NSE4

Antivirus

Flow based

* Flow-based optimizes compared to proxy inspection
* IPS engine handles the process as a standalone
* Hybrid of scanning modes

Routing / FW

Criteria used to find matching FW policy to process traffic

* Services defined in the FW policy
* Destination defined as internet services in the FW policy
* Source defined as internet services in the FW policy

IP POOL FOR CARRIER-GRADE NAT

* Port block allocation
* Fixed port range

SD-WAN

Key routing principals for SD WAN

* By default - SD WAN members are skipped if they don't have a valid route
* By default - SD WAN rules are skipped if best route to destination is not a SD WAN member
* Regular policy routes have precedence over SD WAN rules

Additional load balance method supported in ECMP load balanced when SD WAN is enabled

* Volume based

SSL Inspection

Certificate actions

* Allow
    * The connection is allowed despite the invalid certificate.
* Trust and Allow
    * The certificate is explicitly trusted, and the connection proceeds.
* Block
    * The connection is allowed despite the invalid certificate.

Downloading file from EICAR works when using HTTPS

* Certificate inspection enabled - can cause issues with SSL/TLS connections, leading to failure to detect virus in HTTPS traffic
* Website exempt from SSL inspection

Certificates

CA Certificate when used in SSL Inspection

* KeyUsage extension = KeyCertSign
* CA extension = TRUE

Global Settings

Ha settings
FortiGuard settings

Protect server = DoS policy/log UDP/TCP scan attempts - IPS sensor to monitor signatures for server

443 used for both management and SSLVPN - SSLVPN will be first

Limitation of using URL list and APP control on same FW policy

* Limits scanning of application traffic to browser based technology category only.

VPN

SSLVPN

TWO SETTINGS FG > FG

* Server FG requires CA to very client FG certificate
* Client FG requires the SSL VPPN tunnel interface type to connect SSL VPN

IPSEC

HA

Traffic Flow
- SYN Packet from client always goes to primary device first
Enable proxy TCP failover
- session-pickup-enable
FGCP
- Elects primary FG device
- Runs only over heartbeat links

FSSO

fsso-polling refresh-user

* Refresh all users learned through agentless polling

Security fabric

downstream-access enable

Diagnostics

memory-use-threshold-green

* Forti sandbox?

memory-use-threshold-red

* Memory conserve mode
* Cannot change config

memory-use-threshold-extreme

* Serial only?