# NSE4 ## Antivirus Flow based * Flow-based optimizes compared to proxy inspection * IPS engine handles the process as a standalone * Hybrid of scanning modes Proxy * Virus detected = block messages is displayed immediately * Client must wait for antivirus to scan before receiving file Virus database * Extreme database only available on certing FG models * Normal database available on all FG models ## Routing / FW / NAT Criteria used to find matching FW policy to process traffic * Services defined in the FW policy * Destination defined as internet services in the FW policy * Source defined as internet services in the FW policy IP POOL FOR CARRIER-GRADE NAT * Port block allocation * Fixed port range ### SD-WAN Key routing principals for SD WAN * By default - SD WAN members are skipped if they don't have a valid route * By default - SD WAN rules are skipped if best route to destination is not a SD WAN member * Regular policy routes have precedence over SD WAN rules Additional load balance method supported in ECMP load balanced when SD WAN is enabled * Volume based ### NAT Hvis central NAT er enabled = Put mapped ip of VIP object i FW policy ## SSL Inspection Certificate actions * Allow * The connection is allowed despite the invalid certificate. * Trust and Allow * The certificate is explicitly trusted, and the connection proceeds. * Block * The connection is allowed despite the invalid certificate. Downloading file from EICAR works when using HTTPS * Certificate inspection enabled - can cause issues with SSL/TLS connections, leading to failure to detect virus in HTTPS traffic * Website exempt from SSL inspection ## Certificates CA Certificate when used in SSL Inspection * KeyUsage extension = KeyCertSign * CA extension = TRUE ## Global Settings * Ha settings * FortiGuard settings Protect server = DoS policy/log UDP/TCP scan attempts - IPS sensor to monitor signatures for server 443 used for both management and SSLVPN - SSLVPN will be first Limitation of using URL list and APP control on same FW policy * Limits scanning of application traffic to browser based technology category only. ## VPN ### SSLVPN TWO SETTINGS FG > FG * Server FG requires CA to verify client FG certificate * Client FG requires the SSL VPPN tunnel interface type to connect SSL VPN ### IPSEC Phase 2 - Auto Negotiate * FG brings up IPsec tunnnel, and keeps it up - regardless of activity. ## HA * Traffic Flow * SYN Packet from client always goes to primary device first * Enable proxy TCP failover * session-pickup-enable * FGCP * Elects primary FG device * Runs only over heartbeat links * Primary device * If HA age difference is less than 5 minutes (300 seconds), the device priority and FortiGate serial number selects the cluster unit to become the primary unit. ## FSSO fsso-polling refresh-user * Refresh all users learned through agentless polling DC Agent in FSSO DC agent mode * Capture login events, forward to collector agent Advanced AD access mode for FSSO collector * Act as LDAP client to configure group filters * It supports monitoring of nested groups Standard AD access mode * Security profiles apply to user groups * Uses windows netbios domain\username Methods used for polling * WMI * WinSecLog * NetAPI ## Security fabric downstream-access enable Root fortigate * FortiAnalyzer IP * Fabric name ## Diagnostics memory-use-threshold-green * Forti sandbox? memory-use-threshold-red * Memory conserve mode * Cannot change config memory-use-threshold-extreme * Serial only? FG agentless polling mode * FG uses SMB to read event viewer * FG queries AD by using LDAP to read user group info ## General NOTES Proto 1 = ICMP Reliable logging = prevents loss of of logs when disk is full VIP ARP REPLY App control - facebook, can't like/comment -> make sure deep inspect is on ### VDOMS Two default vdoms, when split * FG-Traffic * Root