Fortinet NSE 4 - FortiOS 7.6 Administrator Free Sample Questions

With override disabled (the default), primary selection compares monitored interfaces, then HA uptime (differences below ha-uptime-diff-margin, default 300 s, are ignored), then priority, then serial number. A unit that rebooted has its uptime reset, so it does not reclaim the primary role. Enabling override makes device priority count before uptime (monitored interfaces, priority, uptime, serial). FGT-A, configured with the higher priority (default 128), therefore becomes primary again when it rejoins. Enable override on the cluster members; override-wait-time (default 0) can delay renegotiation to reduce flapping. session-pickup-delay only limits session sync to sessions older than 30 seconds.

When the Security Fabric is enabled, global objects such as addresses, services and schedules are synchronized from the upstream FortiGate to downstream devices by default. This is controlled on the root by config system csf > set fabric-object-unification {default | local}: with default, global CMDB objects are synchronized, and with local they are not. Individual objects must also have Fabric synchronization (fabric-object) enabled. Because the branches are already authorized and online, the Fabric link on TCP 8013 (the default upstream-port) is working and authorization is not the problem.

The debug message 'Denied by forward policy check (policy 0)' specifically indicates that the packet failed to match any user-defined firewall policy and hit the default implicit deny policy, which has an ID of 0. This means there is no valid firewall policy allowing traffic from 192.168.1.10 to 10.0.2.50 on port 80.

diagnose sys session list displays the sessions in the kernel session table (addresses, ports, protocol, state, policy ID, NPU offload state, and so on). You can narrow the output by first setting criteria with diagnose sys session filter , such as src, dst, dport or policy. The list and clear commands then act only on matching sessions. The list itself removes nothing; diagnose sys session clear does. Sessions are not kept across reboots.

Port forwarding is configured in the VIP object itself: the External IP address (203.0.113.10) and the mapped internal address (192.168.1.50), with Port Forwarding enabled, the External service port set to 8443 (the port that clients connect to on the WAN) and the mapped port (GUI 'Map to IPv4 port', CLI mappedport) set to 443 on the server. With central NAT disabled (the default), the VIP is then selected as the Destination of the firewall policy from the WAN interface to the internal interface. With central NAT enabled, the VIP is created under Policy & Objects > DNAT & Virtual IPs instead and the policy uses the internal mapped address (FortiOS 7.6.0 Administration Guide, Virtual IPs and Central DNAT). A service object for port 8443 only matches traffic and does not translate the port, Central SNAT translates source addresses rather than destinations, and port forwarding is a VIP setting, not an option of the firewall policy.

With a Collector Agent (CA), logon events are gathered either from DC agents installed on the domain controllers (DC-agent mode, DC agents send to the CA on UDP 8002) or by the CA polling the DCs. The CA then sends the user IP-to-group logon information to the FortiGate over TCP 8000. The FortiGate does not poll the DCs itself in this mode, and RADIUS/multicast are not used.