NSE4 - blame None – An Otter Wiki

Blame

2db5b9	Peter	2026-09-18 17:30:46

# NSE4

## Antivirus

Flow based

ce06db	Peter	2026-09-20 13:27:13

    * Flow-based optimizes compared to proxy inspection

    * IPS engine handles the process as a standalone

    * Hybrid of scanning modes

2db5b9	Peter	2026-09-18 17:30:46

0b1804	Peter	2026-09-20 14:05:31

Proxy

    * Virus detected = block messages is displayed immediately

    * Client must wait for antivirus to scan before receiving file 

2db5b9	Peter	2026-09-18 17:30:46

0b1804	Peter	2026-09-20 14:05:31

Virus database

    * Extreme database only available on certing FG models

    * Normal database available on all FG models

## Routing / FW / NAT

2db5b9	Peter	2026-09-18 17:30:46

Criteria used to find matching FW policy to process traffic

ce06db	Peter	2026-09-20 13:27:13

    * Services defined in the FW policy

    * Destination defined as internet services in the FW policy

    * Source defined as internet services in the FW policy

f9cc5a	Peter	2026-09-18 18:13:43

IP POOL FOR CARRIER-GRADE NAT

ce06db	Peter	2026-09-20 13:27:13

    * Port block allocation

    * Fixed port range

f9cc5a	Peter	2026-09-18 18:13:43

### SD-WAN

Key routing principals for SD WAN

    * By default - SD WAN members are skipped if they don't have a valid route

    * By default - SD WAN rules are skipped if best route to destination is not a SD WAN member

    * Regular policy routes have precedence over SD WAN rules

Additional load balance method supported in ECMP load balanced when SD WAN is enabled

    * Volume based

0b1804	Peter	2026-09-20 14:05:31

### NAT

Hvis central NAT er enabled = Put mapped ip of VIP object i FW policy

f9cc5a	Peter	2026-09-18 18:13:43

2db5b9	Peter	2026-09-18 17:30:46

## SSL Inspection

Certificate actions

e9b40b	Peter	2026-09-18 17:31:57

    * Allow

        * The connection is allowed despite the invalid certificate.

    * Trust and Allow

        * The certificate is explicitly trusted, and the connection proceeds.

    * Block

        * The connection is allowed despite the invalid certificate.

2db5b9	Peter	2026-09-18 17:30:46

dd876b	Peter	2026-09-18 17:31:25

Downloading file from EICAR works when using HTTPS

2db5b9	Peter	2026-09-18 17:30:46

    * Certificate inspection enabled - can cause issues with SSL/TLS connections, leading to failure to detect virus in HTTPS traffic

    * Website exempt from SSL inspection

8fe8e8	Peter	2026-09-18 17:35:57

## Certificates

CA Certificate when used in SSL Inspection

    * KeyUsage extension = KeyCertSign

    * CA extension = TRUE

f9cc5a	Peter	2026-09-18 18:13:43

## Global Settings

* Ha settings

* FortiGuard settings

Protect server = DoS policy/log UDP/TCP scan attempts - IPS sensor to monitor signatures for server

443 used for both management and SSLVPN - SSLVPN will be first

Limitation of using URL list and APP control on same FW policy

    * Limits scanning of application traffic to browser based technology category only.

## VPN

### SSLVPN

TWO SETTINGS FG > FG

0b1804	Peter	2026-09-20 14:05:31

    * Server FG requires CA to verify client FG certificate

f9cc5a	Peter	2026-09-18 18:13:43

    * Client FG requires the SSL VPPN tunnel interface type to connect SSL VPN

### IPSEC

0b1804	Peter	2026-09-20 14:05:31

Phase 2 - Auto Negotiate

    * FG brings up IPsec tunnnel, and keeps it up - regardless of activity.

f9cc5a	Peter	2026-09-18 18:13:43

## HA

* Traffic Flow

    * SYN Packet from client always goes to primary device first

* Enable proxy TCP failover

    * session-pickup-enable

* FGCP

    * Elects primary FG device

    * Runs only over heartbeat links

0b1804	Peter	2026-09-20 14:05:31

* Primary device

    * If HA age difference is less than 5 minutes (300 seconds), the device priority and FortiGate serial number selects the cluster unit to become the primary unit.

100

f9cc5a	Peter	2026-09-18 18:13:43

101

## FSSO

102

fsso-polling refresh-user

103

    * Refresh all users learned through agentless polling

0b1804	Peter	2026-09-20 14:05:31

104

105

DC Agent in FSSO DC agent mode

106

    * Capture login events, forward to collector agent

107

108

Advanced AD access mode for FSSO collector

109

    * Act as LDAP client to configure group filters

110

    * It supports monitoring of nested groups

111

112

Standard AD access mode

113

    * Security profiles apply to user groups

114

    * Uses windows netbios domain\username

115

116

Methods used for polling

117

    * WMI

118

    * WinSecLog

119

    * NetAPI

120

f9cc5a	Peter	2026-09-18 18:13:43

121

122

123

## Security fabric

124

downstream-access enable

125

0b1804	Peter	2026-09-20 14:05:31

126

Root fortigate

127

    * FortiAnalyzer IP

128

    * Fabric name

f9cc5a	Peter	2026-09-18 18:13:43

129

130

## Diagnostics

131

memory-use-threshold-green

132

    * Forti sandbox?

133

memory-use-threshold-red

134

    * Memory conserve mode

135

    * Cannot change config

136

memory-use-threshold-extreme

137

    * Serial only?

138

0b1804	Peter	2026-09-20 14:05:31

139

FG agentless polling mode

140

    * FG uses SMB to read event viewer

141

    * FG queries AD by using LDAP to read user group info

142

f9cc5a	Peter	2026-09-18 18:13:43

143

## General NOTES

144

Proto 1 = ICMP

145

146

Reliable logging = prevents loss of of logs when disk is full

147

148

VIP ARP REPLY

149

150

App control - facebook, can't like/comment -> make sure deep inspect is on

0b1804	Peter	2026-09-20 14:05:31

151

152

### VDOMS

153

Two default vdoms, when split

154

    * FG-Traffic

155

    * Root