Every card 121 cards
Factory default IP address on the internal / LAN interface of most desktop FortiGate models?
192.168.1.99 / 24 — with a DHCP server running on it and an admin account with no password.
Which port does the Security Fabric (CSF) connection use between upstream and downstream FortiGates?
TCP 8013
HA primary election order when override is DISABLED (the default)?
1. Most monitored ports up · 2. Highest HA uptime · 3. Highest device priority · 4. Highest serial number
HA primary election order when override is ENABLED?
1. Most monitored ports up · 2. Highest device priority · 3. Highest HA uptime · 4. Highest serial number
In one sentence — what does enabling HA override actually change?
Priority moves ahead of uptime. That is how you pin a chosen unit as primary.
How big must the HA uptime difference be before it counts in the election?
About 5 minutes. Smaller gaps are ignored.
At what memory usage does a FortiGate ENTER conserve mode?
About 88 percent — the red threshold.
At what memory usage does a FortiGate EXIT conserve mode?
About 82 percent — the green threshold.
What happens at the extreme memory threshold, and what is it?
About 95 percent. The FortiGate starts dropping new sessions outright.
What is the default setting of av-failopen, and what does it do?
Default is pass — under conserve mode, new antivirus sessions pass through UNSCANNED. · · Other options: off (block them), one-shot (pass until manually re-enabled).
Which session types does session-pickup synchronise by default?
TCP sessions only.
What must you add to synchronise UDP and ICMP sessions in HA?
set session-pickup-connectionless enable
Which sessions never survive an HA failover, no matter what you configure?
Proxy-based inspection sessions, and most SSL VPN sessions.
An HA cluster keeps flapping and will not stay in sync. What do you check, and with what command?
A configuration checksum mismatch between members. · · diagnose sys ha checksum cluster
What must match between two FortiGates for an FGCP cluster to form?
Same model, firmware, hardware configuration, license level, HA group ID, HA password — plus at least one shared heartbeat interface.
Name the log severity levels 0 through 7 in order.
0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notification, 6 Information, 7 Debug. · · Setting a level logs that level and everything more severe.
When is a traffic log written by default, and how do you change it?
At session CLOSE. · · Add: set logtraffic-start enable to also log at session start.
What are the three per-policy logtraffic options?
disable · utm (security events only) · all (every session)
Which policy type controls traffic destined TO the FortiGate itself — admin logins, IPsec, SSL VPN?
Local-in policies. Firewall policies only control traffic passing THROUGH the device.
Sniffer verbosity level 4 shows what?
Packet header plus the interface name.
What do sniffer verbosity levels 1, 2 and 3 show?
1 = header only · 2 = header + IP data · 3 = header + Ethernet data · · (4, 5, 6 are the same three plus the interface name.)
In diagnose sniffer packet, what does a timestamp value of 'a' give you?
Absolute UTC time.
Why sniff on interface 'any' rather than a named interface?
It disables hardware offloading, so you actually see all the packets.
Debug flow says: denied by forward policy check (policy 0). What happened?
Nothing matched — the traffic hit the implicit deny. Policy ID 0 is always the implicit deny.
Debug flow says: reverse path check fail, drop. What is the cause, and what is NOT the cause?
Cause: a missing or wrong route back toward the SOURCE. · · Not the cause: a firewall policy problem.
An address object created on the root FortiGate is not appearing on a downstream device. Where is the fix?
On the DOWNSTREAM device — it has set configuration-sync local, which means do not accept objects from upstream. Change it to default.
What is the default of uninterruptible-upgrade, and what order does an HA cluster upgrade in?
Enabled by default. Subordinates upgrade first, then the cluster fails over, then the former primary upgrades.
The Web Filtering license expires. What breaks and what still works?
FortiGuard category rating stops working. The static URL filter still works.
What drives BYOL license sizing on a FortiGate-VM?
vCPU count — not RAM, not throughput.
What is FortiGate CNF in one line?
A Fortinet-managed SaaS next-gen firewall for AWS and Azure. No instances for you to size or patch.
Name the FortiSASE user onboarding methods.
FortiClient invitation code · SAML / SSO with an IdP · AD or Entra ID connector · push via EMS or MDM.
What is required to restore a password-encrypted config backup?
A device using the same encryption password. Also note: a per-VDOM backup contains only that VDOM — global config is separate.
What is the policy ID of the implicit deny?
Policy ID 0.
How are firewall policies matched?
Top to bottom, FIRST match wins, then the implicit deny.
An exhibit lists policies with IDs 3, 1, 7 in that order. What is the evaluation order?
3, then 1, then 7 — exactly as listed. Policy ID is not policy order; the GUI sequence is the order.
Which NGFW mode makes central NAT mandatory?
NGFW policy-based mode. (Profile-based is the default and does not require it.)
Traffic dropped immediately after a policy edit. Which setting explains it?
firewall-session-dirty set to check-all — existing sessions are re-evaluated after any policy change. · · check-new only affects new sessions.
Which IP pool type is the default, and what does it do?
Overload — many-to-few source NAT with port translation.
What happens when a one-to-one IP pool runs out of addresses?
New sessions are DROPPED. There is no port translation to fall back on.
What does the port block allocation IP pool type do, and why use it?
Assigns each internal host a fixed block of ports. Carrier-style NAT, and it makes log correlation straightforward.
Does DNAT happen before or after the routing decision — and why does it matter?
BEFORE. The FortiGate therefore routes toward the MAPPED (internal) address, not the external one.
For a port forward, what goes in the firewall policy destination address field?
The VIP object itself — never the internal address.
Why does a VIP on the interface subnet work without any extra ARP configuration?
The FortiGate automatically replies to ARP for the VIP external IP.
What does set nat-source-vip do?
Forces reverse source NAT — used for hairpin / internal-to-VIP scenarios.
Active versus passive firewall authentication?
Active = the user is prompted (captive portal or a policy-triggered challenge). · · Passive = credentials learned elsewhere (FSSO, RSSO).
How does LDAP Regular bind work?
The FortiGate binds with a service account, searches for the user, then binds as that user.
How does LDAP Simple bind work, and what does it need?
Binds directly as the user's DN. It needs a DN template, because there is no search step.
For Active Directory, what is the Common Name Identifier?
sAMAccountName — not cn. cn is the classic wrong answer in exhibits.
RADIUS authentication and accounting ports?
UDP 1812 (authentication) and UDP 1813 (accounting). · · Legacy: 1645 and 1646.
What order does RADIUS auth-type 'auto' try?
PAP, then MS-CHAPv2, then CHAP.
What is the Fortinet RADIUS vendor-specific attribute number?
12356 — it can push group membership.
FSSO port: FortiGate to Collector Agent?
TCP 8000
FSSO port: DC Agent to Collector Agent?
UDP 8002
FSSO ports: Collector Agent to a domain controller?
TCP 445 (SMB) and 135 (RPC / WMI) — used for polling and workstation checks.
Describe FSSO DC Agent mode.
An agent DLL on every domain controller intercepts logon events and pushes them to a Collector Agent, which forwards to the FortiGate. Most scalable, near real-time.
What is agentless FSSO polling, and what do you give up?
The FortiGate polls the DCs directly — no agents at all. Simplest to deploy, least scalable, and you lose collector features like workstation check.
A user is logged in but FSSO policies do not match them. Give four likely causes.
1. Their group is missing from the collector agent's group filter · 2. They logged in before FSSO was deployed — no logon event captured · 3. Their DHCP IP changed and workstation check is off · 4. The policy uses a LOCAL group instead of an FSSO group
Which command shows the current FSSO logon database?
diagnose debug authd fsso list
What does certificate inspection let the FortiGate see?
The SNI and the certificate CN only. No decryption, no payload.
What does full (deep) SSL inspection require on every endpoint?
The re-signing CA certificate must be installed and trusted — otherwise every HTTPS site throws an error.
What is the default re-signing CA certificate?
Fortinet_CA_SSL
The destination server's certificate is invalid. Which CA does the FortiGate re-sign with, and why?
Fortinet_CA_Untrusted — deliberately, so the browser warning still reaches the user.
Deep inspection breaks a banking app. What is the correct fix?
Add an SSL exemption for that destination. Certificate pinning and HSTS cannot be worked around — and 'disable inspection' is the wrong answer.
Which FortiGuard categories are exempt from deep inspection by default?
Finance and Health.
What is the web filter evaluation order?
1. Static URL filter · 2. FortiGuard category filtering · 3. Content and advanced filters
What does the URL filter 'exempt' action do that 'allow' does not?
Exempt skips the REMAINING inspection as well — antivirus and DLP included. Allow only overrides the category decision.
Name the five FortiGuard category actions.
Allow · Monitor (allow and log) · Block · Warning (interstitial with a timer) · Authenticate (require credentials to continue).
Which features require PROXY-based inspection?
Web profile overrides, quotas, CDR (content disarm), DLP, client comforting, and full safe-search enforcement.
Which engine runs application control, and what does that imply?
The IPS engine — so application control is ALWAYS flow-based, even inside a proxy-based policy.
What is the application control match order?
1. Application overrides (individual apps) · 2. Filter overrides · 3. Categories · · Most specific first — an app entry always beats its own category.
Why does application control misidentify HTTPS applications with certificate inspection only?
Without deep inspection it can only match on the SNI, giving coarse identification. Real app identification needs full SSL inspection.
Flow-based versus proxy-based antivirus — the key behavioural difference?
Flow scans as the stream passes, so the client may receive part of the file before the connection is reset. · · Proxy buffers the whole file, scans it, then releases it.
What happens to a file larger than the oversize limit, by default?
It is NOT scanned, and it is PASSED through.
Where is the antivirus oversize limit actually configured?
In the PROTOCOL OPTIONS profile — a separate object from the antivirus profile. This is the answer to most 'why isn't it scanning' questions.
Which inspection mode is required for CDR (content disarm and reconstruction)?
Proxy-based only.
What is FortiGuard Outbreak Prevention?
A real-time hash lookup against FortiGuard for files the signature database does not know. Requires a license and live connectivity.
Name the three antivirus signature databases.
Normal, extended, extreme.
What are the two components of an IPS sensor, and which is evaluated first?
Filters (by severity, target, protocol, OS, application) and individual signature entries. · · Signature entries are evaluated first.
Name the IPS sensor actions.
Allow, Monitor, Block, Reset, Quarantine, or default (use the signature's own recommended action).
What three things must a rate-based IPS signature define?
A threshold, a duration, and a track-by value (source or destination).
diagnose test application ipsmonitor 99 does what?
Restarts all IPS engines. · · (1 = display engine info, 2 = toggle engine on/off, 5 = toggle bypass status.)
Are DoS policies part of IPS sensors, and when are they evaluated?
No — they are separate objects, and they are evaluated BEFORE firewall policies.
Does DNS filtering need deep inspection?
No. It is a separate profile and works without decrypting anything.
Which web filtering features require deep inspection?
Safe search enforcement and the YouTube education filter.
What is the default administrative distance of a static route on FortiGate?
10 — not 1. This is a common Cisco-habit mistake.
What does administrative DISTANCE decide?
Which route gets installed into the routing table in the first place.
What does route PRIORITY decide, and which value wins?
It breaks ties among routes already in the table with EQUAL distance. LOWER priority wins.
Where does route METRIC apply?
Only within a dynamic routing protocol.
What two conditions produce ECMP?
Equal administrative distance AND equal priority.
What is the default ECMP load-balancing method?
source-ip-based
Name the four ECMP load-balancing methods.
source-ip-based (default) · source-dest-ip-based · weighted-load-balance · usage-based (spillover)
Why pair a blackhole route with a route-based IPsec tunnel?
So traffic does not leak out the default route when the tunnel drops. Give the blackhole a HIGHER distance than the tunnel route.
Are policy routes evaluated before or after the routing table?
Before.
What is the DEFAULT reverse path forwarding mode, and what does it check?
Loose (feasible). The source IP just has to be reachable via ANY route out ANY interface.
What does STRICT RPF check, and how do you enable it?
The best route back to the source must use the same interface the packet arrived on. · · config system settings → set strict-src-check enable
An SD-WAN member is healthy but no rule will select it. What is missing?
A static default route pointing at the sd-wan virtual interface. No route, no selection.
Name the SD-WAN performance SLA probe protocols.
Ping, HTTP, HTTPS, DNS, TCP-echo, UDP-echo, and TWAMP.
Which three metrics does an SD-WAN performance SLA measure?
Latency, jitter, and packet loss. Minimum bandwidth is optional.
Name the four SD-WAN rule strategies.
Manual · Best Quality · Lowest Cost (SLA) · Maximize Bandwidth (SLA)
What does the Lowest Cost (SLA) strategy do?
Among the members currently MEETING the SLA, it picks the lowest-cost (priority) one. The usual production choice.
What is the evaluation order: routing table, SD-WAN rules, policy routes?
Policy routes → SD-WAN rules → routing table.
What does the implicit SD-WAN rule at the bottom do by default?
Load-balances across all members using source IP.
An SLA shows state(alive) but the service shows no members. Why?
The link is up but is not MEETING the SLA targets. Alive does not mean eligible.
Which command shows the actual forwarding table rather than the RIB?
get router info kernel
IKEv1 main mode — how many messages, and what is protected?
Six messages, and the peer identity is protected.
IKEv1 aggressive mode — how many messages, and what is the trade-off?
Three messages, but the identity is sent in the clear. Needed for dynamic-IP peers that identify by peer ID.
What does IKEv2 give you over IKEv1?
Fewer exchanges, built-in NAT traversal, and EAP support.
Which phase 1 settings must match on both peers?
Encryption and hash proposals, DH group, authentication method (PSK or certificate), and — for IKEv1 — the mode.
Does the phase 1 lifetime have to match on both ends?
No. The LOWER of the two values is used.
Which port does NAT-T use, and where is NAT detected?
NAT-T encapsulates ESP in UDP 4500. NAT is detected during IKE negotiation on UDP 500.
Phase 1 is up but phase 2 will not establish. What is the number one cause?
A quick mode selector mismatch — the local and remote subnets must mirror each other on the two ends.
What two things does a route-based IPsec tunnel need before traffic will pass?
1. A static route for the remote subnet via the tunnel interface · 2. Firewall policies in BOTH directions
What does dead peer detection actually accomplish in a redundant VPN?
It detects the failure so the tunnel goes down and its routes are withdrawn, letting the backup route take over.
How is redundancy between two IPsec tunnels expressed?
In ROUTING — same destination via both tunnels, using distance for active/backup, or equal distance plus priority for preference, or equal both for ECMP.
How many tunnels does a full mesh of n sites need, and what is the scalable alternative?
n(n−1)/2 tunnels. · · ADVPN is the alternative — shortcut tunnels built on demand.
How is a dial-up IPsec hub configured?
One phase 1 with type dynamic, addresses handed out by mode-config, and set add-route enable to inject client routes. Peer ID or XAuth identifies clients.
IKE error: NO_PROPOSAL_CHOSEN. What does it mean?
A proposal mismatch — in phase 1 or phase 2.
IKE error: INVALID_ID_INFORMATION. What does it mean?
A selector or peer-ID mismatch.
The tunnel is up but counters only increment in one direction. Crypto problem or not?
Not crypto. It is a firewall policy or routing problem.
Which command shows phase 1 state, and which shows phase 2 SAs?
Phase 1: diagnose vpn ike gateway list · · Phase 2: diagnose vpn tunnel list
What changed for SSL VPN in FortiOS 7.6?
Tunnel and web mode were removed from lower-memory entry-level models, in favour of IPsec dial-up and ZTNA.