Domain 2 — Firewall policies & authentication 26 cards
What is the policy ID of the implicit deny?
Policy ID 0.
How are firewall policies matched?
Top to bottom, FIRST match wins, then the implicit deny.
An exhibit lists policies with IDs 3, 1, 7 in that order. What is the evaluation order?
3, then 1, then 7 — exactly as listed. Policy ID is not policy order; the GUI sequence is the order.
Which NGFW mode makes central NAT mandatory?
NGFW policy-based mode. (Profile-based is the default and does not require it.)
Traffic dropped immediately after a policy edit. Which setting explains it?
firewall-session-dirty set to check-all — existing sessions are re-evaluated after any policy change. · · check-new only affects new sessions.
Which IP pool type is the default, and what does it do?
Overload — many-to-few source NAT with port translation.
What happens when a one-to-one IP pool runs out of addresses?
New sessions are DROPPED. There is no port translation to fall back on.
What does the port block allocation IP pool type do, and why use it?
Assigns each internal host a fixed block of ports. Carrier-style NAT, and it makes log correlation straightforward.
Does DNAT happen before or after the routing decision — and why does it matter?
BEFORE. The FortiGate therefore routes toward the MAPPED (internal) address, not the external one.
For a port forward, what goes in the firewall policy destination address field?
The VIP object itself — never the internal address.
Why does a VIP on the interface subnet work without any extra ARP configuration?
The FortiGate automatically replies to ARP for the VIP external IP.
What does set nat-source-vip do?
Forces reverse source NAT — used for hairpin / internal-to-VIP scenarios.
Active versus passive firewall authentication?
Active = the user is prompted (captive portal or a policy-triggered challenge). · · Passive = credentials learned elsewhere (FSSO, RSSO).
How does LDAP Regular bind work?
The FortiGate binds with a service account, searches for the user, then binds as that user.
How does LDAP Simple bind work, and what does it need?
Binds directly as the user's DN. It needs a DN template, because there is no search step.
For Active Directory, what is the Common Name Identifier?
sAMAccountName — not cn. cn is the classic wrong answer in exhibits.
RADIUS authentication and accounting ports?
UDP 1812 (authentication) and UDP 1813 (accounting). · · Legacy: 1645 and 1646.
What order does RADIUS auth-type 'auto' try?
PAP, then MS-CHAPv2, then CHAP.
What is the Fortinet RADIUS vendor-specific attribute number?
12356 — it can push group membership.
FSSO port: FortiGate to Collector Agent?
TCP 8000
FSSO port: DC Agent to Collector Agent?
UDP 8002
FSSO ports: Collector Agent to a domain controller?
TCP 445 (SMB) and 135 (RPC / WMI) — used for polling and workstation checks.
Describe FSSO DC Agent mode.
An agent DLL on every domain controller intercepts logon events and pushes them to a Collector Agent, which forwards to the FortiGate. Most scalable, near real-time.
What is agentless FSSO polling, and what do you give up?
The FortiGate polls the DCs directly — no agents at all. Simplest to deploy, least scalable, and you lose collector features like workstation check.
A user is logged in but FSSO policies do not match them. Give four likely causes.
1. Their group is missing from the collector agent's group filter · 2. They logged in before FSSO was deployed — no logon event captured · 3. Their DHCP IP changed and workstation check is off · 4. The policy uses a LOCAL group instead of an FSSO group
Which command shows the current FSSO logon database?
diagnose debug authd fsso list