Fortinet FCSS NST cheat sheet

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.

Security Fabric is a topology of FortiGate, FortiSwitch, FortiAP, FortiManager, FortiAnalyzer, and FortiClient joined by fabric connectors; FortiGate acts as the fabric root and shares device telemetry with FortiAnalyzer for a single-pane view.

FortiGate VDOMs partition one physical appliance into independent virtual firewalls, each with its own interfaces, routing table, policies, and admin accounts; inter-VDOM links (IVL) are required for traffic to pass between VDOMs because no implicit route exists.

Interface modes: NAT mode supports routing, policies, and VIPs; transparent mode forwards at Layer 2 and can only be used on interface pairs, and it cannot terminate IPsec or run most UTM profiles that need a routed IP.

Zone-based design groups interfaces of the same security posture (for example all WAN links) so one policy covers many interfaces; intra-zone traffic is blocked by default unless intra-zone-deny is disabled on the zone.

Policy order is first-match: FortiOS evaluates policies top-down and stops at the first match, so specific deny rules must sit above broad permit rules; implicit deny drops all unmatched traffic and logs it only if logging is enabled on the implicit rule.

The FortiGate security profile set includes antivirus, IPS, web filter, application control, DNS filter, email filter, SSL/SSH inspection, DLP, file filter, and VoIP; profiles attach to a firewall policy and apply only to accepted traffic, so a deny policy never inspects.

FortiGuard subscription services (AV, IPS, web filter, App Control, DNS, outbreak prevention) require valid licenses and FortiGuard connectivity; without a license the engine may still run but signatures stop updating, so verify license status before assuming detection coverage.

HA sizing rule: in active-passive, throughput equals a single unit; in active-active, per-session throughput can scale but sessions are not load-balanced per packet, and UTM inspection may pin sessions to one unit, so plan capacity against the slower path.

Static routes use distance (default 10) as the tiebreaker among routes to the same destination; lower distance wins, and equal distance with equal priority creates ECMP if the routes have the same distance and priority values.

Policy routes override the routing table for matching traffic: they match on incoming interface, source, destination, protocol, and port, and take effect before destination-based lookup; the action can be forward to a gateway, interface, or a specific next-hop.

Administrative distance reference: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200, and floating static routes are made by raising distance above the dynamic protocol's value.

OSPF on FortiGate requires matching area, hello/dead timers, and MTU on neighbors; the FortiGate can act as ABR with multiple areas and supports authentication (MD5/SHA) per interface, and virtual links are configured under the OSPF area.

Interface configuration essentials: an interface must have an IP and be administratively up, and the allowaccess list must include the relevant protocol (ping, https, ssh) or management traffic is dropped even when the address is correct.

SD-WAN members are selected by a rule matching source/destination and a strategy (manual, best quality, lowest cost, maximize bandwidth); health checks (SLA probes) determine member eligibility, and a member failing its SLA is removed from selection.

The session table (diagnose sys session list) is the authoritative view of live flows; policy and route changes do not affect existing sessions unless the session is cleared, so flushes are required after some routing changes.

NAT behavior: SNAT via policy NAT or central NAT changes the source, DNAT via VIP or central DNAT changes destination before route lookup; with central NAT enabled, policy-level NAT settings are ignored and central rules apply.

Flow-based inspection streams traffic through the IPS engine with limited buffering and is the default for most policies; proxy-based inspection buffers and reassembles content, enabling full file scanning and features such as content disarm and reconstruction.

SSL inspection modes: certificate inspection reads SNI and the server certificate without decryption; deep inspection (full) terminates TLS with a FortiGate CA-signed certificate and can break pinned applications unless exempted.

SSL exemptions and deep-inspection bypass lists must include trusted categories and pinned apps; otherwise users see certificate errors, and the FortiGate CA certificate must be distributed to clients for deep inspection to work without warnings.

Antivirus profile options include scan mode (proxy/flow), virus outbreak prevention, and emulator/CPRL; quarantine stores infected files on the FortiGate, and the profile can send files to FortiSandbox for dynamic analysis.

Web filter actions are allow, block, monitor, warning, and authenticate; category and URL filter entries are evaluated in order with the URL filter list taking precedence over category actions on a per-request basis, and override requires an admin or user group.

Application control identifies applications regardless of port, can enforce per-application actions, and supports categories and application groups; it must be paired with SSL deep inspection to see applications inside encrypted sessions.

IPS sensor entries combine signatures, filters (severity, target, protocol), and rate-based anomalies; the sensor action can be pass, block, or reset, and the default action applies to signatures not matched by a specific entry.

DNS filter uses botnet CNAME/domain databases and per-domain actions; it requires the DNS traffic to traverse the FortiGate, so clients using external DNS bypass the profile unless DNS is redirected or DoT/DoH is blocked.

IPsec phase 1 negotiates IKE (main or aggressive mode, IKEv1 or IKEv2), authentication by pre-shared key or certificate, and proposals (encryption, hash, DH group); phase 2 defines the ESP proposals and selectors.

Route-based IPsec uses a tunnel interface (or VTIs) and works with dynamic routing and multiple subnets; policy-based IPsec matches traffic in the policy and requires a matching static route or policy pair in both directions.

Dial-up IPsec servers assign addresses from a pool or DHCP; the client config (phase 1 with mode config) and the server must agree on the pool, and overlapping local/remote subnets break the tunnel.

SSL VPN modes: tunnel mode gives a virtual adapter and full subnet access; web mode proxies specific bookmarks; both require a portal, a firewall policy for ssl.root, and user/group authentication.

Authentication methods: local users, LDAP, RADIUS, TACACS+, and SAML/SSO; two-factor adds FortiToken, email, or SMS OTP, and the order of methods in a user group determines which is tried first.

FSSO integrates with Active Directory collectors; the FortiGate learns logged-in users from the collector and matches them in policies, and workstation IP-to-user mapping must be current or policy matches fail.

HA: FGCP active-passive shares a virtual MAC and virtual IP; the primary owns the IPs, and failover is triggered by heartbeat loss, monitored interface failure, or link monitor. HA heartbeat and session sync must be enabled on dedicated links.

HA override and priority: with override enabled a higher-priority unit can preempt the primary; without override the current primary stays primary, and session pickup is required to keep existing sessions across failover.