I85PREP
⌘ K
FCSS FortiSASE 25 Administrator study materials
FCSS FortiSASE 25 Administrator study resources

FCSS FortiSASE 25 Administrator: Monitoring, Logging, and Troubleshooting

FCSS FortiSASE 25 Administrator · Work through your exam, one topic at a time.

All guide sections

Monitoring, Logging, and Troubleshooting

Domain 6: Monitoring, Logging, and Troubleshooting

This domain tests whether you can prove what FortiSASE did with a session and find where it failed. Expect questions on dashboards, log types, retention and forwarding, and a layered troubleshooting sequence rather than a single magic command.

Core rules

  • Dashboards and FortiView summarize users, devices, applications, threats, and PoP health. Use them to spot scope, not to prove a single session.
  • Log types include traffic, security, system, and endpoint/client events. A block may appear in web filter, DNS filter, IPS, or application control logs, depending on which engine acted.
  • Retention is finite. If the event is older than the retention window, it is gone unless forwarded. Forward logs to FortiAnalyzer or a syslog/SIEM destination before you need them.
  • Time zones matter. Compare endpoint, portal, and log timestamps in the same zone.
  • Troubleshoot in layers: identity/authentication, client connection and PoP, policy match, security profile action, routing/connector, DNS, then endpoint application.
  • The implicit deny is real: no matching policy means no log line for an allowed session, only a deny.

Worked example

A user reports that a SaaS application returns an access-denied page. The administrator checks the client status: connected to the Singapore PoP, user authenticated as SASE-Sales. The traffic log shows the session matched the general internet policy, not the Marketing policy, because the user was placed in the wrong IdP group. The web filter category was allowed, but a later URL filter blocked the path. The fix is group correction plus a URL filter exception, not an SSL change.

Reasoning: each layer produced evidence: client status ruled out connectivity; the traffic log identified the policy; the security log identified the URL filter. Changing SSL inspection would not help.

Traps

  • Looking only at endpoint logs and never at the PoP policy match.
  • Forgetting that monitor actions still log but do not block.
  • Missing logs because retention expired or forwarding was never configured.
  • Comparing timestamps across time zones and concluding the event did not happen.
  • Assuming a block page identifies the engine; check the specific log type.

Key points

  • Dashboards show scope; traffic and security logs prove individual session decisions.
  • Retention is limited, so forward logs to FortiAnalyzer or syslog before they expire.
  • Troubleshoot in layers: identity, client/PoP, policy, profile, routing, DNS, endpoint.
  • Monitor actions log without blocking, which is useful for tuning but not enforcement.
  • The implicit deny explains many "no log, no access" cases.