Domain 1 — Deployment & system configuration 32 cards
Factory default IP address on the internal / LAN interface of most desktop FortiGate models?
192.168.1.99 / 24 — with a DHCP server running on it and an admin account with no password.
Which port does the Security Fabric (CSF) connection use between upstream and downstream FortiGates?
TCP 8013
HA primary election order when override is DISABLED (the default)?
1. Most monitored ports up · 2. Highest HA uptime · 3. Highest device priority · 4. Highest serial number
HA primary election order when override is ENABLED?
1. Most monitored ports up · 2. Highest device priority · 3. Highest HA uptime · 4. Highest serial number
In one sentence — what does enabling HA override actually change?
Priority moves ahead of uptime. That is how you pin a chosen unit as primary.
How big must the HA uptime difference be before it counts in the election?
About 5 minutes. Smaller gaps are ignored.
At what memory usage does a FortiGate ENTER conserve mode?
About 88 percent — the red threshold.
At what memory usage does a FortiGate EXIT conserve mode?
About 82 percent — the green threshold.
What happens at the extreme memory threshold, and what is it?
About 95 percent. The FortiGate starts dropping new sessions outright.
What is the default setting of av-failopen, and what does it do?
Default is pass — under conserve mode, new antivirus sessions pass through UNSCANNED. · · Other options: off (block them), one-shot (pass until manually re-enabled).
Which session types does session-pickup synchronise by default?
TCP sessions only.
What must you add to synchronise UDP and ICMP sessions in HA?
set session-pickup-connectionless enable
Which sessions never survive an HA failover, no matter what you configure?
Proxy-based inspection sessions, and most SSL VPN sessions.
An HA cluster keeps flapping and will not stay in sync. What do you check, and with what command?
A configuration checksum mismatch between members. · · diagnose sys ha checksum cluster
What must match between two FortiGates for an FGCP cluster to form?
Same model, firmware, hardware configuration, license level, HA group ID, HA password — plus at least one shared heartbeat interface.
Name the log severity levels 0 through 7 in order.
0 Emergency, 1 Alert, 2 Critical, 3 Error, 4 Warning, 5 Notification, 6 Information, 7 Debug. · · Setting a level logs that level and everything more severe.
When is a traffic log written by default, and how do you change it?
At session CLOSE. · · Add: set logtraffic-start enable to also log at session start.
What are the three per-policy logtraffic options?
disable · utm (security events only) · all (every session)
Which policy type controls traffic destined TO the FortiGate itself — admin logins, IPsec, SSL VPN?
Local-in policies. Firewall policies only control traffic passing THROUGH the device.
Sniffer verbosity level 4 shows what?
Packet header plus the interface name.
What do sniffer verbosity levels 1, 2 and 3 show?
1 = header only · 2 = header + IP data · 3 = header + Ethernet data · · (4, 5, 6 are the same three plus the interface name.)
In diagnose sniffer packet, what does a timestamp value of 'a' give you?
Absolute UTC time.
Why sniff on interface 'any' rather than a named interface?
It disables hardware offloading, so you actually see all the packets.
Debug flow says: denied by forward policy check (policy 0). What happened?
Nothing matched — the traffic hit the implicit deny. Policy ID 0 is always the implicit deny.
Debug flow says: reverse path check fail, drop. What is the cause, and what is NOT the cause?
Cause: a missing or wrong route back toward the SOURCE. · · Not the cause: a firewall policy problem.
An address object created on the root FortiGate is not appearing on a downstream device. Where is the fix?
On the DOWNSTREAM device — it has set configuration-sync local, which means do not accept objects from upstream. Change it to default.
What is the default of uninterruptible-upgrade, and what order does an HA cluster upgrade in?
Enabled by default. Subordinates upgrade first, then the cluster fails over, then the former primary upgrades.
The Web Filtering license expires. What breaks and what still works?
FortiGuard category rating stops working. The static URL filter still works.
What drives BYOL license sizing on a FortiGate-VM?
vCPU count — not RAM, not throughput.
What is FortiGate CNF in one line?
A Fortinet-managed SaaS next-gen firewall for AWS and Azure. No instances for you to size or patch.
Name the FortiSASE user onboarding methods.
FortiClient invitation code · SAML / SSO with an IdP · AD or Entra ID connector · push via EMS or MDM.
What is required to restore a password-encrypted config backup?
A device using the same encryption password. Also note: a per-VDOM backup contains only that VDOM — global config is separate.