FCSS Enterprise Firewall 7.6 cheat sheet

Interfaces are grouped into zones; a zone can hold multiple interfaces, but each interface belongs to exactly one VDOM and one zone.

Administrative access protocols (HTTPS, SSH, SNMP, ping, FMG-access) are enabled per-interface under the interface's administrative access settings, not globally.

A management VDOM is designated on multi-VDOM devices; only that VDOM's management interface exposes global admin access, and it is set with set management-vdom in the global config.

Firmware upgrades: execute backup config before upgrading; execute restore image stages the image; diagnose sys flash list shows image partitions and the boot partition.

Default administrative ports: HTTPS 443, SSH 22; changing ports requires set admin-sport / set admin-ssh-port and re-login on the new port.

HA and VDOM mode changes require a reboot; switching between NAT and transparent (or interface) mode is done per-VDOM and requires confirmation.

NTP and DNS are configured globally or per-VDOM; certificate-based features and log timestamps depend on correct NTP sync.

Config revisions are stored locally; execute revision lists them and execute revision restore <n> rolls back, while # config-revision controls how many are retained.

Authentication policies are evaluated before firewall policies; a matching auth policy triggers the captive portal or explicit proxy challenge before the traffic policy is checked.

Supported methods include local password, LDAP, RADIUS, TACACS+, PKI/certificate, FSSO, and SAML; each is defined as a user object referenced by a user group.

Firewall authentication timeout (auth-timeout) defaults to 480 minutes and is set per firewall policy or per auth policy; idle-timeout defaults to 300 minutes.

FSSO relies on collector agents polling domain controllers; diagnose debug authd fsso list shows logged-in users, and diagnose debug authd fsso refresh-logons forces a resync.

LDAP group matching uses group-object filters; nested groups require the group filter to recurse or an explicit memberOf check.

Two-factor authentication combines a primary method (LDAP/RADIUS/local) with FortiToken or an OTP via RADIUS; the token is bound to the user object.

Captive portal can be authentication (redirect to login) or disclaimer-only; disclaimer mode records acceptance without credential verification.

diagnose firewall auth list displays authenticated users and their source IPs; diagnose firewall auth clear removes sessions.

Security profiles attach to firewall policies in the policy's security-profile group; profile mode can be set to flow-based or proxy-based per VDOM.

Antivirus scan modes: proxy (full inspection, buffers files) vs flow (streaming, less latency); flow-based AV cannot scan some archive formats.

IPS sensor entries match by signature, severity, and target (server/client); set status disable on a signature excludes it, and rate-based signatures need set rate-count/set rate-duration.

Web filter profiles use static URL filter entries plus FortiGuard categories; actions are allow, block, monitor, warning, and authenticate.

Application control matches on application signature and category; unknown applications can be forced through set unknown-app-action.

SSL/SSH inspection profiles determine which traffic is decrypted; deep-inspection requires the FortiGate CA certificate be trusted on clients or installed via a distribution mechanism.

DNS filter profiles block by domain category or botnet C&C database; they apply to DNS queries and can log or block with a replacement portal.

Profile consistency: a policy referencing an SSL inspection profile also needs a firewall policy action of accept; profiles cannot be applied to deny policies.

Policy routes are evaluated before the routing table; a policy route match uses incoming interface, source, destination, protocol, and port, and can set gateway, outgoing interface, or a specific next-hop.

Static routes support distance and priority; equal distance/priority routes ECMP across gateways unless set ecmp-max-paths limits it.

OSPF areas: area 0 is the backbone; ABRs connect non-backbone areas to area 0, and virtual links extend area 0 across transit areas.

BGP attributes: local preference is compared before AS-path length; weight is Cisco-proprietary and not used by FortiOS. set bestpath-as-path-ignore alters selection.

Route redistribution requires a route-map or explicit metric/type settings; metrics default to 0 for connected and 10 for static when redistributed into OSPF.

Reverse path forwarding (RPF) check is set per interface; strict mode drops packets whose return path differs from the incoming interface.

SD-WAN rules select members by SLA probes (latency, jitter, packet loss) and can override routing for specific traffic; diagnose sys sdwan health-check shows probe results.

get router info routing-table all shows the full RIB; diagnose ip route list shows the kernel/FIB view.

VDOMs partition the configuration and forwarding tables; interfaces, firewall policies, routing, and most security profiles are per-VDOM.

Global settings (admin accounts, HA, some system settings) are shared unless set vdom scoping is applied; global objects can be referenced by VDOMs only if set global-object 1 is enabled.

Inter-VDOM links are virtual interfaces that route traffic between VDOMs; each side is a separate interface in its VDOM and needs a policy to permit traffic.

A VDOM in NAT mode routes; a VDOM in transparent mode bridges and requires its interfaces to have no IP addresses.

VDOM resource limits (max sessions, max policies, max routes) are set per VDOM with config vdom and set ... under config system vdom-property.

diagnose sys vd list shows VDOM IDs and session counts; diagnose sys session filter vd <id> filters sessions by VDOM.

Deleting a VDOM requires removing references (policies, routes, interfaces) first; diagnose sys vd errors list remaining dependencies.

FGCP HA modes: active-passive (one primary, one or more secondaries) and active-active (all members forward, sessions may be asymmetric).

HA heartbeat and session sync use dedicated HA interfaces or the management interface; heartbeat interval and ha-uptime/hb-interval/hb-lost-threshold control failover timing.

HA override: when enabled, the unit with the highest priority always becomes primary; when disabled, a rebooted former primary does not preempt.

Session synchronization is enabled per VDOM with config system ha and set session-pickup enable; asymmetric traffic requires set session-pickup-connectionless enable.

HA monitor interfaces: a monitored interface failure reduces the unit's priority by ha-priority (default 1) and can trigger failover if the priority delta exceeds the peer's.

diagnose sys ha status shows role, priority, and monitored interfaces; diagnose sys ha checksum show compares config checksums across members.

Firmware upgrades in HA: upgrade secondaries first, then the primary; execute ha manage <index> opens a console to a peer unit.

Split-brain: if heartbeat fails but both units are up, both may become primary; verify HA link connectivity and ha-uptime before assuming failover completed.

diagnose debug flow traces packet processing: set filters with diagnose debug flow filter, then diagnose debug flow trace start <count>; diagnose debug enable activates output.

diagnose sniffer packet <interface> '<filter>' <verbose> <count> captures packets; verbose level 4 shows interface names and level 6 shows full headers with hex.

diagnose sys session list shows session table entries; use diagnose sys session filter to narrow by source, destination, port, or VDOM before listing.

get system performance status reports CPU, memory, and session counts; diagnose hardware sysinfo memory and diagnose sys top show per-process resource use.

diagnose debug application <daemon> -1 enables debug for a specific daemon (e.g., authd, httpsd); always disable with -1 off and diagnose debug disable after.

execute log filter and execute log display browse logs from CLI; diagnose sys logdisk usage shows log disk consumption.

diagnose netlink interface list and diagnose ip address list verify interface and IP state; get system interface physical shows link status.

diagnose sys ha checksum mismatches identify config drift between HA members; diagnose debug crashlog read shows recent crashes.