The HA uptime values show FGVM010000064692 has 604814.78 seconds (approximately 7 days) while FGVM010000065036 has 86396.42 seconds (approximately 1 day). This significant difference indicates FGVM010000065036's HA uptime was recently reset. Additionally, FGVM010000064692 is the primary unit because it has the higher HA uptime value, which is a key factor in HA primary selection when other factors are equal.

B. Both devices show "hastate=hello" and are communicating, indicating both are operational and in sync.

D. FGVM010000064692 has priority=1 while FGVM010000065036 has priority=0, so 065036 has the higher priority value.

1. FortiGate Administration Guide 7.2, "High Availability" chapter, sections on HA primary selection and monitoring

2. Fortinet Documentation Library, FortiOS 7.2 CLI Reference, "diagnose sys ha" command documentation

3. FortiGate High Availability Technical Note, "HA Primary Unit Selection" section

4. FortiOS 7.2 Handbook, "HA Troubleshooting and Diagnostics" chapter

5. Fortinet Knowledge Base Article FD40056, "Understanding HA primary unit selection process"

The FortiGate Intrusion Prevention System (IPS) engine is a core component of the single-pass architecture responsible for protocol decoding and signature-based threat detection. This powerful engine is leveraged by several other security features. Application Control uses the IPS engine and its decoders to identify and control thousands of applications. The DNS Filter uses the IPS engine to inspect DNS traffic for malicious patterns and threats. Similarly, the Web Application Firewall (WAF) feature relies on the IPS engine to apply its signature set to protect against common web application attacks like SQL injection and cross-site scripting.

A. Antivirus in flow-based inspection: Antivirus scanning uses a separate, dedicated antivirus (AV) engine and malware signature database, distinct from the IPS engine.

B. Web filter in flow-based inspection: The primary mechanism for Web Filtering is URL categorization and rating lookups against the FortiGuard database, not the IPS signature engine.

1. FortiOS 7.0.1 Administration Guide, "Application control" section, p. 826. It states, "Application control uses IPS protocol decoders..."

2. FortiOS 7.0.1 Administration Guide, "DNS filter" section, p. 880. It mentions that the DNS filter profile uses the IPS engine to scan DNS traffic.

3. FortiOS 7.0.1 Administration Guide, "Web application firewall" section, p. 900. The guide explains that WAF uses the IPS engine and signatures to protect servers from malicious attacks.

FortiGate uses multiple criteria to match traffic against firewall policies. The three key criteria are: source addresses (which can be defined as Internet Services), destination addresses (which can also be defined as Internet Services), and services/protocols defined in the policy. These criteria form the basic matching elements that determine which policy will process specific traffic. FortiGate evaluates policies sequentially from top to bottom in the policy list, not by priority values or policy ID numbers.

C. FortiGate does not use priority values for policy matching; it uses top-to-bottom order in the policy list.

E. Policy ID numbers are for identification only, not for determining processing order.

1. Fortinet NSE4 Study Guide - FortiGate Security 7.2, Chapter 3: Firewall Policies, Section 3.2: Policy Lookup, Pages 45-48

2. FortiGate Administration Guide 7.2, "Firewall Policy Components", Document ID: FG-702-ADMIN, Section 2.3, Pages 112-115

3. Fortinet Knowledge Base Article: "How FortiGate processes firewall policies", Document KB-FGT-2021-0234, Paragraphs 3-5

4. FortiGate Security Best Practices Guide 7.2, "Policy Configuration Guidelines", Section 4.1, Pages 67-69

5. Fortinet Technical Documentation: "FortiOS 7.2 CLI Reference", Command: config firewall policy, Pages 234-237

During a firmware upgrade on an active-active HA cluster, the uninterruptible upgrade feature is enabled by default to minimize downtime. This process involves upgrading the secondary unit first, which then reboots. A failover occurs, making the newly upgraded secondary unit the primary. During this transition, the new primary unit handles all traffic, meaning that active-active load balancing is temporarily suspended. The old primary (now the new secondary) is then upgraded. This sequential process ensures service continuity but relies on a single unit for a short period.

A. The firmware is uploaded only to the primary unit, which then automatically synchronizes and upgrades the secondary units.

B. All FortiGate devices in the cluster are rebooted, but sequentially, not simultaneously, to maintain network connectivity.

1. FortiOS 7.0.0 High Availability Guide, "Upgrading the cluster firmware" section. It states, "By default, uninterruptible-upgrade is enabled." and "You upload the firmware image to the primary FortiGate and the primary FortiGate upgrades the firmware of all the cluster members."

2. FortiOS 7.0.0 High Availability Guide, "HA uninterruptible upgrade" section. The description of the process confirms that a failover occurs and one unit handles traffic while the other is upgraded, thus suspending load balancing.

The Intrusion Prevention System (IPS) engine in FortiOS is a core component responsible for advanced protocol decoding and signature-based inspection. Application Control, DNS Filter, and Web Application Firewall (WAF) all fundamentally rely on this engine to function. Application Control uses it to identify application traffic, DNS Filter uses it to inspect DNS requests against categories, and WAF uses it to detect web-specific attacks.

A. While flow-based web filtering uses the IPS engine for protocol decoding, its primary function is URL/category lookup, which is a separate subsystem.

B. Flow-based antivirus uses the IPS engine to extract files from traffic streams, but the actual malware scanning is performed by a distinct antivirus engine.

1. FortiGate Security 7.2 Study Guide, page 10. A diagram explicitly shows the IPS engine as the core component for IPS, Application Control, and Web Application Firewall (WAF) features.

2. FortiGate Security 7.2 Study Guide, page 171. It states, "DNS filter uses the IPS engine to inspect DNS traffic."

3. FortiOS Handbook 7.2 - Security Profiles, "Application Control" chapter. It details that application signatures are part of the IPS package and processed by the IPS engine.

4. FortiOS Handbook 7.2 - Security Profiles, "Web Application Firewall" chapter. It explains that WAF uses the IPS engine with a specialized signature set to protect against web application threats.

:

The issue is that the explicit Deny policy for Remote-User2 is not being matched, allowing traffic to pass. There are two primary ways to fix this to achieve the desired outcome:

1. (D) Set the Destination address as Webserver in the Deny policy. By default, policies match on the post-NAT (real) IP address. The Deny policy with dstaddr: all should match, but may fail due to ambiguity with VIP traffic. Making the destination explicit to the real

In transparent mode, a FortiGate acts as a Layer 2 bridging device, forwarding Ethernet frames based on MAC addresses. It does not modify the source or destination MAC addresses of the frames passing through it. By default, all physical interfaces are placed into a single forwarding domain, which functions as a single broadcast domain, effectively making the FortiGate behave like a simple transparent bridge. This allows it to be inserted into a network with no changes to the IP addressing scheme.

B. A primary advantage of transparent mode is that it can be installed without changing the existing network's IP schema.

C. Static routes are not used for forwarding transit traffic in transparent mode; forwarding is based on the Layer 2 forwarding database (MAC address table).

1. Fortinet. (2021). FortiOS 7.0.0 Handbook - System. Fortinet Document Library. pp. 42-43, "Transparent mode", "Forwarding domains".

2. Fortinet. (2021). FortiOS 7.0.0 Networking Guide. Fortinet Document Library. p. 16, "Transparent mode".

During full SSL inspection, FortiGate intercepts the encrypted traffic and re-signs it with its own certificate to inspect the content. This process is a form of man-in-the-middle (MITM). Web browsers have a built-in list of trusted Certificate Authorities (CAs). The default FortiGate CA certificate used for SSL inspection is not on this public list. Therefore, when the browser receives the re-signed certificate from FortiGate, it cannot verify the issuer's authenticity against its trusted store, resulting in a certificate warning error. HTTP traffic is not encrypted and does not involve certificates, which is why it is unaffected.

A. The matching firewall policy is set to proxy inspection mode: Both proxy-based and flow-based inspection modes perform full SSL inspection and will cause this error if the CA certificate is not trusted.

B. The certificate used by FortiGate for SSL inspection does not contain the required certificate extensions: While certificate extensions are important, the primary and most common cause of this specific, widespread error is the lack of trust in the signing CA.

C. The full SSL inspection feature does not have a valid license: SSL inspection is a core feature of FortiOS and does not require a separate license. A licensing issue would not manifest as a browser certificate error.

1. Fortinet. (2021). FortiOS Administration Guide 7.0.0. "Preventing certificate warnings," pp. 768-769. This section explicitly states, "When SSL inspection is configured, FortiOS intercepts encrypted traffic... To avoid certificate errors, you must download the FortiGate CA certificate and install it in the end user's browser."

2. Fortinet. (2021). FortiOS Handbook - Security Profiles 7.0.0. "SSL/SSH Inspection," p. 273. This chapter describes the mechanism of deep inspection and the need for a trusted CA on the client side.

Reverse Path Forwarding (RPF) checking is a security mechanism to prevent IP spoofing. In topologies with asymmetric routing, RPF can incorrectly drop legitimate traffic. To accommodate this, RPF checks can be disabled either globally by enabling asymmetric routing (set asymroute enable) or on a specific ingress interface by disabling the source check (set src-check disable).

A. Anti-replay is a security feature within the IPsec protocol to prevent attackers from re-injecting captured packets; it is unrelated to RPF.

D. Disabling strict-src-check changes the RPF mode from strict (route must be the best one) to loose (any route on that interface is acceptable), but it does not disable RPF checking itself.

1. Fortinet. (2021). FortiGate Infrastructure Study Guide for FortiOS 7.0, p. 69. "If you have an asymmetric routing topology, you must disable RPF. You can disable RPF globally or per interface... To disable RPF globally, you must enable asymmetric routing... To disable RPF on an interface, you must disable the source check."

2. Fortinet. (2021). FortiOS CLI Reference 7.0.0, config system interface section. The set src-check disable command is documented to disable the source address check.

3. Fortinet. (2021). FortiOS CLI Reference 7.0.0, config system settings section. The set asymroute enable command is documented to enable asymmetric routing.