https://docs.fortinet.com/document/fortigate/6.4.0/new-features/520820/improvements-tosynchronizing-objects-across-the-security-fabric-6-4-4

To retrieve an SSO group called SalesGroup using the FortiAuthenticator REST API, the following

issues need to be fixed in the API call:

The API version should be v2, not v1, as SSO groups are only supported in version 2 of the REST API.

The HTTP method should be GET, not POST, as GET is used to retrieve information from the server,

while POST is used to create or update information on the server. Therefore, a correct API call would

look like this: curl -X GET -H “Authorization: Bearer ”

https://fac.example.com/api/v2/sso/groups/SalesGroup Reference:

https://docs.fortinet.com/document/fortiauthenticator/6.4.1/rest-api-solutionguide/927310/introduction https://docs.fortinet.com/document/fortiauthenticator/6.4.1/rest-api-

solution-guide/927311/sso-groups

:

The output in Exhibit A shows that the VPN tunnel is not established because the peer IP address is

incorrect. The output in Exhibit B shows that the peer IP address is 192.168.1.100, but the baseline

VPN configuration in Exhibit C shows that the peer IP address should be 192.168.1.101.

To restore VPN connectivity, you need to change the peer IP address in the VPN tunnel configuration

to 192.168.1.101. The correct configuration is shown below:

config vpn ipsec phase1-interface

edit "wan"

set peer-ip 192.168.1.101

set peer-id 192.168.1.101

set dhgrp 1

set auth-mode psk

set psk SECRET_PSK

next

end

Option A is incorrect because it does not change the peer IP address. Option B is incorrect because it

changes the peer IP address to 192.168.1.100, which is the incorrect IP address. Option D is incorrect

because it does not include the necessary configuration for the VPN tunnel.

https://community.fortinet.com/t5/FortiManager/Technical-Tip-FortiManager-VRRP-HAconfiguration-in-Azure-Public/ta-p/267503

https://community.fortinet.com/t5/FortiManager/Technical-Tip-FortiManager-HA-setup-andtroubleshooting/ta-p/222998

A . Systems running on Azure will need to go through the main data center to access the services on

Oracle Cloud. This is because the Oracle Cloud is not directly connected to the Azure Cloud. The

traffic will need to go through the main data center in order to reach the Oracle Cloud.

C . Branch FortiGate devices must be configured as VPN clients for the branches' internal network to

be able to access Oracle services without using public IPs. This is because the Oracle Cloud does not

allow direct connections from the internet. The traffic will need to go through the FortiGate devices

in order to reach the Oracle Cloud.

The other options are not correct.

B . Use FortiGate VM for IPSEC over ExpressRoute, as traffic is not encrypted by Azure. This is not

necessary. Azure does encrypt traffic over ExpressRoute.

D . Two ExpressRoute services to the main data center are required to implement SD-WAN between

a FortiGate VM in Azure and a FortiGate device at the data center edge. This is not necessary. A

single ExpressRoute service can be used to implement SD-WAN between a FortiGate VM in Azure

and a FortiGate device at the data center edge.

https://learn.microsoft.com/en-us/azure/expressroute/expressroute-about-encryption

The FortiGate VM is a virtual firewall appliance that can run on various hypervisors, such as ESXi,

Hyper-V, KVM, etc. The adapter type for NICs on a FortiGate VM determines the performance and

compatibility of the network interface cards with the hypervisor and the physical network. There are

different adapter types available for NICs on a FortiGate VM, such as E1000, VMXNET3, SR-IOV, etc. If

performance is the main concern and cost is not a factor, one option is to use native ESXi networking

with VMXNET3 adapter type for NICs on a FortiGate VM that will run on an ESXi hypervisor.

VMXNET3 is a paravirtualized network interface card that is optimized for performance in virtual

machines and supports features such as multiqueue support, Receive Side Scaling (RSS), Large

Receive Offload (LRO), IPv6 offloads, and MSI/MSI-X interrupt delivery. Native ESXi networking

means that the FortiGate VM uses the standard virtual switch (vSwitch) or distributed virtual switch

(dvSwitch) provided by the ESXi hypervisor to connect to the physical network. This option can

provide high performance and compatibility for NICs on a FortiGate VM without requiring additional

hardware or software components. Reference:

https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmwareesxi/19662/installing-fortigate-vm-on-vmware-esxi

https://docs.fortinet.com/document/fortigate/7.0.0/vm-installation-for-vmwareesxi/19662/networking

https://docs.fortinet.com/document/fortigate/7.0.0/new-features/710924/http-2-support-in-proxymode-ssl-inspection

B must be set to enable mode-cfg, which is required for injecting IKE routes on the ADVPN shortcut

tunnels.

D must be set to enable add-route, which is the command that actually injects the IKE routes.

E must be set to enable mode-cfg-allow-client-selector, which allows custom phase 2 selectors to be

configured.

The other options are incorrect. Option A is incorrect because net-device disable is not required for

injecting IKE routes on the ADVPN shortcut tunnels. Option C is incorrect because IKE version 1 is not

supported for ADVPN.

Reference:

Phase 2 selectors and ADVPN shortcut tunnels | FortiGate / FortiOS 7.2.0

Configuring SD-WAN/ADVPN with FortiGate | FortiGate / FortiOS 7.2.0

: