NSE4-FGT-AD-7-6: Fortinet NSE 4 - FortiOS 7.6 AdministratorDemo

Feasible-path RPF accepts a packet when at least one active route to its source uses the receiving interface; the default route through port2 therefore permits source 10.0.13.10 received on port2. Strict RPF requires the best route back to the source to use the receiving interface; source 10.100.110.10 matches the default route through port2 and therefore passes when received on port2.

The FSSO Collector Agent communicates login information to FortiGate through TCP port 8000. Confirming that this port is reachable between the Collector Agent and FortiGate directly tests the required forwarding path.

virtual-wan-link is the default SD-WAN zone, and the four displayed member interfaces are assigned within the SD-WAN configuration. The Underlay zone has no member interfaces listed beneath it, so it is an empty zone. Fortinet documents that the default SD-WAN zone is named virtual-wan-link.

A Static URL Filter action of Monitor behaves like Allow and continues processing through the remaining FortiGuard web filters, so Facebook is still blocked by the Social Networking category. Setting the matching www.facebook.com URL-filter entry to Exempt bypasses the remaining FortiGuard web filtering for that URL while the Social Networking category remains blocked for other sites.

For flow-based antivirus, NTurbo creates a dedicated data path that redirects traffic from the ingress interface to the IPS engine and from the IPS engine to the egress interface. This permits firewall operations along that path to be offloaded, reducing FortiGate CPU workload and improving throughput. Proxy-based security profiles are not offloaded by NTurbo. Fortinet: NTurbo offloads flow-based processing

When SD-WAN is disabled, the IPv4 ECMP load-balancing algorithm is configured in config system settings with v4-ecmp-mode. When SD-WAN is enabled, ECMP configuration moves to config system sdwan, where load-balance-mode controls the algorithm. Volume-based balancing is available only as measured-volume-based under SD-WAN, and ECMP static routes must have equal distance and priority values.

Application and filter overrides are evaluated in priority order. A specific Google application override configured as Monitor must precede the Excessive-Bandwidth filter configured as Block, or Google traffic that matches the filter is blocked. SSL certificate inspection examines only up to the TLS headers; deep-content inspection decrypts HTTPS traffic so FortiGate can inspect its content and apply application control to encrypted Google application traffic. Fortinet: Application Control Profile GUI Improvements Fortinet: SSL & SSH Inspection

FortiGate On Idle DPD sends liveness probes after the tunnel has no inbound traffic for the configured interval. Receiving inbound traffic demonstrates that the peer is active, so probes are not needed until the tunnel becomes idle.

A policy that uses an IP pool for source NAT translates outbound sessions to an address from that pool instead of the outgoing interface address. The configured overload pool contains only 100.65.0.102, so that is the translated source address. The VIP 100.65.0.200 provides destination NAT for inbound HTTPS traffic to 10.0.11.50 and is unrelated to this outbound flow. Dynamic SNAT

DNS must be allowed so an unauthenticated client can resolve the hostname needed to access the web destination or an FQDN-based captive portal. FortiGate supports configuring the captive portal by FQDN, which requires name resolution.

A one-to-one IP pool maps each internal address to a distinct external address and does not use port address translation. The range 100.65.0.110–100.65.0.111 therefore provides translations for only two hosts. Setting the pool to overload allows multiple hosts to share external address translation through PAT, and extending the pool endpoint to 100.65.0.112 adds a third external address for one-to-one mapping.

The add-route option adds a route for the peer destination selector when the dynamic IPsec tunnel has been negotiated, so a successful Phase 2 security association is required. The route is based on the Phase 2 remote proxy ID (destination selector); consequently, the remote network must be defined correctly in the Phase 2 selectors.

When HA override is enabled, FortiGate HA primary-unit selection gives device priority precedence over HA uptime. Connected monitored interfaces are evaluated first, HA uptime is used after priority as a tie-breaker, and the serial number resolves any remaining tie.

For outbound traffic inspection, an EC2 subnet routes default traffic to a Gateway Load Balancer endpoint. The endpoint forwards the traffic through the Gateway Load Balancer to the security appliance for inspection; inspected traffic returns to the endpoint, whose route table sends it to the internet gateway and then to the internet.

Agentless SIA configures the SWG as an explicit proxy for web traffic only. Nonweb traffic bypasses FortiSASE and is forwarded directly to the internet.

FSSO Collector Agent advanced mode uses LDAP distinguished-name group information, which supports nested or inherited group memberships. It also allows FortiGate to use an LDAP server locally and define the group filters on FortiGate. The Windows NetBIOS Domain\Username convention is associated with standard mode, not advanced mode. Fortinet technical tip

Category usage quotas are available only in proxy-based web-filter mode. The web filter profile’s feature set must match the associated firewall policy’s inspection mode, so a proxy-based profile that contains a quota is unavailable to a policy configured for flow-based inspection.

The routing lookup selects port2 (gw-0.0.0.0 via port2), indicating that the default gateway route uses port2. Firewall policy 2 matches with the act-drop action, and the forward-policy check explicitly denies the traffic. Protocol 1 with ICMP type 8 is ICMP rather than UDP, and no RPF failure is reported.

FSSO-based access depends on FortiGate receiving a logon record that maps the authenticated user to the workstation IP address. If that IP address is absent from the FSSO active-user list, FortiGate cannot match the user’s traffic to the applicable identity-based policy. Fortinet troubleshooting guidance first directs administrators to verify the local FSSO user list when an authenticated AD user cannot access the internet.

At 90% memory utilization, FortiGate exceeds both the configured red threshold of 88%, which forces entry into conserve mode, and the extreme threshold of 89%, at which new sessions are dropped.

Flow-based antivirus uses a hybrid of the scan modes associated with proxy-based inspection, with the scan method selected according to the file type. It provides higher-throughput performance than proxy-based antivirus. During file handling, FortiGate can buffer the file while forwarding data to the client, retaining the final packet pending the antivirus verdict; a malicious verdict prevents that final packet from being sent. The IPS process can forward files requiring a full scan to the scanunit process, so it is not a standalone handler for the entire process.

Agentless FSSO polling has FortiGate directly poll Windows domain controllers for Security Event logon information, without a collector or DC agent. It uses SMB to read the DC event logs, and its built-in collector functionality does not provide workstation checks.

FortiGate displays an address object as a static-route destination only when Routing configuration is enabled on that firewall address (allow-routing enable). An FQDN address object can be used for routing once this setting is enabled and the static route uses a named address destination.

A web filter profile’s feature set must correspond to the inspection mode of the firewall policy that applies it. A flow-based profile attached to a proxy-based policy is incorrectly configured. In addition, a static URL filter action of Monitor permits and logs the matching URL; it does not bypass subsequent FortiGuard filtering. Fortinet documents that URL filters are processed before FortiGuard Web Filtering, and that Monitor allows matching traffic with logging.