FCP-FSA-AD-5-0: Fortinet NSE 5 - FortiSandbox 5.0 Administrator

FortiSandbox supports creating custom VMs on appliance-based (device-based) and private-cloud deployments. The feature is not supported on Azure non-nested deployments or FortiSandbox Cloud.

A FortiSandbox API interface accepts API access only through HTTPS; HTTP access is not permitted. Configuring or removing an API port is a CLI-only operation. An API port cannot also be configured as an HA port or an administrative port.

FortiClient can submit files downloaded from email, the internet, removable media, or mapped drives to FortiSandbox, and can block access until the sandbox verdict is returned. This stops malicious payloads as they are delivered to the endpoint, before they can execute, which corresponds to the Delivery stage.

SIMNET substitutes simulated network-service responses when a FortiSandbox VM has no external-network access. It therefore cannot perform antivirus inspection on an actually downloaded file or determine the reputation of the real IP address used for a callback connection. Dynamic behavioral scanning and URL rating remain available. Fortinet documents that SIMNET starts when VM Internet access is unavailable and is not a real Internet connection.

FortiSandbox can expand scan power beyond the local clone limit by purchasing additional VM Clone subscriptions and enabling remote WindowsCloudVM and MACOSX clones. Custom VMs still consume the local clone quota, while scan-priority changes only affect scheduling.