Fortinet FCX cheat sheet

FortiOS is the single operating system underlying FortiGate NGFW, FortiSwitch, FortiAP, and FortiExtender management; Fabric telemetry flows over the FortiTelemetry protocol on TCP 8013 by default.

Security Fabric roles: root FortiGate aggregates downstream FortiGate devices as fabric clients; downstream devices report to the upstream root, and only the root holds the full topology view.

Fabric connectors include FortiManager, FortiAnalyzer, FortiSandbox, FortiClient EMS, FortiWeb, FortiMail, and FortiNAC; each is added as a Fabric device and requires authorization on both sides.

FortiGate VDOMs partition configuration and routing; inter-VDOM links (IVL) move traffic between VDOMs, and management VDOM selection determines which VDOM holds admin interfaces.

HA: FGCP supports active-passive and active-active; session pickup and session synchronization preserve TCP state on failover, and HA override controls whether a higher-priority unit reclaims primary role.

Configuration hierarchy: global settings vs VDOM settings; most firewall policies, routing, and VPN are per-VDOM, while HA and admin accounts can be global.

FortiGate NP/CP acceleration offloads sessions to network and content processors; accelerated sessions bypass some UTM inspection unless proxy-based or flow-based inspection is configured to force full scanning.

Firmware upgrade path must follow Fortinet's supported upgrade matrix; skipping intermediate versions is unsupported and can corrupt configuration.

FortiGate SD-WAN uses SD-WAN zones containing member interfaces; performance SLAs are defined per member with latency, jitter, and packet-loss thresholds, and rules select members by best quality, lowest cost, or manual order.

SD-WAN rules are evaluated before static routes; a matching rule steers traffic to a member, and implicit rules handle traffic not matched by explicit rules.

NGFW inspection modes: flow-based inspection streams packets through a single pass with pattern matching; proxy-based inspection buffers traffic and supports full content reconstruction and advanced features.

Security profiles include IPS, antivirus, web filter, application control, DNS filter, SSL inspection, and DLP; profile order and SSL inspection depth determine what encrypted traffic can be inspected.

FortiSwitch can be managed by FortiGate (FortiLink, default VLAN 4094) or standalone; FortiLink auto-discovers switches and pushes VLANs and policies from the FortiGate.

FortiAP managed by FortiGate uses CAPWAP control and data; tunnel mode sends client traffic to the FortiGate, bridge mode switches locally at the AP.

Wireless security: WPA3-Personal uses SAE, WPA3-Enterprise uses 802.1X with 192-bit mode option; WPA2/WPA3 transition mode allows mixed clients.

Policy routing and SD-WAN can coexist; policy routes are evaluated before SD-WAN rules, so overlapping criteria change which path traffic takes.

FortiSASE converges cloud-delivered SWG, CASB, ZTNA, and firewall-as-a-service; FortiClient or agentless proxy connects endpoints to the nearest SASE point of presence.

ZTNA in FortiOS uses access proxy policies with server certificates; application access is granted per user or group rather than by network subnet, replacing traditional remote-access VPN exposure.

FortiClient EMS provides endpoint telemetry and compliance tags; ZTNA and SASE policies can require device compliance or on-net/off-net status as a condition.

IPsec and SSL VPN remain supported remote-access options; SSL VPN web mode and tunnel mode differ in client requirements, and MFA can be enforced per user group.

SASE traffic steering uses FortiClient with always-on or on-demand connection, split tunneling, and destination-based exemptions; destructive full-tunnel modes increase latency if PoPs are distant.

CASB controls SaaS usage via inline or API-based inspection; inline CASB sees traffic through the SASE PoP, while API mode queries the SaaS provider for retroactive visibility.

Authentication integrates with SAML IdPs, RADIUS, LDAP, and FortiToken; single sign-on to SASE relies on the IdP assertion and group mapping.

ZTNA access proxy rules can include posture checks, geo restrictions, and time-based schedules; a failed check denies before any application handshake occurs.

FortiGate-VM is available on major public clouds with bring-your-own-license and pay-as-you-go models; instance sizing must match throughput and inspection needs, since license tiers cap throughput.

Cloud-native firewall policies on AWS, Azure, and GCP integrate with cloud route tables and VPC/VNet peering; traffic inspection requires routing subnets through the firewall's interfaces.

FortiCNP and FortiCNAPP provide cloud security posture management: they collect configuration data via read-only roles or agents and report misconfigurations against benchmarks such as CIS.

FortiCASB protects SaaS applications using API connectors with OAuth grants; it monitors activity, detects anomalies, and can apply DLP to cloud-stored data.

Cloud SD-WAN and transit gateways connect branch and VPC networks; hub-and-spoke and full-mesh topologies differ in cost and inspection chokepoints.

Infrastructure-as-code deployment uses Terraform or CloudFormation templates; autoscaling groups with FortiGate-VM require license and configuration synchronization across instances.

Cloud workload protection uses agents or agentless snapshots; container and Kubernetes security requires image scanning and runtime policy enforcement.

Identity and access in cloud: least-privilege service accounts, role-based access control, and short-lived credentials reduce blast radius if a connector is compromised.

FortiAnalyzer collects logs from FortiGate and Fabric devices, builds events from log parsing, and correlates them into incidents; FortiSIEM adds broader multi-vendor log and CMDB correlation.

FortiSOAR automates playbooks triggered by incidents; connectors integrate ticketing, threat intelligence, and enforcement tools, and playbooks can execute manual or automatic approval steps.

FortiEDR uses kernel-level event capture, behavioral detection, and automated response such as process termination, file quarantine, and network isolation.

FortiNDR analyzes network traffic and files for malicious behavior; it can be integrated with FortiGate and FortiEDR for detection and containment.

Detection tuning uses thresholds, suppressions, and log filters; excessive false positives usually trace to untuned anomaly rules or missing asset context.

Incident workflow stages: detection, triage, investigation, containment, eradication, recovery, and lessons learned; SOAR playbooks map actions to each stage.

Threat intelligence feeds enrich indicators; FortiGuard services provide signatures and ratings, while third-party feeds are ingested via connectors and must be normalized.

Key SOC metrics include mean time to detect and mean time to respond; they are computed from incident timestamps, not from raw alert counts.

OT networks use Purdue model levels: Level 0 physical process, Level 1 controllers, Level 2 supervisory, Level 3 operations, Level 3.5 DMZ, and Levels 4-5 enterprise/IT.

OT protocols such as Modbus, DNP3, PROFINET, and OPC are often unauthenticated and sensitive to latency; active scanning can disrupt controllers, so passive monitoring is preferred.

FortiGate Rugged and FortiSwitch Rugged series are designed for industrial environments with extended temperature ranges and DIN-rail mounting.

OT segmentation uses zones and conduits per IEC 62443; the industrial DMZ terminates IT-OT traffic and brokers data flows instead of allowing direct paths.

FortiGate can inspect OT protocols with dedicated IPS signatures and enforce read-only access to controllers from IT-side users.

Asset discovery in OT uses passive traffic analysis or vendor-safe queries; FortiNAC can profile OT devices but must be configured to avoid aggressive probing.

Patch management in OT is constrained by uptime; compensating controls include virtual patching via IPS, strict allowlisting, and network segmentation.

Incident response in OT prioritizes safety and process continuity; containment actions must be coordinated with plant operations before isolating controllers.

FortiOS is the single operating system underlying FortiGate NGFW, FortiSwitch, FortiAP, and FortiExtender management; Fabric telemetry flows over the FortiTelemetry protocol on TCP 8013 by default.

Security Fabric roles: root FortiGate aggregates downstream FortiGate devices as fabric clients; downstream devices report to the upstream root, and only the root holds the full topology view.

Fabric connectors include FortiManager, FortiAnalyzer, FortiSandbox, FortiClient EMS, FortiWeb, FortiMail, and FortiNAC; each is added as a Fabric device and requires authorization on both sides.

FortiGate VDOMs partition configuration and routing; inter-VDOM links (IVL) move traffic between VDOMs, and management VDOM selection determines which VDOM holds admin interfaces.

HA: FGCP supports active-passive and active-active; session pickup and session synchronization preserve TCP state on failover, and HA override controls whether a higher-priority unit reclaims primary role.

Configuration hierarchy: global settings vs VDOM settings; most firewall policies, routing, and VPN are per-VDOM, while HA and admin accounts can be global.

FortiGate NP/CP acceleration offloads sessions to network and content processors; accelerated sessions bypass some UTM inspection unless proxy-based or flow-based inspection is configured to force full scanning.

Firmware upgrade path must follow Fortinet's supported upgrade matrix; skipping intermediate versions is unsupported and can corrupt configuration.

FortiGate SD-WAN uses SD-WAN zones containing member interfaces; performance SLAs are defined per member with latency, jitter, and packet-loss thresholds, and rules select members by best quality, lowest cost, or manual order.

SD-WAN rules are evaluated before static routes; a matching rule steers traffic to a member, and implicit rules handle traffic not matched by explicit rules.

NGFW inspection modes: flow-based inspection streams packets through a single pass with pattern matching; proxy-based inspection buffers traffic and supports full content reconstruction and advanced features.

Security profiles include IPS, antivirus, web filter, application control, DNS filter, SSL inspection, and DLP; profile order and SSL inspection depth determine what encrypted traffic can be inspected.

FortiSwitch can be managed by FortiGate (FortiLink, default VLAN 4094) or standalone; FortiLink auto-discovers switches and pushes VLANs and policies from the FortiGate.

FortiAP managed by FortiGate uses CAPWAP control and data; tunnel mode sends client traffic to the FortiGate, bridge mode switches locally at the AP.

Wireless security: WPA3-Personal uses SAE, WPA3-Enterprise uses 802.1X with 192-bit mode option; WPA2/WPA3 transition mode allows mixed clients.

Policy routing and SD-WAN can coexist; policy routes are evaluated before SD-WAN rules, so overlapping criteria change which path traffic takes.

FortiSASE converges cloud-delivered SWG, CASB, ZTNA, and firewall-as-a-service; FortiClient or agentless proxy connects endpoints to the nearest SASE point of presence.

ZTNA in FortiOS uses access proxy policies with server certificates; application access is granted per user or group rather than by network subnet, replacing traditional remote-access VPN exposure.

FortiClient EMS provides endpoint telemetry and compliance tags; ZTNA and SASE policies can require device compliance or on-net/off-net status as a condition.

IPsec and SSL VPN remain supported remote-access options; SSL VPN web mode and tunnel mode differ in client requirements, and MFA can be enforced per user group.

SASE traffic steering uses FortiClient with always-on or on-demand connection, split tunneling, and destination-based exemptions; destructive full-tunnel modes increase latency if PoPs are distant.

CASB controls SaaS usage via inline or API-based inspection; inline CASB sees traffic through the SASE PoP, while API mode queries the SaaS provider for retroactive visibility.

Authentication integrates with SAML IdPs, RADIUS, LDAP, and FortiToken; single sign-on to SASE relies on the IdP assertion and group mapping.

ZTNA access proxy rules can include posture checks, geo restrictions, and time-based schedules; a failed check denies before any application handshake occurs.

FortiGate-VM is available on major public clouds with bring-your-own-license and pay-as-you-go models; instance sizing must match throughput and inspection needs, since license tiers cap throughput.

Cloud-native firewall policies on AWS, Azure, and GCP integrate with cloud route tables and VPC/VNet peering; traffic inspection requires routing subnets through the firewall's interfaces.

FortiCNP and FortiCNAPP provide cloud security posture management: they collect configuration data via read-only roles or agents and report misconfigurations against benchmarks such as CIS.

FortiCASB protects SaaS applications using API connectors with OAuth grants; it monitors activity, detects anomalies, and can apply DLP to cloud-stored data.

Cloud SD-WAN and transit gateways connect branch and VPC networks; hub-and-spoke and full-mesh topologies differ in cost and inspection chokepoints.

Infrastructure-as-code deployment uses Terraform or CloudFormation templates; autoscaling groups with FortiGate-VM require license and configuration synchronization across instances.

Cloud workload protection uses agents or agentless snapshots; container and Kubernetes security requires image scanning and runtime policy enforcement.

Identity and access in cloud: least-privilege service accounts, role-based access control, and short-lived credentials reduce blast radius if a connector is compromised.

FortiAnalyzer collects logs from FortiGate and Fabric devices, builds events from log parsing, and correlates them into incidents; FortiSIEM adds broader multi-vendor log and CMDB correlation.

FortiSOAR automates playbooks triggered by incidents; connectors integrate ticketing, threat intelligence, and enforcement tools, and playbooks can execute manual or automatic approval steps.

FortiEDR uses kernel-level event capture, behavioral detection, and automated response such as process termination, file quarantine, and network isolation.

FortiNDR analyzes network traffic and files for malicious behavior; it can be integrated with FortiGate and FortiEDR for detection and containment.

Detection tuning uses thresholds, suppressions, and log filters; excessive false positives usually trace to untuned anomaly rules or missing asset context.

Incident workflow stages: detection, triage, investigation, containment, eradication, recovery, and lessons learned; SOAR playbooks map actions to each stage.

Threat intelligence feeds enrich indicators; FortiGuard services provide signatures and ratings, while third-party feeds are ingested via connectors and must be normalized.

Key SOC metrics include mean time to detect and mean time to respond; they are computed from incident timestamps, not from raw alert counts.

OT networks use Purdue model levels: Level 0 physical process, Level 1 controllers, Level 2 supervisory, Level 3 operations, Level 3.5 DMZ, and Levels 4-5 enterprise/IT.

OT protocols such as Modbus, DNP3, PROFINET, and OPC are often unauthenticated and sensitive to latency; active scanning can disrupt controllers, so passive monitoring is preferred.

FortiGate Rugged and FortiSwitch Rugged series are designed for industrial environments with extended temperature ranges and DIN-rail mounting.

OT segmentation uses zones and conduits per IEC 62443; the industrial DMZ terminates IT-OT traffic and brokers data flows instead of allowing direct paths.

FortiGate can inspect OT protocols with dedicated IPS signatures and enforce read-only access to controllers from IT-side users.

Asset discovery in OT uses passive traffic analysis or vendor-safe queries; FortiNAC can profile OT devices but must be configured to avoid aggressive probing.

Patch management in OT is constrained by uptime; compensating controls include virtual patching via IPS, strict allowlisting, and network segmentation.

Incident response in OT prioritizes safety and process continuity; containment actions must be coordinated with plant operations before isolating controllers.

FortiOS is the single operating system underlying FortiGate NGFW, FortiSwitch, FortiAP, and FortiExtender management; Fabric telemetry flows over the FortiTelemetry protocol on TCP 8013 by default.

Security Fabric roles: root FortiGate aggregates downstream FortiGate devices as fabric clients; downstream devices report to the upstream root, and only the root holds the full topology view.

Fabric connectors include FortiManager, FortiAnalyzer, FortiSandbox, FortiClient EMS, FortiWeb, FortiMail, and FortiNAC; each is added as a Fabric device and requires authorization on both sides.

FortiGate VDOMs partition configuration and routing; inter-VDOM links (IVL) move traffic between VDOMs, and management VDOM selection determines which VDOM holds admin interfaces.

HA: FGCP supports active-passive and active-active; session pickup and session synchronization preserve TCP state on failover, and HA override controls whether a higher-priority unit reclaims primary role.

Configuration hierarchy: global settings vs VDOM settings; most firewall policies, routing, and VPN are per-VDOM, while HA and admin accounts can be global.

FortiGate NP/CP acceleration offloads sessions to network and content processors; accelerated sessions bypass some UTM inspection unless proxy-based or flow-based inspection is configured to force full scanning.

Firmware upgrade path must follow Fortinet's supported upgrade matrix; skipping intermediate versions is unsupported and can corrupt configuration.

FortiGate SD-WAN uses SD-WAN zones containing member interfaces; performance SLAs are defined per member with latency, jitter, and packet-loss thresholds, and rules select members by best quality, lowest cost, or manual order.

SD-WAN rules are evaluated before static routes; a matching rule steers traffic to a member, and implicit rules handle traffic not matched by explicit rules.

NGFW inspection modes: flow-based inspection streams packets through a single pass with pattern matching; proxy-based inspection buffers traffic and supports full content reconstruction and advanced features.

Security profiles include IPS, antivirus, web filter, application control, DNS filter, SSL inspection, and DLP; profile order and SSL inspection depth determine what encrypted traffic can be inspected.

FortiSwitch can be managed by FortiGate (FortiLink, default VLAN 4094) or standalone; FortiLink auto-discovers switches and pushes VLANs and policies from the FortiGate.

FortiAP managed by FortiGate uses CAPWAP control and data; tunnel mode sends client traffic to the FortiGate, bridge mode switches locally at the AP.

Wireless security: WPA3-Personal uses SAE, WPA3-Enterprise uses 802.1X with 192-bit mode option; WPA2/WPA3 transition mode allows mixed clients.

Policy routing and SD-WAN can coexist; policy routes are evaluated before SD-WAN rules, so overlapping criteria change which path traffic takes.

FortiSASE converges cloud-delivered SWG, CASB, ZTNA, and firewall-as-a-service; FortiClient or agentless proxy connects endpoints to the nearest SASE point of presence.

ZTNA in FortiOS uses access proxy policies with server certificates; application access is granted per user or group rather than by network subnet, replacing traditional remote-access VPN exposure.

FortiClient EMS provides endpoint telemetry and compliance tags; ZTNA and SASE policies can require device compliance or on-net/off-net status as a condition.

IPsec and SSL VPN remain supported remote-access options; SSL VPN web mode and tunnel mode differ in client requirements, and MFA can be enforced per user group.

SASE traffic steering uses FortiClient with always-on or on-demand connection, split tunneling, and destination-based exemptions; destructive full-tunnel modes increase latency if PoPs are distant.

CASB controls SaaS usage via inline or API-based inspection; inline CASB sees traffic through the SASE PoP, while API mode queries the SaaS provider for retroactive visibility.

Authentication integrates with SAML IdPs, RADIUS, LDAP, and FortiToken; single sign-on to SASE relies on the IdP assertion and group mapping.

ZTNA access proxy rules can include posture checks, geo restrictions, and time-based schedules; a failed check denies before any application handshake occurs.

FortiGate-VM is available on major public clouds with bring-your-own-license and pay-as-you-go models; instance sizing must match throughput and inspection needs, since license tiers cap throughput.

Cloud-native firewall policies on AWS, Azure, and GCP integrate with cloud route tables and VPC/VNet peering; traffic inspection requires routing subnets through the firewall's interfaces.

FortiCNP and FortiCNAPP provide cloud security posture management: they collect configuration data via read-only roles or agents and report misconfigurations against benchmarks such as CIS.

FortiCASB protects SaaS applications using API connectors with OAuth grants; it monitors activity, detects anomalies, and can apply DLP to cloud-stored data.

Cloud SD-WAN and transit gateways connect branch and VPC networks; hub-and-spoke and full-mesh topologies differ in cost and inspection chokepoints.

Infrastructure-as-code deployment uses Terraform or CloudFormation templates; autoscaling groups with FortiGate-VM require license and configuration synchronization across instances.

Cloud workload protection uses agents or agentless snapshots; container and Kubernetes security requires image scanning and runtime policy enforcement.

Identity and access in cloud: least-privilege service accounts, role-based access control, and short-lived credentials reduce blast radius if a connector is compromised.

FortiAnalyzer collects logs from FortiGate and Fabric devices, builds events from log parsing, and correlates them into incidents; FortiSIEM adds broader multi-vendor log and CMDB correlation.

FortiSOAR automates playbooks triggered by incidents; connectors integrate ticketing, threat intelligence, and enforcement tools, and playbooks can execute manual or automatic approval steps.

FortiEDR uses kernel-level event capture, behavioral detection, and automated response such as process termination, file quarantine, and network isolation.

FortiNDR analyzes network traffic and files for malicious behavior; it can be integrated with FortiGate and FortiEDR for detection and containment.

Detection tuning uses thresholds, suppressions, and log filters; excessive false positives usually trace to untuned anomaly rules or missing asset context.

Incident workflow stages: detection, triage, investigation, containment, eradication, recovery, and lessons learned; SOAR playbooks map actions to each stage.

Threat intelligence feeds enrich indicators; FortiGuard services provide signatures and ratings, while third-party feeds are ingested via connectors and must be normalized.

Key SOC metrics include mean time to detect and mean time to respond; they are computed from incident timestamps, not from raw alert counts.

OT networks use Purdue model levels: Level 0 physical process, Level 1 controllers, Level 2 supervisory, Level 3 operations, Level 3.5 DMZ, and Levels 4-5 enterprise/IT.

OT protocols such as Modbus, DNP3, PROFINET, and OPC are often unauthenticated and sensitive to latency; active scanning can disrupt controllers, so passive monitoring is preferred.

FortiGate Rugged and FortiSwitch Rugged series are designed for industrial environments with extended temperature ranges and DIN-rail mounting.

OT segmentation uses zones and conduits per IEC 62443; the industrial DMZ terminates IT-OT traffic and brokers data flows instead of allowing direct paths.

FortiGate can inspect OT protocols with dedicated IPS signatures and enforce read-only access to controllers from IT-side users.

Asset discovery in OT uses passive traffic analysis or vendor-safe queries; FortiNAC can profile OT devices but must be configured to avoid aggressive probing.

Patch management in OT is constrained by uptime; compensating controls include virtual patching via IPS, strict allowlisting, and network segmentation.

Incident response in OT prioritizes safety and process continuity; containment actions must be coordinated with plant operations before isolating controllers.

FortiOS is the single operating system underlying FortiGate NGFW, FortiSwitch, FortiAP, and FortiExtender management; Fabric telemetry flows over the FortiTelemetry protocol on TCP 8013 by default.

Security Fabric roles: root FortiGate aggregates downstream FortiGate devices as fabric clients; downstream devices report to the upstream root, and only the root holds the full topology view.

Fabric connectors include FortiManager, FortiAnalyzer, FortiSandbox, FortiClient EMS, FortiWeb, FortiMail, and FortiNAC; each is added as a Fabric device and requires authorization on both sides.

FortiGate VDOMs partition configuration and routing; inter-VDOM links (IVL) move traffic between VDOMs, and management VDOM selection determines which VDOM holds admin interfaces.

HA: FGCP supports active-passive and active-active; session pickup and session synchronization preserve TCP state on failover, and HA override controls whether a higher-priority unit reclaims primary role.

Configuration hierarchy: global settings vs VDOM settings; most firewall policies, routing, and VPN are per-VDOM, while HA and admin accounts can be global.

FortiGate NP/CP acceleration offloads sessions to network and content processors; accelerated sessions bypass some UTM inspection unless proxy-based or flow-based inspection is configured to force full scanning.

Firmware upgrade path must follow Fortinet's supported upgrade matrix; skipping intermediate versions is unsupported and can corrupt configuration.

FortiGate SD-WAN uses SD-WAN zones containing member interfaces; performance SLAs are defined per member with latency, jitter, and packet-loss thresholds, and rules select members by best quality, lowest cost, or manual order.

SD-WAN rules are evaluated before static routes; a matching rule steers traffic to a member, and implicit rules handle traffic not matched by explicit rules.

NGFW inspection modes: flow-based inspection streams packets through a single pass with pattern matching; proxy-based inspection buffers traffic and supports full content reconstruction and advanced features.

Security profiles include IPS, antivirus, web filter, application control, DNS filter, SSL inspection, and DLP; profile order and SSL inspection depth determine what encrypted traffic can be inspected.

FortiSwitch can be managed by FortiGate (FortiLink, default VLAN 4094) or standalone; FortiLink auto-discovers switches and pushes VLANs and policies from the FortiGate.

FortiAP managed by FortiGate uses CAPWAP control and data; tunnel mode sends client traffic to the FortiGate, bridge mode switches locally at the AP.

Wireless security: WPA3-Personal uses SAE, WPA3-Enterprise uses 802.1X with 192-bit mode option; WPA2/WPA3 transition mode allows mixed clients.

Policy routing and SD-WAN can coexist; policy routes are evaluated before SD-WAN rules, so overlapping criteria change which path traffic takes.

FortiSASE converges cloud-delivered SWG, CASB, ZTNA, and firewall-as-a-service; FortiClient or agentless proxy connects endpoints to the nearest SASE point of presence.

ZTNA in FortiOS uses access proxy policies with server certificates; application access is granted per user or group rather than by network subnet, replacing traditional remote-access VPN exposure.

FortiClient EMS provides endpoint telemetry and compliance tags; ZTNA and SASE policies can require device compliance or on-net/off-net status as a condition.

IPsec and SSL VPN remain supported remote-access options; SSL VPN web mode and tunnel mode differ in client requirements, and MFA can be enforced per user group.

SASE traffic steering uses FortiClient with always-on or on-demand connection, split tunneling, and destination-based exemptions; destructive full-tunnel modes increase latency if PoPs are distant.

CASB controls SaaS usage via inline or API-based inspection; inline CASB sees traffic through the SASE PoP, while API mode queries the SaaS provider for retroactive visibility.

Authentication integrates with SAML IdPs, RADIUS, LDAP, and FortiToken; single sign-on to SASE relies on the IdP assertion and group mapping.

ZTNA access proxy rules can include posture checks, geo restrictions, and time-based schedules; a failed check denies before any application handshake occurs.

FortiGate-VM is available on major public clouds with bring-your-own-license and pay-as-you-go models; instance sizing must match throughput and inspection needs, since license tiers cap throughput.

Cloud-native firewall policies on AWS, Azure, and GCP integrate with cloud route tables and VPC/VNet peering; traffic inspection requires routing subnets through the firewall's interfaces.

FortiCNP and FortiCNAPP provide cloud security posture management: they collect configuration data via read-only roles or agents and report misconfigurations against benchmarks such as CIS.

FortiCASB protects SaaS applications using API connectors with OAuth grants; it monitors activity, detects anomalies, and can apply DLP to cloud-stored data.

Cloud SD-WAN and transit gateways connect branch and VPC networks; hub-and-spoke and full-mesh topologies differ in cost and inspection chokepoints.

Infrastructure-as-code deployment uses Terraform or CloudFormation templates; autoscaling groups with FortiGate-VM require license and configuration synchronization across instances.

Cloud workload protection uses agents or agentless snapshots; container and Kubernetes security requires image scanning and runtime policy enforcement.

Identity and access in cloud: least-privilege service accounts, role-based access control, and short-lived credentials reduce blast radius if a connector is compromised.

FortiAnalyzer collects logs from FortiGate and Fabric devices, builds events from log parsing, and correlates them into incidents; FortiSIEM adds broader multi-vendor log and CMDB correlation.

FortiSOAR automates playbooks triggered by incidents; connectors integrate ticketing, threat intelligence, and enforcement tools, and playbooks can execute manual or automatic approval steps.

FortiEDR uses kernel-level event capture, behavioral detection, and automated response such as process termination, file quarantine, and network isolation.

FortiNDR analyzes network traffic and files for malicious behavior; it can be integrated with FortiGate and FortiEDR for detection and containment.

Detection tuning uses thresholds, suppressions, and log filters; excessive false positives usually trace to untuned anomaly rules or missing asset context.

Incident workflow stages: detection, triage, investigation, containment, eradication, recovery, and lessons learned; SOAR playbooks map actions to each stage.

Threat intelligence feeds enrich indicators; FortiGuard services provide signatures and ratings, while third-party feeds are ingested via connectors and must be normalized.

Key SOC metrics include mean time to detect and mean time to respond; they are computed from incident timestamps, not from raw alert counts.

OT networks use Purdue model levels: Level 0 physical process, Level 1 controllers, Level 2 supervisory, Level 3 operations, Level 3.5 DMZ, and Levels 4-5 enterprise/IT.

OT protocols such as Modbus, DNP3, PROFINET, and OPC are often unauthenticated and sensitive to latency; active scanning can disrupt controllers, so passive monitoring is preferred.

FortiGate Rugged and FortiSwitch Rugged series are designed for industrial environments with extended temperature ranges and DIN-rail mounting.

OT segmentation uses zones and conduits per IEC 62443; the industrial DMZ terminates IT-OT traffic and brokers data flows instead of allowing direct paths.

FortiGate can inspect OT protocols with dedicated IPS signatures and enforce read-only access to controllers from IT-side users.

Asset discovery in OT uses passive traffic analysis or vendor-safe queries; FortiNAC can profile OT devices but must be configured to avoid aggressive probing.

Patch management in OT is constrained by uptime; compensating controls include virtual patching via IPS, strict allowlisting, and network segmentation.

Incident response in OT prioritizes safety and process continuity; containment actions must be coordinated with plant operations before isolating controllers.