FCSS Enterprise Firewall 7.6 flashcards
FCSS Enterprise Firewall 7.6 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Management VDOM
- On a multi-VDOM FortiGate, the single VDOM whose management interface provides global administrative access; set with `set management-vdom` in the global configuration.
- Config revision rollback
- FortiOS stores numbered configuration revisions locally; `execute revision` lists them and `execute revision restore <n>` reverts to a prior saved configuration.
- Interface administrative access
- Per-interface settings that enable HTTPS, SSH, SNMP, ping, or FMG access; disabling HTTPS on an interface removes GUI reachability through that interface.
- NAT vs transparent VDOM
- A NAT-mode VDOM routes and performs address translation; a transparent VDOM bridges interfaces without IP addresses and applies policies at layer 2.
- Authentication policy order
- Authentication policies are evaluated before firewall policies; a match triggers captive portal or credential challenge, and only authenticated traffic proceeds to policy checks.
- FSSO collector agent
- A server-side agent that polls domain controllers for logon events and reports user-to-IP mappings to the FortiGate for identity-based policy enforcement.
- Firewall auth timeout
- The duration an authenticated user session remains valid; auth-timeout defaults to 480 minutes and idle-timeout to 300 minutes, configurable per policy.
- Captive portal disclaimer
- A portal mode that displays a usage notice and records acceptance without verifying credentials, unlike authentication mode which requires a valid login.
- Flow vs proxy inspection
- Flow-based mode streams packets with lower latency; proxy-based mode buffers and fully inspects content, enabling archive scanning and richer protocol decoding.
- IPS sensor entry
- A rule inside an IPS sensor that matches signatures by severity, target, or specific signature ID and assigns an action such as block, monitor, or reset.
- SSL deep inspection
- Decrypts TLS traffic for inspection using a FortiGate CA certificate; clients must trust that CA or receive it through a distribution mechanism.
- Web filter category action
- Each FortiGuard URL category in a web filter profile can be allowed, blocked, monitored, warned, or set to require authentication.
- DNS filter profile
- A profile that inspects DNS queries and blocks or logs domains by FortiGuard category or botnet C&C database match, with an optional block portal.
- Policy route precedence
- Policy routes are evaluated before the routing table; a match overrides destination-based routing and can set gateway, interface, or next-hop.
- OSPF area 0
- The backbone area of an OSPF domain; all other areas must connect to it directly or through a virtual link across a transit area.
- BGP local preference
- A BGP attribute compared before AS-path length during best-path selection; higher local preference values are preferred within an autonomous system.
- Reverse path forwarding check
- An interface setting that drops packets whose return route does not point back out the receiving interface; strict mode enforces the check.
- SD-WAN SLA health check
- Probes that measure latency, jitter, and packet loss per SD-WAN member; rules select members based on these SLA results.
- Inter-VDOM link
- A virtual interface pair connecting two VDOMs; each side is a separate interface requiring a firewall policy to permit traffic across.
- Global objects in VDOMs
- Objects defined at the global level can be referenced by VDOMs only when global-object is enabled; otherwise each VDOM maintains its own objects.
- VDOM resource limits
- Per-VDOM caps on sessions, policies, routes, and other objects, configured under vdom-property to prevent one VDOM from exhausting shared resources.
- VDOM session filtering
- `diagnose sys session filter vd <id>` restricts session listing or clearing commands to a single VDOM's session table.
- FGCP active-passive
- An HA mode where one unit is primary and forwards all traffic while secondaries stay synchronized and take over if the primary fails.
- HA override
- When enabled, the unit with the highest configured priority always becomes primary; when disabled, a rebooted former primary does not preempt the current one.
- Session pickup
- An HA setting that synchronizes session table entries to peers so established connections survive a failover; connectionless pickup extends this to UDP and ICMP.
- HA monitored interface
- An interface whose failure reduces the unit's HA priority by the configured amount, potentially triggering failover if the delta exceeds the peer's priority.
- HA checksum comparison
- `diagnose sys ha checksum show` compares configuration checksums across HA members to detect configuration drift that could cause inconsistent behavior.
- Debug flow trace
- A filtered packet-processing trace: set filters, start the trace with a count, enable debug, then read each policy and routing decision in the output.
- Sniffer packet verbose level
- In `diagnose sniffer packet`, level 4 adds interface names and level 6 adds full protocol headers with hex payload; level 1 shows headers only.
- Session filter command
- `diagnose sys session filter` narrows session list or clear operations by source, destination, port, protocol, or VDOM before the action is applied.
- Daemon debug level
- `diagnose debug application <daemon> -1` enables verbose output for a specific daemon; disable with the same command and `diagnose debug disable` afterward.
- Crashlog inspection
- `diagnose debug crashlog read` displays recent process crash records, useful for identifying daemons that restarted unexpectedly during an incident.