Administration Guide

• Getting started
  • Using the GUI
    • Connecting using a web browser
    • Menus
    • Tables
    • Entering values
      • Text strings
      • Numbers
  • Using the CLI
    • Connecting to the CLI
    • CLI basics
    • Command syntax
    • Subcommands
    • Permissions
  • FortiExplorer for iOS
    • Getting started with FortiExplorer
    • Connecting FortiExplorer to a FortiGate via WiFi
    • Running a security rating
    • Upgrading to FortiExplorer Pro
  • Basic administration
    • Registration
    • FortiCare and FortiGate Cloud login
    • Transfer a device to another FortiCloud account
    • Configuration backups
  • Troubleshooting your installation
  • Zero touch provisioning
    • Zero touch provisioning with FortiDeploy
    • Zero touch provisioning with FortiManager
• Dashboards and widgets
  • Using dashboards
  • Viewing device dashboards in the security fabric
  • Creating a fabric system and license dashboard
  • Using widgets
  • Changing the default dashboard template
  • Monitor dashboards and widgets
    • Static & Dynamic Routing Monitor
    • DHCP monitor
    • IPSEC monitor
    • SSL VPN monitor
    • Firewall Users Monitor
    • Wifi Dashboard
      • FortiAP Status monitor
      • Clients by FortiAP monitor
    • Device inventory
      • Device inventory and filtering
      • Adding MAC-based addresses to devices
  • FortiView
    • FortiView monitors and widgets
    • Adding FortiView widgets
    • VDOMs and dashboards
    • FortiView interface
    • FortiView from disk
    • FortiView from FortiAnalyzer
    • FortiView from FortiGate Cloud
    • FortiView sources
    • FortiView Sessions
    • Viewing top websites and sources by category
    • Cloud application view
      • Top application: YouTube example
      • FortiView Top Source and Top Destination Firewall Objects widgets
    • Viewing session information for a compromised host
• Fortinet Security Fabric
  • Security Fabric settings and usage
    • Components
    • Configuring the root FortiGate and downstream FortiGates
    • Configuring FortiAnalyzer
    • Configuring other Security Fabric devices
      • FortiGate Cloud
      • FortiAnalyzer Cloud service
      • FortiManager
      • FortiManager Cloud service
      • FortiSandbox
      • FortiClient EMS
      • Synchronizing FortiClient EMS tags and configurations
      • FortiNAC
      • FortiAP and FortiSwitch
      • FortiMail
      • Additional devices
    • Using the Security Fabric
      • Dashboard widgets
      • Topology
      • Topology view — consolidated risk
      • Viewing and controlling network risks via topology view
    • Deploying the Security Fabric
    • Synchronizing objects across the Security Fabric
    • Security Fabric over IPsec VPN
    • Leveraging LLDP to simplify security fabric negotiation
  • Configuring the Security Fabric with SAML
    • Configuring single-sign-on in the Security Fabric
      • Configuring the root FortiGate as the IdP
      • Configuring a downstream FortiGate as an SP
      • Configuring certificates for SAML SSO
      • Verifying the single-sign-on configuration
    • CLI commands for SAML SSO
    • SAML SSO with pre-authorized FortiGates
    • Navigating between Security Fabric members with SSO
    • Integrating FortiAnalyzer management using SAML SSO
    • Integrating FortiManager management using SAML SSO
    • Advanced option - FortiGate SP changes
    • Advanced option - unique SAML attribute types
  • Security rating
    • Security Fabric score
  • External connectors
    • SDN connectors
      • AliCloud SDN connector
      • AWS SDN connector with IAM credentials
      • Azure Stack SDN connector
      • Azure SDN connector for non-VM resources
      • Azure SDN connector ServiceTag and Region filter keys
      • IBM Cloud SDN connector
      • VMware ESXi SDN connector
      • VMware NSX-T manager SDN connector
      • OpenStack (Horizon) SDN connector with domain filter
      • OCI SDN connector
      • ClearPass endpoint connector via FortiManager
      • Cisco pxGrid fabric connector
      • Cisco ACI SDN connector
      • Cisco ACI SDN connector with direct connection
      • Nuage SDN connector
      • Multiple concurrent SDN connectors
      • Filter lookup in SDN connectors
      • Support for wildcard SDN connectors in filter configurations
    • Kubernetes (K8s) SDN connectors
      • Private Cloud K8s SDN connector
      • AWS Kubernetes (EKS) SDN connector
      • GCP Kubernetes (GKE) SDN connector
      • Azure Kubernetes (AKS) SDN connector
      • Oracle Kubernetes (OKE) SDN connector
    • Endpoint/Identity connectors
      • Fortinet single sign-on agent
      • Poll Active Directory server
      • Symantec endpoint connector
      • RADIUS single sign-on agent
      • Exchange Server connector
    • Threat feeds
      • External blocklist – Policy
      • External blocklist - Authentication
      • External blocklist - File hashes
      • External resources for DNS filter
  • Automation stitches
    • Creating automation stitches
      • Default automation stitches
      • Chaining and delaying actions
    • Triggers
      • FortiAnalyzer event handler trigger
    • Actions
      • CLI script action
      • Quarantine via FortiNAC action
      • Assign VMware NSX security tag action
      • Assign VMware NSX-T security tag action
      • AWS Lambda action
      • Azure Function action
      • Google Cloud Function action
      • AliCloud Function action
      • Slack notification action
      • Webhook action
      • Slack integration webhook
      • Microsoft Teams integration webhook
    • Execute a CLI script based on CPU and memory thresholds
  • Monitoring the Security Fabric using FortiExplorer for Apple TV
    • NOC and SOC example
      • Adding the root FortiGate to FortiExplorer for Apple TV
      • Viewing the Fabric Topology monitor
      • Viewing the Fabric Overview monitor
      • Viewing the Security Rating monitor
      • Viewing the Compromised Hosts monitor
      • Viewing the Vulnerability Monitor
      • Using the SD-WAN monitor
  • Troubleshooting
    • Viewing a summary of all connected FortiGates in a Security Fabric
    • Diagnosing automation stitches
• Network
  • Interfaces
    • Interface settings
    • Aggregation and redundancy
    • VLANs
    • Enhanced MAC VLANs
    • Inter-VDOM routing
    • Software switch
    • Hardware switch
    • Zone
    • Virtual Wire Pair
    • Virtual switch support for FortiGate 300E series
    • Failure detection for aggregate and redundant interfaces
    • VLAN inside VXLAN
    • Virtual Wire Pair with VXLAN
    • QinQ
    • Assign a subnet with the FortiIPAM service
    • Configure a VRF ID on an interface
  • DNS
    • Important DNS CLI commands
    • DNS domain list
    • FortiGate DNS server
    • DDNS
    • DNS latency information
    • DNS over TLS
    • DNS troubleshooting
  • Explicit and transparent proxies
    • Explicit web proxy
    • FTP proxy
    • Transparent proxy
    • Proxy policy addresses
    • Proxy policy security profiles
    • Explicit proxy authentication
    • Transparent web proxy forwarding
    • Upstream proxy authentication in transparent proxy mode
    • Multiple dynamic header count
    • Restricted SaaS access (Office 365, G Suite, Dropbox)
    • Explicit proxy and FortiSandbox Cloud
    • Proxy chaining (web proxy forwarding servers)
    • Agentless NTLM authentication for web proxy
  • DHCP server
    • DHCP options
    • IP address assignment with relay agent information option
    • DHCP client options
  • Static routes
  • Policy routes
    • Configuring a policy route
  • RIP
  • OSPF
  • BGP
  • Multicast
    • Multicast routing and PIM support
    • Configuring multicast forwarding
  • FortiExtender
    • Adding a FortiExtender
    • Data plan profiles
  • Direct IP support for LTE/4G
  • LLDP reception
  • Route leaking between VRFs
• SD-WAN
  • SD-WAN quick start
    • Configuring the SD-WAN interface
    • Adding a static route
    • Selecting the implicit SD-WAN algorithm
    • Configuring firewall policies for SD-WAN
    • Link monitoring and failover
    • Results
    • Configuring SD-WAN in the CLI
  • SD-WAN zones
  • Performance SLA
    • Link health monitor
    • Factory default health checks
    • Health check options
    • Link monitoring example
    • SLA targets example
    • Health check packet DSCP marker support
    • Interface speedtest
    • Monitor performance SLA
    • SLA monitoring using the REST API
  • SD-WAN rules
    • Implicit rule
    • Best quality strategy
    • Lowest cost (SLA) strategy
    • Maximize bandwidth (SLA) strategy
    • Minimum number of links for a rule to take effect
    • Use MAC addresses in SD-WAN rules and policy routes
    • SD-WAN traffic shaping and QoS
    • SDN dynamic connector addresses in SD-WAN rules
    • Application steering using SD-WAN rules
      • Static application steering with a manual strategy
      • Dynamic application steering with lowest cost and best quality strategies
    • DSCP tag-based traffic steering in SD-WAN
      • Configuring IPsec tunnels
      • Configuring SD-WAN zones
      • Configuring firewall policies
      • Configuring Performance SLA test
      • Configuring SD-WAN rules
      • Results
  • Advanced routing
    • Self-originating traffic
    • Using BGP tags with SD-WAN rules
    • BGP multiple path support
    • Controlling traffic with BGP route mapping and service rules
    • Applying BGP route-map to multiple BGP neighbors
    • IBGP and EBGP support in VRF
  • VPN overlay
    • ADVPN and shortcut paths
    • SD-WAN monitor on ADVPN shortcuts
    • SD-WAN integration with OCVPN
    • Forward error correction on VPN overlay networks
    • Dual VPN tunnel wizard
    • Duplicate packets on other zone members
  • Advanced configuration
    • SD-WAN with FGCP HA
    • Configuring SD-WAN in an HA cluster using internal hardware switches
    • SD-WAN configuration portability
  • SD-WAN cloud on-ramp
    • Configuring the VPN overlay between the HQ FortiGate and cloud FortiGate-VM
    • Configuring the VPN overlay between the HQ FortiGate and AWS native VPN gateway
    • Configuring the VIP to access the remote servers
    • Configuring the SD-WAN to steer traffic between the overlays
    • Verifying the traffic
  • Hub and spoke SD-WAN deployment example
    • Datacenter configuration
      • Configure dial-up (dynamic) VPN
      • Configure VPN interfaces
      • Configure loopback interface
      • Configure BGP
      • Firewall policies
      • Configure a black hole route
    • Branch configuration
      • Configure VPN to the hub
      • Configure VPN interfaces
      • Configure BGP
      • Configure SD-WAN
      • Firewall configuration
    • Validation
    • Dynamic definition of SD-WAN routes
    • Adding another datacenter
  • Troubleshooting SD-WAN
    • Tracking SD-WAN sessions
    • Understanding SD-WAN related logs
    • SD-WAN related diagnose commands
    • SD-WAN bandwidth monitoring service
• System
  • Administrators
    • Administrator profiles
    • Add a local administrator
    • Remote authentication for administrators
    • Password policy
    • Admin profile option for diagnose access
    • Associating a FortiToken to an administrator account
    • SSO administrators
  • Firmware
    • Firmware upgrade notifications
    • Downloading a firmware image
    • Testing a firmware version
    • Upgrading the firmware
    • Downgrading to a previous firmware version
    • Installing firmware from system reboot
    • Restoring from a USB drive
    • Controlled upgrade
  • Settings
    • Default administrator password
    • Changing the host name
    • Setting the system time
      • SHA-1 authentication support (for NTPv4)
      • PTPv2
    • Configuring ports
      • Custom default service port range
    • Setting the idle timeout time
    • Setting the password policy
    • Changing the view settings
    • Setting the administrator password retries and lockout time
    • TLS configuration
  • Virtual Domains
    • Global and per-VDOM resources
    • Split-task VDOM mode
      • Assign interfaces to a VDOM
      • Create per-VDOM administrators
    • Multi VDOM mode
      • Multi VDOM configuration examples
        • NAT mode
        • NAT and transparent mode
  • High Availability
    • Introduction to the FGCP cluster
    • Failover protection
    • FGSP (session synchronization) peer setup
    • UTM inspection on asymmetric traffic in FGSP
    • UTM inspection on asymmetric traffic on L3
    • Encryption for L3 on asymmetric traffic in FGSP
    • Synchronizing sessions between FGCP clusters
    • Using standalone configuration synchronization
    • Troubleshoot an HA formation
    • Check HA sync status
    • Disabling stateful SCTP inspection
    • Upgrading FortiGates in an HA cluster
    • HA cluster setup examples
      • HA active-passive cluster setup
      • HA active-active cluster setup
      • HA virtual cluster setup
      • HA using a hardware switch to replace a physical switch
    • HA between remote sites over managed FortiSwitches
    • Routing data over the HA management interface
    • Override FortiAnalyzer and syslog server settings
    • Force HA failover for testing and demonstrations
    • Querying autoscale clusters for FortiGate VM
  • SNMP
    • Interface access
    • MIB files
    • SNMP agent
    • SNMP v1/v2c communities
    • SNMP v3 users
    • Important SNMP traps
    • SNMP traps and query for monitoring DHCP pool
  • Replacement messages
  • Replacement message groups
  • FortiGuard
    • IPv6 FortiGuard connections
    • Configuring FortiGuard updates
    • Manual updates
    • Automatic updates
    • Sending malware statistics to FortiGuard
    • Update server location
    • Filtering
    • Override FortiGuard servers
    • Online security tools
    • FortiGuard anycast and third-party SSL validation
    • Using FortiManager as a local FortiGuard server
    • Cloud service communication statistics
    • IoT detection service
    • FortiAP query to FortiGuard IoT service to determine device details
  • Feature visibility
  • Certificates
    • Microsoft CA deep packet inspection
    • Purchase and import a signed SSL certificate
  • Configuration scripts
  • Workspace mode
  • Custom languages
• Policy and Objects
  • Policies
    • Firewall policy parameters
    • Profile-based NGFW vs policy-based NGFW
    • NGFW policy mode application default service
    • Application logging in NGFW policy mode
    • Policy views and policy lookup
    • Policy with source NAT
      • Static SNAT
      • Dynamic SNAT
      • Central SNAT
      • Configuring an IPv6 SNAT policy
      • SNAT policies with virtual wire pairs
    • Policy with destination NAT
      • Static virtual IPs
      • Virtual IP with services
      • Virtual IPs with port forwarding
      • Virtual server
    • Policy with Internet Service
      • Using Internet Service in policy
      • Using custom Internet Service in policy
      • Using extension Internet Service in policy
      • Global IP address information database
      • IP reputation filtering
      • Internet service groups in policies
      • Allow creation of ISDB objects with regional information
      • Internet service customization
    • NAT64 policy and DNS64 (DNS proxy)
    • NAT46 policy
    • Local-in policies
    • IPv4/IPv6 access control lists
    • Mirroring SSL traffic in policies
    • Inspection mode per policy
    • OSPFv3 neighbor authentication
    • Firewall anti-replay option per policy
    • Enabling advanced policy options in the GUI
    • Recognize anycast addresses in geo-IP blocking
    • Matching GeoIP by registered and physical location
    • Authentication policy extensions
    • HTTP to HTTPS redirect for load balancing
    • GTPv2 in policies
    • Use active directory objects directly in policies
    • FortiGate Cloud / FDN communication through an explicit proxy
    • No session timeout
    • MAP-E support
  • Objects
    • Address group exclusions
    • MAC addressed-based policies
    • ISDB well-known MAC address list
    • Dynamic policy — fabric devices
    • FSSO dynamic address subtype
    • ClearPass integration for dynamic address objects
    • Group address objects synchronized from FortiManager
    • Using wildcard FQDN addresses in firewall policies
    • Configure FQDN-based VIPs
    • IPv6 geography-based addresses
    • Array structure for address objects
    • IPv6 MAC addresses and usage in firewall policies
  • Traffic shaping
    • Determining your QoS requirements
    • Packet rates
    • Changing traffic shaper bandwidth unit of measurement
    • Shared traffic shaper
    • Per-IP traffic shaper
    • Type of Service-based prioritization and policy-based traffic shaping
    • Interface-based traffic shaping profile
    • Interface-based traffic shaping with NP acceleration
    • Classifying traffic by source interface
    • Configuring traffic class IDs
    • Traffic shaping schedules
    • DSCP matching (shaping)
    • QoS assignment and rate limiting for quarantined VLANs
    • Weighted random early detection queuing
• Security Profiles
  • Inspection modes
    • Flow mode inspection (default mode)
    • Proxy mode inspection
    • Inspection mode feature comparison
  • Antivirus
    • Databases
    • Content disarm and reconstruction for antivirus
    • FortiGuard outbreak prevention
    • External malware block list for antivirus
    • Checking flow antivirus statistics
    • CIFS support
    • Using FortiSandbox appliance with antivirus
    • Using FortiSandbox Cloud with antivirus
  • Web filter
    • URL filter
    • FortiGuard filter
    • Credential phishing prevention
    • Usage quota
    • Web content filter
    • Advanced filters 1
    • Advanced filters 2
    • Reliable web filter statistics
    • Flow-based web filtering
    • URL certificate blocklist
  • DNS filter
    • Configure and apply a DNS filter profile
    • FortiGuard category-based DNS domain filtering
    • Botnet C&C domain blocking
    • DNS safe search
    • Local domain filter
    • DNS translation
    • Using a FortiGate as a DNS server
    • Troubleshooting for DNS filter
  • Application control
    • Basic category filters and overrides
    • Port enforcement check
    • Protocol enforcement
    • SSL-based application detection over decrypted traffic in a sandwich topology
    • Matching multiple parameters on application control signatures
  • Intrusion prevention
    • Botnet C&C IP blocking
    • Detecting IEC 61850 MMS protocol in IPS
    • IPS signature filter options
  • File filter
    • Supported file types
  • Email filter
    • Local-based filters
    • FortiGuard-based filters
    • Protocols and actions
    • Configuring webmail filtering
  • Data leak prevention
    • Basic DLP filter types
    • DLP fingerprinting
    • DLP watermarking
  • VoIP solutions
    • General use cases
    • SIP message inspection and filtering
    • SIP pinholes
    • SIP over TLS
    • Custom SIP RTP port range support
    • Voice VLAN auto-assignment
  • ICAP
    • ICAP configuration example
    • ICAP response filtering
  • Web application firewall
    • Protecting a server running web applications
  • SSL & SSH Inspection
    • Certificate inspection
    • Deep inspection
    • Protecting an SSL server
    • Ignoring the AUTH TLS command
    • SSH traffic file scanning
    • Redirect to WAD after handshake completion
  • Custom signatures
    • Application groups in policies
    • Blocking applications with custom signatures
  • Overrides
    • Web rating override
    • Web profile override
• VPN
  • IPsec VPNs
    • General IPsec VPN configuration
      • Network topologies
      • Phase 1 configuration
        • Choosing IKE version 1 and 2
        • Pre-shared key vs digital certificates
        • Using XAuth authentication
        • Dynamic IPsec route control
        • Dynamic tunnel interface creation
      • Phase 2 configuration
      • VPN security policies
      • Blocking unwanted IKE negotiations and ESP packets with a local-in policy
    • Site-to-site VPN
      • Basic site-to-site VPN with pre-shared key
      • Site-to-site VPN with digital certificate
      • GRE over IPsec
      • Policy-based IPsec tunnel
      • IKEv2 IPsec site-to-site VPN to an AWS VPN gateway
      • IPsec VPN to Azure with virtual network gateway
      • IPsec VPN to an Azure with virtual WAN
      • IPSec VPN between a FortiGate and a Cisco ASA with multiple subnets
    • Remote access
      • FortiGate as dialup client
      • FortiClient as dialup client
      • Add FortiToken multi-factor authentication
      • Add LDAP user authentication
      • iOS device as dialup client
      • IPsec VPN with external DHCP service
      • L2TP over IPsec
      • Tunneled Internet browsing
    • Aggregate and redundant VPN
      • OSPF with IPsec VPN for network redundancy
      • IPsec VPN in an HA environment
      • Adding IPsec aggregate members in the GUI
      • Represent multiple IPsec tunnels as a single interface
      • IPsec aggregate for redundancy and traffic load-balancing
      • Per packet distribution and tunnel aggregation
      • Redundant hub and spoke VPN
      • Weighted round robin for IPsec aggregate tunnels
    • Overlay Controller VPN (OCVPN)
      • Full mesh OCVPN
      • Hub-spoke OCVPN with ADVPN shortcut
      • Hub-spoke OCVPN with inter-overlay source NAT
      • OCVPN portal
      • Allow FortiClient to join OCVPN
      • Troubleshooting OCVPN
    • ADVPN
      • IPsec VPN wizard hub-and-spoke ADVPN support
      • ADVPN with BGP as the routing protocol
      • ADVPN with OSPF as the routing protocol
      • ADVPN with RIP as the routing protocol
      • UDP hole punching for spokes behind NAT
    • Other VPN topics
      • VPN and ASIC offload
      • Encryption algorithms
      • Fragmenting IP packets before IPsec encapsulation
      • VXLAN over IPsec tunnel
      • Defining gateway IP addresses in IPsec with mode-config and DHCP
      • FQDN support for remote gateways
    • VPN IPsec troubleshooting
      • Understanding VPN related logs
      • IPsec related diagnose commands
  • SSL VPN
    • SSL VPN best practices
    • SSL VPN quick start
      • SSL VPN split tunnel for remote user
      • Connecting from FortiClient VPN client
      • Set up FortiToken multi-factor authentication
      • Connecting from FortiClient with FortiToken
    • SSL VPN tunnel mode
      • SSL VPN full tunnel for remote user
      • SSL VPN tunnel mode host check
    • SSL VPN web mode for remote user
      • Quick Connection tool
    • SSL VPN authentication
      • SSL VPN with LDAP user authentication
      • SSL VPN with LDAP user password renew
      • SSL VPN with LDAP-integrated certificate authentication
      • SSL VPN for remote users with MFA and user case sensitivity
      • SSL VPN with FortiToken mobile push authentication
      • SSL VPN with RADIUS on FortiAuthenticator
      • SSL VPN with RADIUS and FortiToken mobile push on FortiAuthenticator
      • SSL VPN with RADIUS password renew on FortiAuthenticator
      • SSL VPN with RADIUS on Windows NPS
      • SSL VPN with multiple RADIUS servers
      • SSL VPN with local user password policy
      • SSL VPN with certificate authentication
      • Dynamic address support for SSL VPN policies
      • SSL VPN multi-realm
      • NAS-IP support per SSL-VPN realm
    • SSL VPN to IPsec VPN
    • SSL VPN protocols
      • TLS 1.3 support
      • SMBv2 support
    • SSL VPN troubleshooting
      • Debug commands
      • Troubleshooting common issues
• User & Authentication
  • Endpoint control and compliance
    • Per-policy disclaimer messages
    • Compliance
      • FortiSandbox Cloud region selection
      • FortiGate VM unique certificate
      • Running a file system check automatically
    • FortiGuard distribution of updated Apple certificates
  • User Definition
    • User types
    • Removing a user
  • User Groups
    • Configuring POP3 authentication
  • Guest Management
    • Configuring guest access
    • Retail environment guest access
  • LDAP Servers
    • Configuring an LDAP server
    • FSSO polling connector agent installation
    • Enabling Active Directory recursive search
    • Configuring LDAP dial-in using a member attribute
    • Configuring wildcard admin accounts
    • Configuring least privileges for LDAP admin account authentication in Active Directory
  • RADIUS Servers
    • Configuring RADIUS SSO authentication
    • RSA ACE (SecurID) servers
    • Support for Okta RADIUS attributes filter-Id and class
    • Send multiple RADIUS attribute values in a single RADIUS Access-Request
  • TACACS+ servers
  • SAML
    • Outbound firewall authentication for a SAML user
    • SAML SP for VPN authentication
  • Authentication Settings
  • FortiTokens
    • FortiToken Mobile Quick Start Guide
      • Registering FortiToken Mobile
      • Provisioning FortiToken Mobile
      • Activating FortiToken Mobile on a Mobile Phone
      • Applying Multi-Factor Authentication
    • FortiToken Cloud
    • Registering hard tokens
    • Managing FortiTokens
    • FortiToken Mobile Push
    • Troubleshooting and diagnosis
  • Configuring the maximum log in attempts and lockout period
  • PKI
    • Creating a PKI/peer user
  • Configuring firewall authentication
• Wireless configuration
• Switch Controller
  • FortiLink setup
  • Viewing managed FortiSwitches
  • Register FortiSwitch to FortiCloud
  • VLAN interface templates for FortiSwitches
  • FortiLink auto network configuration policy
  • FortiLink network sniffer extension
  • FortiLink MCLAG configuration
  • Allow FortiSwitch Trunk mode selection on FortiGate
  • Standalone FortiGate as switch controller
    • Standalone FortiGate as switch controller
    • Multiple FortiSwitches managed via hardware/software switch
    • Multiple FortiSwitches in tiers via aggregate interface with redundant link enabled
    • Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled only on distribution
  • HA (A-P) mode FortiGate pairs as switch controller
    • Multiple FortiSwitches managed via hardware/software switch
    • Multiple FortiSwitches in tiers via aggregate interface with redundant link enabled
    • Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled only on distribution
    • Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled on all tiers
  • Authentication and security
    • MAC-based 802.1X authentication
    • Port-based 802.1X authentication
    • MAC layer control - Sticky MAC and MAC Learning-limit
    • Quarantine
    • Inter-operability with per instance RSTP 802.1w
  • Flow and device detection
    • Data statistic
    • Security Fabric showing
    • NAC policies on switch ports
    • EMS tags in NAC policies
    • Use FortiSwitch to query FortiGuard IoT service for device details
    • Voice device detection
  • FortiSwitch multi-tenant support
  • Persistent MAC learning
  • Split port mode (for QSFP / QSFP28)
  • Dynamic VLAN name assignment from RADIUS attribute
  • MPSK groups
  • MSTI support
  • Netflow and IPFIX support
  • ECN configuration for managed FortiSwitch devices
  • PTP transparent clock mode configuration for managed FortiSwitch devices
• Log and Report
  • Viewing event logs
  • Sample logs by log type
  • Log buffer on FortiGates with an SSD disk
  • Checking the email filter log
  • Supported log types to FortiAnalyzer, syslog, and FortiAnalyzer Cloud
  • Configuring multiple FortiAnalyzers on a multi-VDOM FortiGate
  • Configuring multiple FortiAnalyzers (or syslog servers) per VDOM
  • Source and destination UUID logging
  • Logging the signal-to-noise ratio and signal strength per client
  • RSSO information for authenticated destination users in logs
  • Threat weight
  • Troubleshooting
    • Log-related diagnose commands
    • Backing up log files or dumping log messages
    • SNMP OID for logs that failed to send
• VM
  • Amazon Web Services
  • Microsoft Azure
  • Google Cloud Platform
  • Oracle OCI
  • AliCloud
  • Private cloud
  • VM license
  • FortiGate multiple connector support
  • Adding VDOMs with FortiGate v-series
  • Terraform: FortiOS as a provider
  • PF SR-IOV driver support
• Troubleshooting
  • Troubleshooting methodologies
  • Troubleshooting scenarios
    • Checking the system date and time
    • Checking the hardware connections
    • Checking FortiOS network settings
    • Troubleshooting CPU and network resources
    • Troubleshooting high CPU usage
    • Checking the modem status
    • Running ping and traceroute
    • Checking the logs
    • Verifying routing table contents in NAT mode
    • Verifying the correct route is being used
    • Verifying the correct firewall policy is being used
    • Checking the bridging information in transparent mode
    • Checking wireless information
    • Performing a sniffer trace (CLI and packet capture)
    • Debugging the packet flow
    • Testing a proxy operation
    • Displaying detail Hardware NIC information
    • Performing a traffic trace
    • Using a session table
    • Finding object dependencies
    • Diagnosing NPU-based interfaces
    • Identifying the XAUI link used for a specific traffic stream
    • Running the TAC report
    • Other commands
      • ARP table
      • IP address
    • FortiGuard troubleshooting
      • Verifying connectivity to FortiGuard
      • Troubleshooting process for FortiGuard updates
      • FortiGuard server settings
  • Additional resources
• Change Log