QuestionQ30

VerifiedSystem Configuration

A FortiGate root VDOM has already been authorized on FortiSandbox, and the FortiGate is configured to send suspicious files to FortiSandbox for inspection.

You then create a new VDOM on the FortiGate and generate traffic so that this new VDOM sends a file to FortiSandbox for the first time.

In this scenario, which action will FortiSandbox take?

Explanation

FortiSandbox tracks authorization on a per-VDOM basis for each FortiGate device, and it only becomes aware of a given VDOM once it receives a file submission from it. The authorization status of the root VDOM does not automatically extend to a newly created VDOM. When the new VDOM submits its first file, FortiSandbox will accept and register the file/VDOM entry, but it will not perform inspection/scanning on files from that VDOM until an administrator manually authorizes the new VDOM under the FortiGate device settings on FortiSandbox (Security Fabric > Device, or Scan Input > Device in older versions).

Learn more

Community Discussion

No comments yet. Be the first to start the discussion!