address using port multiplexing, also called port address translation.

Administrative distance

A value ranking route sources; lower distance is preferred, so connected routes beat static routes, which beat dynamic routes of higher distance.

Static route priority

A tie-breaker used when multiple routes share the same destination and distance; the lower priority value is preferred for forwarding.

Equal-cost multipath

A condition where multiple routes to a destination share distance and priority, so sessions are distributed across them using a hash.

OSPF cost

A metric derived from interface bandwidth relative to a reference; lower cost paths are preferred within an area, and areas connect via area 0.

SD-WAN SLA check

A health probe measuring latency, jitter, and packet loss on member links; when an SLA fails, traffic fails over to the next eligible member.

VLAN sub-interface

A logical interface on a parent port carrying 802.1Q tags; the VLAN ID must match the peer switch and the parent must be configured.

Local versus remote users

Local users are stored on the device; remote users are authenticated against LDAP, RADIUS, TACACS+, or SAML servers defined under user settings.

Identity-based policy

A firewall policy that matches a user or user group, allowing access decisions based on authenticated identity rather than only addresses.

Two-factor authentication

A login method combining a password with a second factor such as a FortiToken, email, or SMS code; TOTP codes are time-based.

FSSO

Fortinet single sign-on that collects domain logon events from controllers or agents so users are authenticated without an explicit prompt.

Captive portal

An HTTP/HTTPS interception that collects credentials before granting access; it applies per interface and can use local or remote authentication.

Admin trusthost

A setting restricting which source addresses may log in as an administrator; it limits exposure of administrative access to trusted networks.

Antivirus profile

A security profile scanning files for malware using signatures; flow mode inspects inline while proxy mode buffers files for deeper inspection.

IPS signature action

The response when an intrusion signature matches: block drops the packet, monitor logs only, and reset terminates the session.

Web filter category

A classification of URLs used by the web filter profile to allow, block, or warn on sites; safe search and malicious categories can be enforced.

Application control

A profile identifying applications by signature regardless of port, then allowing, blocking, or shaping traffic per application or category.

Certificate inspection

An SSL inspection mode that reads the server certificate without decrypting payload; full SSL inspection uses a forward-proxy certificate to decrypt.

DNS filter

A profile acting on DNS queries to block domains by category or botnet list, optionally redirecting clients to a block page.

Profile group

A bundle of security profiles applied together by a single firewall policy, enabling antivirus, IPS, web filter, and app control at once.

IPsec phase 1

The IKE negotiation of authentication method, encryption, hashing, DH group, and lifetime; both peers must agree on these proposals.

IPsec phase 2

The negotiation of the IPsec security association, including encryption, hashing, and traffic selectors; mismatched subnets cause failures.

Route-based VPN

A VPN using a tunnel interface and routing table entries; traffic enters the tunnel based on routes rather than a policy action.

Dead peer detection

A mechanism detecting an unresponsive IPsec peer and optionally restarting the tunnel; on-demand mode checks only when traffic exists.

NAT traversal

Encapsulation of ESP packets in UDP port 4500 so IPsec passes through NAT devices; both peers must support it.

SSL VPN portal

A configuration controlling client or web-mode access, including the resources exposed and whether split tunneling routes are pushed.

FortiAnalyzer logging

Centralized log storage, reporting, and correlation; FortiGate sends logs to it over OFTP or syslog for retention and analysis.

FGCP HA failover

Fortinet clustering where a primary handles traffic and a secondary takes over on failure, using heartbeat and session synchronization.