* Virus detected = block messages is displayed immediately
+
* Client must wait for antivirus to scan before receiving file
-
## Routing / FW
+
Virus database
+
* Extreme database only available on certing FG models
+
* Normal database available on all FG models
+
+
## Routing / FW / NAT
Criteria used to find matching FW policy to process traffic
* Services defined in the FW policy
@@ 27,6 34,11 @@
Additional load balance method supported in ECMP load balanced when SD WAN is enabled
* Volume based
+
+
+
### NAT
+
+
Hvis central NAT er enabled = Put mapped ip of VIP object i FW policy
@@ 65,9 77,13 @@
## VPN
### SSLVPN
TWO SETTINGS FG > FG
-
* Server FG requires CA to very client FG certificate
+
* Server FG requires CA to verify client FG certificate
* Client FG requires the SSL VPPN tunnel interface type to connect SSL VPN
### IPSEC
+
+
Phase 2 - Auto Negotiate
+
* FG brings up IPsec tunnnel, and keeps it up - regardless of activity.
+
## HA
* Traffic Flow
* SYN Packet from client always goes to primary device first
@@ 79,14 95,37 @@
* Elects primary FG device
* Runs only over heartbeat links
+
* Primary device
+
* If HA age difference is less than 5 minutes (300 seconds), the device priority and FortiGate serial number selects the cluster unit to become the primary unit.
+
## FSSO
fsso-polling refresh-user
* Refresh all users learned through agentless polling
+
+
DC Agent in FSSO DC agent mode
+
* Capture login events, forward to collector agent
+
+
Advanced AD access mode for FSSO collector
+
* Act as LDAP client to configure group filters
+
* It supports monitoring of nested groups
+
+
Standard AD access mode
+
* Security profiles apply to user groups
+
* Uses windows netbios domain\username
+
+
Methods used for polling
+
* WMI
+
* WinSecLog
+
* NetAPI
+
## Security fabric
downstream-access enable
+
Root fortigate
+
* FortiAnalyzer IP
+
* Fabric name
## Diagnostics
memory-use-threshold-green
@@ 97,7 136,10 @@
memory-use-threshold-extreme
* Serial only?
-
+
FG agentless polling mode
+
* FG uses SMB to read event viewer
+
* FG queries AD by using LDAP to read user group info
+
## General NOTES
Proto 1 = ICMP
@@ 106,3 148,8 @@
VIP ARP REPLY
App control - facebook, can't like/comment -> make sure deep inspect is on
