FCSS Enterprise Firewall 7.6 key terms

A dedicated administrative VDOM that separates management traffic from user traffic, allowing administrators to reach the firewall even when other VDOMs are under heavy load or misconfigured.

An independent virtual firewall instance inside a physical FortiGate that has its own interfaces, routing table, firewall policies, and administrators, effectively partitioning one appliance into several logical devices.

A virtual point-to-point interface pair that connects two VDOMs so traffic can be routed or filtered between them without consuming physical ports.

The global setting that enables or disables multi-VDOM support on the device; changing it requires a reboot and resets VDOM-related configuration to defaults.

The configuration layer shared by all VDOMs, holding device-wide settings such as admin accounts, HA parameters, and global firewall objects that can be referenced from any VDOM.

A firewall address, service, or profile defined at the global level so it can be used by policies in multiple VDOMs while being maintained in a single place.

Two or more FortiGates configured to act as a single logical unit that shares session state and configuration, providing device redundancy if a member fails.

The cluster member that actively processes traffic, owns the cluster IP addresses, and synchronizes configuration and session information to the secondary devices.

A standby cluster member that keeps a synchronized copy of configuration and session state and takes over traffic processing if the primary becomes unavailable.

Periodic keepalive messages exchanged over heartbeat interfaces so cluster members can detect whether their peers are still reachable and healthy.

The process by which a secondary device assumes the primary role after the active member stops responding or loses monitored interfaces, minimizing traffic interruption.

An interface linked to an HA virtual cluster whose failure lowers the device's priority, causing a role change so traffic follows the surviving network path.

A numeric value that determines which cluster member becomes primary; the highest value wins, and monitored interface failures can reduce it dynamically.

The continuous replication of configuration changes and connection state from the primary to secondary members so failover preserves existing sessions.

A failure condition where cluster members cannot communicate over heartbeat links and each believes it should be primary, potentially causing duplicate IP conflicts and inconsistent sessions.

FortiGate Clustering Protocol, the native HA implementation that elects a primary by priority and monitored interface status and synchronizes configuration and sessions across members.

A manually configured path that tells the firewall where to send traffic for a destination prefix, including the next-hop gateway or outgoing interface and an optional distance.

A preference value used to rank routes to the same destination; lower values are preferred, and it is used to break ties between routes from different sources.

A rule that overrides the routing table for matching traffic based on criteria such as source address, protocol, or port, forwarding it to a specified gateway or interface.

Equal-cost multipath routing, where multiple routes with the same distance and priority to a destination are installed and traffic is load-balanced across their next hops.

The process of choosing the best path for a packet by comparing longest prefix match, administrative distance, priority, and metric among candidate routes.

A protocol such as OSPF or BGP that automatically learns and advertises routes, adapting to topology changes without manual static route updates.

A logical grouping of OSPF routers that limits link-state flooding; all areas must connect to the backbone area zero, and inter-area routes are summarized at area borders.

A configured peering session between BGP speakers that exchange route updates; it can be internal within one autonomous system or external between different autonomous systems.

A validation that a packet's source address is reachable through the interface it arrived on, dropping spoofed traffic when the check is strict.

An ordered rule that matches traffic by source, destination, service, and schedule, then applies an action such as accept or deny along with security profiles and logging.

A set of inspection settings, such as antivirus, IPS, web filtering, or application control, attached to a policy to scan matching traffic for threats and policy violations.

A consolidated profile that groups several security inspection features so they can be applied together to traffic accepted by a firewall policy.

A configuration object containing signature filters and override actions that determines which intrusion prevention signatures are active and how matching traffic is handled.

A security feature that identifies applications in network traffic regardless of port and enforces actions such as allow, block, or bandwidth limit per application.

The process of decrypting TLS traffic so security profiles can examine it, then re-encrypting it, using certificate inspection or full deep inspection with a trusted CA.

A profile that rates and categorizes websites and applies actions such as block or allow, often combined with safe-search enforcement and content rating overrides.

A policy that identifies which traffic must be authenticated, which authentication methods are permitted, and which user groups are allowed access.

A collection of local or remote user accounts referenced by policies and authentication rules so permissions can be managed for many users at once.

A directory service connector the firewall queries to validate user credentials and retrieve group membership for identity-based policy enforcement.

An external authentication server that receives user credentials or accounting requests from the firewall and returns an accept or reject decision with attributes.

Fortinet Single Sign-On, which learns user logon identity from domain controllers or collector agents so policies can match users without prompting them again.

A web page presented to unauthenticated clients that collects credentials or terms acceptance before granting access through the firewall.

An authentication method requiring a second proof of identity, such as a one-time token or push approval, in addition to a password.

The set of protocols enabled on an interface, such as HTTPS, SSH, or SNMP, that determines how administrators and monitoring systems reach the device.