FCSS-NST-SE-7-6: Fortinet NSE 6 - Network Security 7.6 Support EngineerDemo

An expectation session is a pseudo-session created by a session helper for dynamically negotiated ports. Its expire=23 value is the remaining timeout; if no matching traffic arrives before the expectation expires, FortiGate removes it and closes the dynamic pinhole. The TCP protocol and the dynamic translated port identify this as a pinhole for a protocol that negotiates additional TCP ports. The displayed policy_id is inherited from the parent session and does not show that matching traffic is evaluated against that firewall policy.

For FortiGate sessions, TCP proto_state=01 denotes an established TCP connection. UDP proto_state=01 denotes that a reply has been seen. Each state confirms traffic in both directions.

With equal route distances, the static route with the lower priority is preferred; therefore, changing port1's priority from 5 to 11 makes the port2 route with priority 10 preferred. SNAT sessions normally keep their original outbound interface when the old route remains active. Enabling snat-route-change causes a new route lookup after the routing change and applies new SNAT, allowing the existing session to use port2.

The BGP network statement must exactly match a route in the routing table when network-import-check is enabled. Port3 has the connected route 172.16.54.0/24, not 172.16.0.0/16. Advertising can therefore be enabled either by configuring 172.16.54.0/24 in the BGP network statement or by disabling network-import-check, which allows the configured network to be advertised without a matching IGP route.

Dead Peer Detection uses IKE liveness probes and acknowledgments to verify that the VPN peer remains reachable. If the required acknowledgment is not received, the peer can declare the tunnel dead and delete the IPsec security association. The route deletion shown after the SA deletion is a result of the tunnel going down, not its underlying cause.

A Phase 2 IPsec security association is absent when the proxy ID reports sa=0, which indicates that Phase 2 is down. Zero received and transmitted packet and byte counters (rxp=0, txp=0, rxb=0, and txb=0) indicate that no traffic is currently traversing the tunnel. Fortinet documents diagnose vpn tunnel list as the command used to view IPsec tunnel status and displays the traffic counters and proxy-ID SA state in its output.

A slab cache is kernel-managed memory. The tcp_session entry has 5 objects with an object size of 1500, producing a total of 7500; it is therefore associated with the kernel. FortiOS documents diagnose hardware sysinfo slab as displaying memory-allocation information.

Web filtering relies on FortiGuard URL-rating connectivity, so unstable communication can cause rating timeouts and inconsistent filtering. Conserve mode indicates memory pressure and can affect inspection processing, making it a relevant condition to check for intermittent behavior.

FortiGate uses the configured Common Name Identifier to search for the connecting LDAP user, and the Distinguished Name defines where user account entries are searched. A failed user-DN lookup is resolved by ensuring that the AD account is enabled and that the user supplies the valid credentials for the configured account identifier. AD group membership is evaluated only after the user can be found and authenticated; it cannot correct an unsuccessful user lookup. With sAMAccountName configured as the identifier, the account logon name—not the person’s display name—is the appropriate lookup value. Fortinet: Configuring an LDAP server

ISAKMP main mode is an IKE Phase 1 negotiation. The local device reports that it is the responder receiving the first main-mode message, which means the remote peer is the initiating peer. Both sides list MODP2048 and MODP1536 among their Phase 1 proposals, so the failure is not caused by a Diffie-Hellman group mismatch.

A BGP neighbor whose State/PfxRcd value is numeric is in the Established state; 10.127.0.75 is established but shows 0 received prefixes. This indicates that the session is up while no routes are being advertised to the local FortiGate, consistent with an outbound RIB policy on that neighbor suppressing route advertisements. Fortinet documents that Active indicates a TCP connection was initiated without a response, while OpenSent is beyond TCP establishment.

Port1 and port17 are connected to NP6 device ID 1. NP6 fastpath-offloaded sessions bypass CPU-based packet capture, so disabling fastpath for NP6 ID 1 makes that traffic available to the sniffer. Disabling auto-asic-offload in the firewall policies that carry the traffic likewise keeps those sessions from being ASIC-offloaded, allowing CPU-based inspection.

Auxiliary-session support creates an auxiliary session alongside the main session when a traffic path changes, such as after a routing change. This lets ECMP traffic continue to use hardware acceleration; the main and auxiliary sessions can be offloaded when the policy permits it.

An unavailable or expired FortiGuard Web Filtering subscription can prevent URL categorization and lead to access being denied under the configured default behavior. SSL/TLS deep inspection re-signs HTTPS certificates with the FortiGate CA, so browsers that do not trust that CA can reject HTTPS connections. An unreachable DNS server prevents users from resolving website hostnames, so sites cannot be reached. The webfilter-force-off setting instead disables FortiGuard web filtering, and clearing the web-filter cache causes fresh rating lookups rather than inherently blocking every site.

local identifies a session attached to the FortiGate local IP stack, meaning FortiGate originated the session or is its destination. redir identifies a session redirected to an internal FortiGate proxy; because it is not NPU-offloaded, the proxy-based security-profile processing occurs in the CPU. This state does not signify captive-portal authentication or uninspected forwarding.

With preserve-session-route enabled, FortiGate preserves routing information for existing sessions, so ordinary routing changes apply only to new sessions. The existing session remains unchanged unless its currently used route is removed from the routing table; in that case, FortiGate marks the session dirty, clears its gateway information, and reevaluates it.

Cached reports the memory allocated to the system I/O cache, while Inactive identifies cache pages that have not been used recently and can be reclaimed if memory is needed. These values help distinguish cache use from memory actively consumed by processes. MemFree is unallocated physical RAM rather than user-space memory, and inactive pages are not memory that will never be used.

The ipsmonitor 5 operation toggles IPS bypass mode, which stops IPS traffic inspection but leaves the IPS engine running. If ipsengine CPU usage remains high while bypass is enabled, disabling the IPS engine with diagnose test application ipsmonitor 2 is the immediate way to stop the daemon’s processing and reduce its CPU consumption.

The command output 'automation test failed(1). stitch:HAFailOver' shows the manual stitch test returned a failure code, so the test was unsuccessful (A). A successful run instead reports 'automation test is done'. Because diagnose automation test directly invokes the stitch action for testing rather than firing it through its real trigger, the run does not generate a normal automation log entry, so B is also correct. C is wrong – nothing indicates a real HA failover took place (only a test was run) – and D is wrong because no successful backup action occurred given the failure.

A stub area does not accept type 5 external LSAs, but that restriction applies to advertisements entering area 0.0.0.5 and does not prevent FGT-1 from advertising routes to FGT-3 across area 0.0.0.0. OSPF uses IP protocol 89 for neighbor communication and LSA exchange; blocking that protocol between FGT-1 and FGT-3 prevents FGT-3 from receiving FGT-1’s OSPF advertisements.

A BGP neighbor in the Active state has initiated a TCP connection but has received no response, so the TCP session and therefore the BGP adjacency are not established. BGP permits multiple configured neighbors in the same remote AS; one established adjacency does not prevent another, and BGP does not use neighbor priority to establish adjacencies.

A prefix-list rule with no ge or le matches the configured prefix length exactly, so a rule for 172.16.0.0/16 does not permit the more-specific 172.16.52.0/24 route. An explicit /24 permit rule matches the advertised route. Setting ge to 17 permits prefixes within 172.16.0.0/16 whose lengths are /17 or longer, which includes /24. FortiGate defines ge as the minimum matched prefix length and le as the maximum.

policy_id=1 identifies firewall Policy ID 1 as the policy that matched the session. The npu info values offload=8/8 and in_npu=1/1, out_npu=1/1 show that the session is hardware-offloaded. Fortinet documents offload=8/8 as NP6 session offloading.

For an uninspected TCP session, FortiGate represents the protocol state with 0 for the inspection-side digit and 1 for the client-side ESTABLISHED state, producing proto_state=01. Therefore, the 562 sessions reported as ESTABLISHED have that state when no inspection is applied. The ephemeral=0/131072 field indicates zero current ephemeral sessions out of a supported maximum of 131072, and memory_tension_drop=0 indicates no memory-tension drops.