Fortinet NSE7 Specialty Modules (SD-WAN and Enterprise Firewall tracks) (FORTINET-NSE7-SPECIALTY) (FORTINET-NSE7-SPECIALTY) — Questions 76–150

The log retention and storage settings are managed in the FortiManager's 'FortiView' or 'Device Settings' regarding log management, specifically under 'Log Settings' where disk quota and retention policies are defined.

IPsec encapsulation adds overhead, and if the Path MTU Discovery (PMTUD) fails due to ICMP fragmentation-needed messages being blocked by security profiles or firewalls along the path, packet drops occur for UDP streams exceeding the actual MTU. Adjusting the TCP MSS or enabling ipsec-phase1-interface fragmentation settings/tcp-mss-enforcement resolves this.

SD-WAN rules route internet or specific traffic based on criteria, but traffic between zones (like Guest Wi-Fi to Corporate LAN) is governed by firewall policies. If a firewall policy permits traffic from Guest Wi-Fi directly to Corporate LAN, it bypasses SD-WAN rules because SD-WAN rules only evaluate traffic matching egress SD-WAN zones/interfaces specified by the rule or routing table lookup. To prevent guest traffic from reaching internal subnets, the firewall policy must block or restrict that inter-zone traffic.

When shortcuts time out, routes must cleanly transition back to the hub route without creating transient routing loops. Adjusting route redistribution metrics, using specific distance values, or configuring 'shortcut-routing' / route-map timers / asymmetric routing settings prevents loops. In FortiOS ADVPN, setting appropriate dead timers or using dynamic routing distance adjustments ensures the hub route has a predictable preference when the shortcut drops.

Tunnel mode requires a configured portal and a policy allowing the VPN tunnel interface to the internal network.

In transparent mode, the FortiGate acts as a Layer 2 bridge and will flood the unknown frame to all interfaces in the bridge domain except the incoming port.

The change affects all templates referencing that object; once pushed, the changes update the health check settings on all associated FortiGates.

FortiOS supports a large number of members per zone, typically limited only by the hardware model's scale, not a low fixed number.

ADVPN shortcuts are triggered when traffic matches a shortcut trigger mechanism. In ADVPN 2.0, IPsec phase 1 shortcut settings ('set advpn shortcut') and dynamic routing protocols working together allow the kernel to generate shortcut requests when traffic hits the phase 1 interface.

Dynamic mapping allows you to map a single template object to different physical values (like interface names) on different FortiGate devices.

Workspace mode is required for concurrent editing and locking of policies by multiple administrators.

The gateway for an SD-WAN member is configured within the SD-WAN member settings menu.

Dynamic mapping allows you to associate the 'WAN' member in the template to 'port1' on one branch and 'wan1' on another.

Revision history allows you to compare versions (diff) and restore to a previous state.

Optimizing security profile performance while maintaining inspection includes switching inspection mode to flow-based where appropriate, tuning antivirus/IPS settings to bypass heavy file types or exempt trusted IPs, and leveraging hardware acceleration.

The 'ha-mgmt-status' and virtual MAC features ensure that the cluster presents a consistent MAC regardless of which node is master.

In SD-WAN health check (ping, tcp-echo, http, dns), when HTTP is selected as the server-type, administrators can configure a 'security-string' or 'http-match' / 'expect' string to validate the HTTP response body.

SD-WAN rules match traffic based on Source, Destination, and Application/Service.

The 'Check Configuration' or 'Diff' tool in the Policy & Objects tab allows administrators to compare the database version against the running device configuration to pinpoint the exact setting causing the conflict.

Local Preference is used to influence outbound traffic selection within an AS.

FortiOS provides diagnostic commands to check SD-WAN health check status and SLA metrics. The correct command is 'diagnose sys sdwan health-check'.

Even if the tunnel is up, a policy must exist to allow traffic to flow between the internal network and the tunnel interface.

The 'diag sys top' command displays real-time resource utilization, allowing the admin to identify specific processes like 'ipsengine' consuming CPU.

Flow-based inspection is generally faster and provides better performance than proxy-based inspection.

The Security Fabric integrates multiple devices to provide coordinated, end-to-end security visibility and control.

FortiGate supports both local user databases and integration with external enterprise servers like RADIUS and LDAP.

The configuration file contains system settings, policy rules, and interface definitions.

'Protect' drops the traffic if a signature matches, whereas 'Monitor' logs the hit without dropping the traffic.

HTTP and Telnet are unencrypted protocols and should always be disabled on external interfaces.

FortiAnalyzer provides both pre-defined reports and custom reports for tailored analysis.

Security profiles in FortiOS are always applied within firewall policies, not directly inside SD-WAN rules or interface configurations. The SD-WAN rule handles routing/path selection, while the firewall policy handling that traffic enforces security profiles.

'hb-interval' and 'hb-lost-threshold' determine how quickly the cluster reacts to heartbeat loss.

Firewall policies can accept, deny, or perform traffic shaping and logging depending on the configured profile settings.

The 'session-pickup' setting, specifically 'session-pickup-delay', helps manage the timing and load of session synchronization to prevent CPU spikes.

FortiGate SD-WAN supports multiple probes, including HTTP, Ping, and DNS, to verify link health.

When multiple members meet the SLA in 'SLA Target' mode, the FortiGate uses the member with the best performance metric (e.g., lowest latency).

The FortiGate must be in 'Normal' mode; if it is in 'Backup' or 'Read-only' mode, full management is not possible.

Changing the VDOM mode affects the CLI hierarchy, the available memory for VDOMs, and how system resources are partitioned.

Policy packages include firewall policies, address objects, and services used within those policies.

The election process considers the monitor status, the override setting, and the priority values of the devices.

Administrative accounts can be restricted to specific VDOMs (Global admin vs. VDOM admin) for granular access control.

Centralized policy management, object database management, and revision control are key parts of the enterprise workflow.

Administrative Domains (ADOMs) allow the segregation of managed devices based on geography, customer, or business unit for delegated administration.

SD-WAN rules are evaluated top-down. If a higher-priority rule matches the traffic, the lower-priority rule will never be reached.

The Performance SLA defines the criteria (latency, jitter, loss) that must be met for a path to be considered 'healthy' for traffic.

The 'threshold-alert' or the individual latency/jitter/packet loss thresholds within the Performance SLA configuration dictate when a member is marked failed.

The 'Auto-update' feature in the FortiManager Device Manager ensures that the configuration on the managed device is automatically synchronized with the policy package defined in the FortiManager database.

Weight is a Cisco/FortiOS-specific BGP attribute that is local to the router on which it is configured. It is evaluated first in the BGP best-path selection algorithm, allowing administrators to deterministically force traffic out of a specific SD-WAN/BGP member without affecting other routers in the AS.

The Volume strategy in SD-WAN distributes traffic proportional to the configured volume/weight (bandwidth capacity) of each member interface.

TCL scripts can be used to automate FortiManager functions, whereas CLI scripts typically target the managed devices.

The command 'diagnose sys sdwan health-check' shows the status of configured health checks and member reachability.

SSL Inspection Exemptions allow bypassing decryption for specific categories or domains.

802.3ad Link Aggregation (LACP) is the standard for binding physical ports into a single logical interface.

The FortiASIC CP (Content Processor) hardware chips are specifically designed to offload CPU-intensive tasks like SSL/TLS decryption.

FortiGate supports ping (ICMP), TCP echo, HTTP, and Two-Way Active Measurement Protocol (TWAMP).

Rules use criteria like source/destination address, services, and application signatures to steer traffic.

SD-WAN rules can match traffic based on source IP addresses or specific user groups.

SD-WAN zones are created and managed under the Network > SD-WAN menu.

The 'Revision History' or 'Policy Package cloning' allows admins to modify and verify changes before pushing them to the production devices.

To view runtime statistics and hit counts for SD-WAN rules, the command 'diagnose sys sdwan service' is used.

A configuration backup is mandatory, and checking the release notes for firmware-specific HA behavior is critical for a smooth upgrade.

When an SD-WAN rule bypasses preferred paths, potential causes include SLA health check failure (the preferred link fails the SLA threshold), incorrect rule evaluation order (an earlier rule matches first), or interface priority/weight settings within the rule. Checking these three areas is standard practice.

On high-latency or high-jitter links like satellite connections, the default DPD retry count and interval may be too aggressive. Increasing the DPD retry count and/or interval or switching the DPD mode to 'on-idle' or 'on-demand' helps prevent false drops.

In the Device Manager tab, you can assign an SD-WAN template to multiple devices by selecting them and applying the template.

In 'Lowest Cost (SLA)' mode, the FortiGate selects the member with the lowest configured cost that meets the SLA requirements.

Log compression, log retention settings, and disk quota management determine how long logs persist and how much space they consume.

SD-WAN Monitor within FortiManager provides visibility into performance metrics for all managed SD-WAN devices.

Inter-VDOM links require pairing, routing, and specific interface assignment within the relevant VDOMs.

The 'SD-WAN Zone' object is used in FortiManager to group multiple interfaces together for use in SD-WAN policies.

The 'Any' interface enables the policy to match traffic originating from or destined to any physical or logical interface on the FortiGate.

The 'Device Manager' page lists all managed devices and displays their status (e.g., 'Up', 'Down', 'Synchronized').

'diag hardware npu np6 port-list' or similar status commands help verify the current operational state and mapping of physical ports to NPU cores.

A local firewall policy must exist to permit traffic arriving from the VPN interface and destined for the internal network.

FortiOS SD-WAN rule strategies include Lowest Cost (SLA), Max Bandwidth, Service-ID, Volume, and Priority. Among these, Priority and Lowest Cost (SLA) are standard strategy options utilizing SLA performance metrics.

The fmg_debug.log or the task monitor logs show the specific CLI commands being pushed and the FortiGate response.