Home A - Z
Page Index

An Otter Wiki

Commit f9cc5a

2026-09-18 18:13:43 Peter: -/-
fortinet/nse4.md ..
@@ 13,7 13,21 @@
Criteria used to find matching FW policy to process traffic
* Services defined in the FW policy
* Destination defined as internet services in the FW policy
- * Source defined as internet services in the FW policy
+ * Source defined as internet services in the FW policy
+
+ IP POOL FOR CARRIER-GRADE NAT
+ * Port block allocation
+ * Fixed port range
+
+ ### SD-WAN
+ Key routing principals for SD WAN
+ * By default - SD WAN members are skipped if they don't have a valid route
+ * By default - SD WAN rules are skipped if best route to destination is not a SD WAN member
+ * Regular policy routes have precedence over SD WAN rules
+
+ Additional load balance method supported in ECMP load balanced when SD WAN is enabled
+ * Volume based
+
@@ 35,3 49,60 @@
CA Certificate when used in SSL Inspection
* KeyUsage extension = KeyCertSign
* CA extension = TRUE
+
+
+ ## Global Settings
+ * Ha settings
+ * FortiGuard settings
+
+ Protect server = DoS policy/log UDP/TCP scan attempts - IPS sensor to monitor signatures for server
+
+ 443 used for both management and SSLVPN - SSLVPN will be first
+
+ Limitation of using URL list and APP control on same FW policy
+ * Limits scanning of application traffic to browser based technology category only.
+
+ ## VPN
+ ### SSLVPN
+ TWO SETTINGS FG > FG
+ * Server FG requires CA to very client FG certificate
+ * Client FG requires the SSL VPPN tunnel interface type to connect SSL VPN
+ ### IPSEC
+ ## HA
+ * Traffic Flow
+ * SYN Packet from client always goes to primary device first
+
+ * Enable proxy TCP failover
+ * session-pickup-enable
+
+ * FGCP
+ * Elects primary FG device
+ * Runs only over heartbeat links
+
+ ## FSSO
+ fsso-polling refresh-user
+ * Refresh all users learned through agentless polling
+
+
+ ## Security fabric
+ downstream-access enable
+
+
+ ## Diagnostics
+ memory-use-threshold-green
+ * Forti sandbox?
+ memory-use-threshold-red
+ * Memory conserve mode
+ * Cannot change config
+ memory-use-threshold-extreme
+ * Serial only?
+
+
+ ## General NOTES
+ Proto 1 = ICMP
+
+ Reliable logging = prevents loss of of logs when disk is full
+
+ VIP ARP REPLY
+
+ App control - facebook, can't like/comment -> make sure deep inspect is on
0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9 0 1 2 3 4 5 6 7 8 9