NSE4

Antivirus

Flow based

Flow-based optimizes compared to proxy inspection
IPS engine handles the process as a standalone
Hybrid of scanning modes

Routing / FW

Criteria used to find matching FW policy to process traffic

Services defined in the FW policy
Destination defined as internet services in the FW policy
Source defined as internet services in the FW policy

IP POOL FOR CARRIER-GRADE NAT

Port block allocation
Fixed port range

SD-WAN

Key routing principals for SD WAN

* By default - SD WAN members are skipped if they don't have a valid route
* By default - SD WAN rules are skipped if best route to destination is not a SD WAN member
* Regular policy routes have precedence over SD WAN rules

Additional load balance method supported in ECMP load balanced when SD WAN is enabled

* Volume based

SSL Inspection

Certificate actions

* Allow
    * The connection is allowed despite the invalid certificate.
* Trust and Allow
    * The certificate is explicitly trusted, and the connection proceeds.
* Block
    * The connection is allowed despite the invalid certificate.

Downloading file from EICAR works when using HTTPS

* Certificate inspection enabled - can cause issues with SSL/TLS connections, leading to failure to detect virus in HTTPS traffic
* Website exempt from SSL inspection

Certificates

CA Certificate when used in SSL Inspection

* KeyUsage extension = KeyCertSign
* CA extension = TRUE

Global Settings

Ha settings
FortiGuard settings

Protect server = DoS policy/log UDP/TCP scan attempts - IPS sensor to monitor signatures for server

443 used for both management and SSLVPN - SSLVPN will be first

Limitation of using URL list and APP control on same FW policy

* Limits scanning of application traffic to browser based technology category only.

VPN

SSLVPN

TWO SETTINGS FG > FG

* Server FG requires CA to very client FG certificate
* Client FG requires the SSL VPPN tunnel interface type to connect SSL VPN

IPSEC

HA

Traffic Flow
- SYN Packet from client always goes to primary device first
Enable proxy TCP failover
- session-pickup-enable
FGCP
- Elects primary FG device
- Runs only over heartbeat links

FSSO

fsso-polling refresh-user

* Refresh all users learned through agentless polling

Security fabric

downstream-access enable

Diagnostics

memory-use-threshold-green

* Forti sandbox?

memory-use-threshold-red

* Memory conserve mode
* Cannot change config

memory-use-threshold-extreme

* Serial only?