Fortinet NSE7 Specialty Modules (SD-WAN and Enterprise Firewall tracks) (FORTINET-NSE7-SPECIALTY) (FORTINET-NSE7-SPECIALTY) — Questions 151–191

The 'Source' field allows you to selectively apply SD-WAN rules based on specific traffic origins, such as a subnet or user group.

Provisioning Templates allow you to define configuration settings that are applied automatically when the device registers with the FortiManager.

HA synchronization ensures that policies, objects, and configurations are mirrored to provide seamless failover.

They isolate heartbeat traffic from data traffic to prevent jitter and ensure cluster stability.

When using SSL Full Inspection (DPI), the FortiGate acts as a man-in-the-middle and re-signs certificates using a Certificate Authority (CA) certificate. This CA certificate must be installed and trusted on the client devices.

FortiGuard provides real-time updates for security signatures, including IPS, Antivirus, and Web Filtering.

When a static route points to an SD-WAN zone as its gateway, the FortiOS routing table delegates the packet forwarding decision to the SD-WAN engine, which then evaluates SD-WAN rules to select the best member interface.

Policy Packages allow for the grouping of policies, while the use of 'Global Policy' or 'Package Inheritance' allows for common policies to be shared across various ADOMs or device groups.

When configuring IPsec tunnels for SD-WAN, setting the interface as a member of an SD-WAN zone and ensuring correct Phase 2 selectors or mode-cfg / routing settings are essential. Specifically, setting the interface to allow traffic, defining appropriate Phase 2 selectors or using 0.0.0.0/0 with route-based VPNs, and assigning it to an SD-WAN zone are critical.

It specifies how long the FortiGate waits after sending a TCP RST packet before clearing the session from the session table.

Central management enables consistent SD-WAN policy deployment, simplified configuration management across large-scale deployments, and centralized monitoring.

Zones allow you to assign generic names to interfaces, so the template can refer to 'WAN_ZONE' rather than specific port names.

Traffic that requires complex inspection, such as encrypted traffic that hasn't been decrypted or specific types of tunnels without hardware support, is handled by the CPU.

Performance SLA evaluates paths based on measured latency, jitter, and packet loss compared to defined thresholds.

SD-WAN templates are specifically designed for mass deployment of standardized configurations.

In an HA cluster, devices must share identical HA group IDs, passwords, and heartbeats to form a cluster.

The workflow involves selecting the package, choosing the target device, and executing the installation (with a preview).

Centralized policy packages allow you to enforce security and SD-WAN routing rules consistently across the entire organization from one location.

The install process begins with an 'Install Preview' to verify the configuration changes before they are actually pushed to the device.

NAT-T encapsulates ESP packets in UDP 4500 to allow them to pass through NAT devices that would otherwise break ESP integrity.

Host check allows the FortiGate to verify the presence of specific software like Antivirus before allowing the VPN connection.

SSH with key-based authentication or HTTPS with restricted access is standard; HTTPS is common for GUI access.

In 'Priority' strategy, if the highest priority member becomes unhealthy (SLA failure), the traffic automatically fails over to the next highest priority member.

Phase 2 failure is usually due to mismatched selectors (proxy IDs) or mismatched encryption/authentication algorithms.

To troubleshoot BGP routing issues on FortiOS, commands examining the BGP summary, advertised routes, and received routes are essential. These include 'get router info bgp summary' and 'get router info bgp neighbors <ip> advertised-routes'.

Hardware acceleration (ASIC) and selecting efficient encryption algorithms like AES-NI (hardware-accelerated AES) improve VPN throughput.

SD-WAN provides link aggregation, intelligent path selection, and simplified WAN management.

FortiOS SD-WAN health check SLA criteria evaluate packet loss, jitter, latency, and threshold failures. When multiple criteria or probes are used, settings such as latency-threshold, packet-loss-threshold, jitter-threshold, and failtime/restoretime determine state transitions.

Troubleshooting ADVPN shortcut failures requires checking IPsec status, IKE exchanges, routing table entries, and network device creation. Valid diagnostic steps include checking IKE daemon output, verifying IPsec tunnel status, and inspecting routing table entries for shortcut triggers.

IPS inspection performs deep packet inspection and signature matching, which is CPU-intensive. While NP6/NP7 hardware offloading accelerates IPsec encryption, full content inspection like IPS typically requires CPU processing unless offloaded or optimized. Using flow-based inspection or hardware offloading settings where supported helps mitigate performance impact.

Deployment requires defining the template, assigning it to devices, and installing the configuration.

Administrators create 'Administrator Profiles' to restrict access to specific modules and permissions.

To configure an SLA, you must define the destination IP (or server) and the probe protocol.

For SD-WAN rules based on applications or destination services to take effect, the matching firewall policy must have application control or appropriate inspection enabled, or the SD-WAN rule position/criteria order must match correctly. Furthermore, explicit proxy or policy routing interactions can interfere if implicit firewall rules intercept the traffic first.

You must define the members (interfaces) and the rules (policies) that dictate how traffic is steered.

'SLA Target' strategy allows you to set specific criteria like jitter, latency, and packet loss, and select the best interface for those metrics.

Device templates are used for system-level settings like DNS, NTP, and local interface configurations.

Any change made in the FortiManager policy or template objects requires a push to keep the device config synchronized.

Robust BGP over SD-WAN requires configuring the BGP router ID, setting up appropriate timers or neighbor relationships, and ensuring that the underlying SD-WAN members and IPsec tunnels allow routing protocol traffic. Additionally, managing BGP timers or enabling graceful restart helps maintain stability during brief IPsec reconnections.

IPS is designed to detect and block threats in common protocols like HTTP, FTP, and SMTP.

An interface is marked down if the probe fails to receive a response or if the response exceeds configured thresholds.