Drag and Drop Matching Questions

Antivirus: Scans files and traffic for known malware signatures.

Antivirus is a critical UTM component that uses signature-based detection to examine files, email attachments, and live traffic for known malware patterns, also incorporating heuristics and sandbox integration for unknown threats. It operates at the file and byte level, comparing hashes and signatures against FortiGuard's malware database. Thus, the definition correctly captures its primary function in Fortinet's layered security architecture.

IPS: Detects and blocks network-based attacks.

The Intrusion Prevention System (IPS) performs deep packet inspection, analyzing protocol fields and traffic patterns to detect and block exploit attempts like buffer overflows, SQL injection, and port scans. Unlike antivirus, it works on network streams rather than individual files, using vulnerability signatures and anomaly detection. It can drop malicious packets or reset sessions in real time, making the stated definition of network-based attack detection accurate.

Application Control: Identifies and controls application traffic regardless of port.

Application Control goes beyond port-based classification by using application signatures, behavioral analysis, and protocol decoding to identify applications even when they hide on non-standard ports or tunnel through other protocols. This enables FortiGate to enforce granular policies per application, such as allowing social media but blocking file-sharing or P2P traffic. Its primary function is thus correctly identified as identifying and controlling application traffic regardless of port.

Web Filtering: Blocks access to malicious or inappropriate websites.

Web Filtering assesses HTTP and HTTPS requests against URL categories, domain reputation, and real-time FortiGuard intelligence to block access to phishing, malicious, or policy-violating websites. It operates at the URL layer, distinct from application-level controls, and supports user- and group-based policies. This makes blocking malicious or inappropriate websites the concise and accurate description of its role.

FortiGate: Provides next-generation firewall and security gateway capabilities.

FortiGate is the enforcement point in the Fortinet Security Fabric, providing next-generation firewall capabilities including deep packet inspection, application control, intrusion prevention, and SSL/TLS inspection. It terminates VPNs and applies security policies at line rate, making it the primary security gateway for both north-south and east-west traffic.

FortiManager: Centralized management and orchestration of Fortinet devices.

FortiManager is the centralized management plane, offering a single-pane-of-glass view for configuration, policy provisioning, and firmware updates across many FortiGate devices. It uses Administrative Domains (ADOMs) to segment network management and supports device groups for bulk changes, but it does not process live traffic or detect threats itself.

FortiAnalyzer: Logging, reporting, and analytics for security events.

FortiAnalyzer acts as a centralized log repository, collecting logs from FortiGate and other Fortinet products to enable forensic analysis, compliance reporting, and event correlation. It also provides preconfigured and custom reports, as well as data visualization for security operations, without performing inline protection or behavioral sandboxing.

FortiSandbox: Advanced threat detection through behavioral analysis.

FortiSandbox is a dedicated threat-detection appliance that detonates suspect files in a virtualized environment, observing their behavior to identify zero-day and evasive malware. It integrates with FortiGate via the Fabric Connector or security rating to quarantine advanced threats, but it is not involved in policy enforcement or management.

Static routing: manually configured routes

Static routing is the process of manually entering routes into the routing table by an administrator, typically specifying a destination prefix, next-hop IP, and administrative distance. These routes remain in the routing table until manually removed or replaced, and they do not automatically adapt to network topology changes. As a result, static routes are most suitable for small networks or stable links where dynamic protocol overhead is unnecessary.

Dynamic routing: routes learned via routing protocols

Dynamic routing leverages routing protocols such as OSPF, BGP, or RIP to automatically exchange route information between routers. The routing protocol builds neighbor adjacencies, propagates reachability information, and calculates the best path using metrics like cost, bandwidth, or path length. This enables the routing table to converge quickly after link failures or topology changes without requiring manual administrator intervention.

Policy-based routing: routing based on packet attributes

Policy-based routing (PBR) forwards traffic based on packet attributes such as source IP address, destination port, protocol type, or application signature, rather than solely on the destination IP route lookup. On FortiGate, PBR is implemented through policy routes that are evaluated before the regular routing table, allowing specific flows to be sent to a different next hop or interface. This is useful for traffic engineering, such as sending VoIP traffic over a dedicated WAN link while regular internet traffic follows the destination-based routing table.

ECMP: distributing traffic over multiple equal-cost paths

Equal-cost multipath (ECMP) is a load-balancing mechanism where multiple routes to the same destination have identical administrative distance and cost, and all are installed in the routing table. FortiGate distributes sessions across these equal-cost paths using a hash of source/destination IP addresses and ports, which helps preserve flow affinity while maximizing throughput. ECMP is not a separate routing protocol but a property that can apply to both static and dynamic routes.

Source NAT: Translates source IP addresses of packets originating from a private network.

Source NAT is applied to outbound traffic, rewriting the source IP address from a private/internal address to a public address so that packets can be routed across the internet. On FortiGate, SNAT may be dynamic (using a pool or IP pool) or overloaded via PAT to share a single IP with multiple sessions. This translation is stateful: the firewall tracks the session so that reply packets from the external host can be translated back to the original private source.

Destination NAT: Translates destination IP addresses of packets destined for a private network.

Destination NAT is used for inbound traffic, translating the destination IP address in packets that are destined for a private network, such as a published server. A public IP or port is mapped to an internal private IP and port, allowing external clients to reach the server without exposing the entire private network. FortiGate Virtual IP (VIP) objects implement DNAT, and the firewall reverses the translation on return packets as part of the same stateful session.

Static NAT: One-to-one mapping between a private IP and a public IP.

Static NAT creates a permanent one-to-one correspondence between a private IP address and a public IP address, with no port translation involved. This mapping is configured manually and works in both directions, allowing an internal host to initiate outbound traffic and also to receive unsolicited inbound traffic from the internet. Because the mapping is fixed, static NAT is often used for servers or devices that require a consistent reachable public identity, but it consumes one public IP per private host.

Port Address Translation (PAT): Maps multiple private IPs to a single public IP using different port numbers.

Port Address Translation (PAT) extends NAT by multiplexing many internal private addresses onto one public IP address, rewriting both the source IP and the source TCP/UDP port in each outgoing packet. The FortiGate maintains a session table so that return traffic is demultiplexed back to the correct internal host based on the original port mapping. This is the default source-NAT behavior for most outbound internet traffic on FortiGate firewalls because it conserves public IPv4 addresses while still providing connectivity.

Active-Passive HA: One FortiGate handles traffic while the other is on standby.

In Fortinet's FortiGate Cluster Protocol, Active-Passive HA designates a single primary unit to actively process all traffic sessions. The backup unit remains in a standby state, maintaining synchronized configuration and session information via the heartbeat interface, and takes over only upon detection of a failure.

Active-Active HA: Both FortiGates handle traffic simultaneously.

Active-Active HA utilizes FGCP's load-balancing mode so that both FortiGate cluster members concurrently forward data-plane traffic. The cluster distributes new sessions between the units using a hash-based algorithm, while one unit still retains control-plane leadership for management and synchronization.

ACCEPT: Allows traffic that matches the policy

In FortiGate firewall policies, the ACCEPT action (also known as 'accept' in the policy action field) permits all matching traffic to pass through the firewall from source to destination, subject to any additional security profiles (like antivirus, IPS, or web filtering) attached to the policy. This is the only action that actively forwards traffic between interfaces, and it can also be paired with logging to record session starts or closes. Unlike DENY or REJECT, ACCEPT does not generate any blocking notification or reset packets—it simply allows the session to be established and traffic to flow bidirectionally for the session.

DENY: Silently drops traffic that matches the policy

The DENY action silently discards all packets that match the policy's criteria, essentially dropping them at the firewall without sending any response back to the source host. This means the source TCP sender will not receive a TCP RST or ICMP unreachable message, so it will rely on its own retransmission timeout to eventually give up, which can cause perceived delays. In FortiGate, this is equivalent to 'deny' in the policy action and is commonly used for restricting traffic while avoiding unnecessary network probes from attackers.