FCSS-EFW-AD-7-6: Fortinet NSE 7 - Enterprise Firewall 7.6 AdministratorDemo

FortiGate performs IP integrity header checking during early ingress processing to validate the packet’s protocol-header length. IPsec decryption occurs after this check, and an NP session key is installed only after an eligible session is established for fast-path offloading. Fortinet: Parallel Path Processing

The ISDB is populated from FortiGuard data and defines Internet services using public IP address ranges and service port information. Firewall policies and SD-WAN rules can use those predefined service entries as matching criteria; a firewall policy configured with a deny action blocks traffic that matches the selected service. URL and domain restrictions are web-filtering functions, not ISDB functions, and ISDB matching is not a proxy-mode feature. Fortinet documents ISDB as a FortiGuard-sourced database that combines IP ranges, service port numbers, and related service information.

BGP on loopback interfaces gives each SD-WAN/ADVPN node a stable identifier and lets a spoke establish one iBGP session per hub, which significantly reduces advertised routes and peer complexity. FortiManager recommended IPsec templates standardize scalable tunnel provisioning; after activation, the relevant templates provide an option to enable ADVPN.

Core2 is assigned to virtual cluster 2. HQ-NGFW-2 must have the higher virtual-cluster-2 priority to become the primary unit processing that VDOM’s traffic. Raising its virtual-cluster-2 priority from 120 to 200 makes it higher than HQ-NGFW-1’s priority of 150. With HA uptime tied, the priority value determines the election at that criterion.

BGP MED is changed with a route map that sets the route metric and is applied in the outbound direction to the BGP neighbor. FortiGate uses the neighbor route-map-out parameter to apply that outbound route map to advertised IPv4 routes. Fortinet: BGP multi-exit discriminator

A route reflector client lets a route reflector advertise IBGP-learned routes among its clients, removing the need for every IBGP router to maintain a full mesh of sessions. This reduces the session scaling burden and improves control-plane scalability.

A FortiGate BGP neighbor-range entry defines the IPv4 range from which dynamic peers are accepted and assigns those peers to a BGP neighbor group. The spoke overlay BGP addresses, 172.16.1.2/32 and 172.16.1.3/32, fall within 172.16.1.0/24, and the configured group is advpn. Route-reflector-client is a neighbor-group setting, not a neighbor-range setting.

A URL filter supports multiple URL patterns and can block traffic that matches those patterns. Associating the URL filter with a web filter profile and applying that profile to the firewall policy enforces the website blocks for the policy’s matching subnet traffic.

On-idle Dead Peer Detection checks an IPsec peer when the tunnel is idle, balancing connectivity assurance with resource utilization; it is appropriate for networks with regular traffic intervals. net-device disable shares a single hub interface among dial-up tunnels rather than creating one per tunnel, and add-route is enabled by default unless explicitly disabled.

The latest revision (ID 7) was created by script_manager with Installation = Retrieved. script_manager is not a real administrator – it is the internal FortiManager account used whenever a script triggers a retrieve, so the revision-history/widget view alone cannot reveal who actually launched it (ruling out D, and A which wrongly calls it an FDN API user). To find the responsible administrator the IT team must look in the FortiManager system event logs and filter for script-generated events (type=script), then read the user field, which is C. B invents a specific 'Remote FortiGate Directly via CLI' trigger that the output does not support.

The ClientHello supported_versions extension advertises TLS 1.3 and TLS 1.2. SSL certificate inspection examines TLS-layer headers and certificate-related information, including the hostname information available for controlling website access, so a web-filtering profile can be effective. It does not inspect the encrypted traffic payload, so it cannot effectively perform antivirus content scanning. A SAN is not a prerequisite for applying security profiles.

For an object conflict during policy-package import, FortiManager lets the administrator retain either the FortiGate or FortiManager object value. When the object is already used by other imported FortiGate devices, retaining the FortiManager version prevents the import from overwriting the shared object and adversely affecting those devices.

A Windows ping sent with -f has the IPv4 Do Not Fragment bit set. Its 1400-byte ICMP data payload becomes a 1428-byte IP packet after the 8-byte ICMP and 20-byte IPv4 headers are added, exceeding the FortiGate egress MTU of 1000 bytes. FortiGate drops an oversized packet with DF set rather than fragmenting it. For a 1000-byte IP MTU, the largest ICMP data payload is 972 bytes (1000 − 20 − 8).

The root FortiGate acts as the SAML identity provider and authenticates the administrator credentials. The downstream FortiGate is the service provider and applies its configured default admin profile, which is super_admin_readonly; therefore, successful SSO grants access to the downstream device with those privileges.

FortiGate IPsec Phase 2 uses the route-overlap setting to determine how overlapping routes are handled. Setting it to allow permits overlapping routes to coexist, which is required for ECMP across tunnels to remote sites that use the same subnet. The use-new and use-old values retain only one route.

FortiGate Application Control uses IPS protocol decoders to identify application traffic, including traffic using non-standard ports or protocols. An application-control sensor can be configured with an action to block the identified application traffic.

In Security Fabric SAML SSO, the root FortiGate acts as the identity provider and the downstream FortiGate acts as a service provider. The root authenticates the administrator credentials, but the downstream FortiGate authorizes the SSO administrator using its own configured default administrator profile. With super_admin_readonly selected as that default profile, the user receives super_admin_readonly access. Fortinet: Configuring a downstream FortiGate as an SP

ADVPN 2.0 dynamically builds direct IPsec shortcut tunnels between spokes and uses distributed SD-WAN path management, including local and remote topology and link-health information, to select and reevaluate the optimal connection. This supports direct spoke-to-spoke traffic and automatic use of the best available underlay path.

The two advertisements for the E1 external prefix have equal cost but are reached through different OSPF areas. When rfc1583-compatible is disabled, RFC 2328 external-path preference rules select only the preferred path instead of retaining both equal-cost external paths. Enabling RFC 1583 compatibility permits both equal-cost external routes to be installed for ECMP.

FGSP synchronizes connectionless UDP and ICMP sessions only when session-pickup-connectionless is enabled. With that setting disabled on FortiGate_B, the ICMP sessions generated by ping are not synchronized to its session table.

IKEv2 supports EAP authentication through its EAP payload and can negotiate elliptic-curve Diffie-Hellman groups, including ECP groups. IKEv1 already supports Mode Configuration, and IKEv2 tunnel establishment requires both IKE_SA_INIT and IKE_AUTH request/response exchanges rather than only two messages.

An IPS sensor with DNS exfiltration or DNS-tunneling signatures can detect and block the anomalous DNS-query patterns used to carry encoded data. TLS-carried DNS must be subject to full SSL/SSH inspection so that the IPS engine can inspect the DNS payload; DNS category filtering alone is not a behavioral DNS-exfiltration control.

00:09:0f:09 is the FGCP virtual-MAC prefix for a group ID below 256. The fifth octet, 18 hexadecimal, is group ID 24. In the applicable VMAC encoding, the final octet 81 represents virtual-cluster ID 1 and physical index 1; virtual-cluster ID 1 denotes the second virtual cluster and therefore indicates VDOM-enabled virtual clustering. FGSP is a separate peer session-synchronization mechanism and is not identified by this FGCP VMAC format.

A BGP neighbor-group centralizes the common peer settings shared by the spokes. A neighbor-range matches the spoke address prefix and automatically assigns matching peers to that group, eliminating the need to configure each spoke as a separate BGP neighbor on the hub.