NSE4
Antivirus
Flow based
* Flow-based optimizes compared to proxy inspection * IPS engine handles the process as a standalone * Hybrid of scanning modes
Proxy
* Virus detected = block messages is displayed immediately * Client must wait for antivirus to scan before receiving file
Virus database
* Extreme database only available on certing FG models * Normal database available on all FG models
Routing / FW / NAT
Criteria used to find matching FW policy to process traffic
* Services defined in the FW policy * Destination defined as internet services in the FW policy * Source defined as internet services in the FW policy
IP POOL FOR CARRIER-GRADE NAT
* Port block allocation * Fixed port range
SD-WAN
Key routing principals for SD WAN
* By default - SD WAN members are skipped if they don't have a valid route * By default - SD WAN rules are skipped if best route to destination is not a SD WAN member * Regular policy routes have precedence over SD WAN rules
Additional load balance method supported in ECMP load balanced when SD WAN is enabled
* Volume based
NAT
Hvis central NAT er enabled = Put mapped ip of VIP object i FW policy
SSL Inspection
Certificate actions
* Allow
* The connection is allowed despite the invalid certificate.
* Trust and Allow
* The certificate is explicitly trusted, and the connection proceeds.
* Block
* The connection is allowed despite the invalid certificate.
Downloading file from EICAR works when using HTTPS
* Certificate inspection enabled - can cause issues with SSL/TLS connections, leading to failure to detect virus in HTTPS traffic * Website exempt from SSL inspection
Certificates
CA Certificate when used in SSL Inspection
* KeyUsage extension = KeyCertSign * CA extension = TRUE
Global Settings
- Ha settings
- FortiGuard settings
Protect server = DoS policy/log UDP/TCP scan attempts - IPS sensor to monitor signatures for server
443 used for both management and SSLVPN - SSLVPN will be first
Limitation of using URL list and APP control on same FW policy
* Limits scanning of application traffic to browser based technology category only.
VPN
SSLVPN
TWO SETTINGS FG > FG
* Server FG requires CA to verify client FG certificate * Client FG requires the SSL VPPN tunnel interface type to connect SSL VPN
IPSEC
Phase 2 - Auto Negotiate
* FG brings up IPsec tunnnel, and keeps it up - regardless of activity.
HA
Traffic Flow
- SYN Packet from client always goes to primary device first
Enable proxy TCP failover
- session-pickup-enable
FGCP
- Elects primary FG device
- Runs only over heartbeat links
Primary device
- If HA age difference is less than 5 minutes (300 seconds), the device priority and FortiGate serial number selects the cluster unit to become the primary unit.
FSSO
fsso-polling refresh-user
* Refresh all users learned through agentless polling
DC Agent in FSSO DC agent mode
* Capture login events, forward to collector agent
Advanced AD access mode for FSSO collector
* Act as LDAP client to configure group filters * It supports monitoring of nested groups
Standard AD access mode
* Security profiles apply to user groups * Uses windows netbios domain\username
Methods used for polling
* WMI * WinSecLog * NetAPI
Security fabric
downstream-access enable
Root fortigate
* FortiAnalyzer IP * Fabric name
Diagnostics
memory-use-threshold-green
* Forti sandbox?
memory-use-threshold-red
* Memory conserve mode * Cannot change config
memory-use-threshold-extreme
* Serial only?
FG agentless polling mode
* FG uses SMB to read event viewer * FG queries AD by using LDAP to read user group info
General NOTES
Proto 1 = ICMP
Reliable logging = prevents loss of of logs when disk is full
VIP ARP REPLY
App control - facebook, can't like/comment -> make sure deep inspect is on
VDOMS
Two default vdoms, when split
* FG-Traffic * Root