Parallel Path Processing (PPP) is a foundational architecture concept in FortiOS. It defines multiple potential processing paths a packet can take, such as the kernel path (slow path), hardware offloading (fast path), and proxy-based inspection. Based on the packet's characteristics and the FortiGate's software/hardware configuration (e.g., firewall policy, security profiles), PPP selects the most efficient and appropriate path. This allows FortiOS to balance security inspection needs with performance optimization.

B. Software configuration (firewall policies, security profiles, etc.) is a primary factor that determines the packet's path, not just hardware.

C. PPP absolutely applies to established sessions. The fast path, a core component of PPP, is specifically designed to accelerate traffic for existing, trusted sessions.

D. Software configuration is the main driver for PPP decisions, dictating whether features like deep inspection (proxy path) or offloading (fast path) are used.

1. Fortinet Document Library, "Life of a Packet for FortiOS 7.6". This document provides a detailed overview of the packet flow and the various processing paths (PPP) within FortiOS, from ingress to egress.

2. FortiOS 7.6.0 Handbook, "Architecture" chapter. It describes the high-level architecture, including the role of the NP/CP processors and the different software paths for packet processing.

Based on the Fortinet FCSS - Network Security 7.6 documents and standard exam content

for these specific troubleshooting scenarios, here are the verified answers.

Questio ns no: 74

Verified Answer: A, C

Comprehensive and Detailed Explanation with all FCSS - Network Security 7.6 documents:

This question typically refers to a session table exhibit showing Local Traffic (traffic

originating from or destined to the FortiGate itself, such as management traffic, DNS queries

initiated by FortiGate, or dynamic routing updates). These sessions are identified by Policy

ID 0 or the absence of a forwarded interface pair (e.g., local flag).

C . FortiGate either initiated the session or the session terminates at FortiGate:

This is the definition of Local Traffic. Unlike Forward Traffic (which passes through the

FortiGate from one interface to another), local traffic belongs to the FortiGate's control plane

(e.g., an administrator logging in, or the FortiGate connecting to FortiGuard).

In the session table, this is characterized by policy_id=0 or the source/destination being the

FortiGate's own IP.

A . FortiGate is performing a security profile inspection using the CPU:

Local traffic and traffic requiring complex handling (like the application notification app_ntf

seen in similar exhibits) are processed by the CPU (Kernel) rather than being fully offloaded

to the NPU (Network Processor) fast path.

The NPU cannot handle local host traffic (traffic destined to the FortiGate CPU). Therefore,

the CPU must process these packets.

Why other options are incorrect:

B: Captive portal redirection involves specific authentication flags and HTTP redirection,

usually seen as a forwarding decision, not a completed local session.

D: "Forwarded without inspection" describes an offloaded or fast-pathed session (NP6/NP7),

which would not be local traffic and would show hardware offload flags (e.g., np6_0).

Reference:

FortiGate Security 7.6 Study Guide (Diagnostics): "Traffic originating from the FortiGate or

destined to the FortiGate (Local-In/Local-Out) is always processed by the CPU and cannot be

offloaded."

There are several potential root causes for a complete failure to access any websites. If SSL deep inspection is enabled, but the FortiGate's CA certificate is not trusted by client browsers, all HTTPS connections will fail with a certificate error, effectively blocking most of the modern web. A fundamental network issue, such as an unreachable DNS server, will prevent browsers from resolving domain names to IP addresses, thus blocking access. Lastly, if the FortiGuard Web Filtering license expires, the FortiGate's default behavior is to block all web traffic that is subject to a web filter profile, leading to a complete outage for users.

A. A cleared web filter cache would cause initial slowness as websites are re-categorized, but it would not result in a persistent block of all sites.

C. The webfilter-force-off setting completely disables the web filter service, which would allow access, not block it. This is the opposite of the observed behavior.

1. FortiOS 7.6.0 Administration Guide, Page 958, "SSL/TLS inspection": "For deep inspection, you must install a CA certificate on the browser of each user whose traffic is to be inspected... If the certificate is not installed, the browser will display certificate warnings".

2. FortiOS 7.6.0 Administration Guide, Page 1018, "Web Filter": "If the FortiGuard Web Filter license expires, you can configure the FortiGate to either allow or block traffic. By default, traffic is blocked."

3. FortiOS 7.6.0 Troubleshooting Guide, Page 10, "Basic network troubleshooting": "Check DNS settings... If the FortiGate cannot resolve domain names, many features will not work, including web filter...".

The session output includes the flag maydirty, which indicates that a security profile (in this case, application control, as shown by appvalid) is applied. When a failover occurs in a FortiGate HA cluster, sessions marked as maydirty are synchronized to the new primary device but must be re-evaluated against their respective security profiles to ensure security policy enforcement. The session is not dropped, but it undergoes this re-inspection process.

B. This is incorrect because the maydirty flag explicitly means the session requires re-evaluation by security profiles; it does not simply continue without any further processing.

C. The session does not show any allowederr packets, and this flag is not the reason for any specific failover behavior in this context. The session is synchronized, not removed.

D. While NAT is applied (nat=1), the primary reason for re-evaluation in this scenario is the application of security profiles, indicated by the maydirty flag, not the NAT status itself.

- FortiOS Handbook - High Availability 7.6, "Session failover" section. It explains that sessions with security profiles are marked as maydirty and are re-evaluated by the new primary after a failover.

- FortiOS Handbook - CLI Reference 7.6, diagnose sys session list command output fields. The description for dirty and maydirty flags confirms their role in session synchronization and re-evaluation.

The exhibit shows the FortiGuard category-based filter has "File Sharing and Storage" set to "Block." Since www.dropbox.com is categorized under this category, FortiGate will block the connection based on the category filter configuration. This is the standard behavior when category-based filtering is enabled and a specific category is set to block.

A. FortiGate won't block it as "invalid URL" - it's a valid URL in a blocked category.

B. The URL Filter section doesn't show any allow rules for this specific URL.

D. Web Content Filter being enabled doesn't exempt URLs from category-based blocking.

- FortiGate Administration Guide 7.6.0, "Web Filter" chapter, section on "FortiGuard Category Filter"

- FortiGate Security 7.6 Study Guide, "Content Inspection" module, pages on category-based filtering

- Fortinet Document Library, "Web Filtering Best Practices Guide v7.6"