Fortinet FCP_FGT_AD-7.4 - FCP - FortiGate 7.4 Administrator

To disable RPF (Reverse Path Forwarding) checking on a FortiGate interface, you need to disable the src-check option in the interface settings. This action disables the RPF check, allowing traffic to bypass the verification that it is arriving on the correct interface based on the routing table.

IPsec security associations

IPsec security associations (SAs) are synchronized between HA members to ensure seamless failover and continuity of VPN tunnels.

DHCP leases

DHCP lease information is synchronized between HA members to maintain consistent IP address assignments and prevent disruptions when failover occurs.

The SSL VPN is configured to listen on port11443on the FortiGate device, as shown in the SSL VPN settings in the exhibit. However, the user is attempting to connect to the server using port1443, as displayed in the VPN connection status. The mismatch between the ports is causing the connection failure. To resolve this, the user should change the client configuration to use port11443to match the FortiGate SSL VPN configuration.

If the SD-WAN traffic logs do not show the specific SD-WAN rule name, it likely means that FortiGate is using the default or implicit SD-WAN rule to balance traffic. The implicit rule comes into effect when no explicit SD-WAN rule is matched, and as a result, the SD-WAN rule name is not displayed in the logs. The default behavior is to load balance the traffic across available interfaces based on SD-WAN strategy.

In flow-based inspection mode, FortiGate sends a reset (RST) packet to the client instead of providing a replacement message, which causes the block message not to be displayed.

To consolidate the two separate firewall policies for Sales and Engineering departments accessing the same web server, you can create an Interface Group that includes bothport1(Sales) andport2(Engineering). Once the Interface Group is created, you can use this group as a single incoming interface in a single firewall policy. This approach reduces the number of policies, making management more efficient.

References:

FortiOS 7.4.1 Administration Guide: Firewall Policy Configuration

For a high-latency internet connection, the SSL VPN setting that should be adjusted is:

C. SSL VPN dtls-hello-timeout:This setting determines how long the FortiGate will wait for a DTLS hello message from the client. For high-latency connections, increasing this timeout will prevent SSL VPN negotiation failures caused by delays in receiving the DTLS hello message.

The other options are not suitable:

A. SSL VPN idle-timeout:This setting controls the idle time allowed before a session is terminated, which is not relevant to the initial connection establishment.

B. SSL VPN login-timeout:This setting controls the maximum time allowed for a user to log in, but does not affect connection negotiation.

D. SSL VPN session-ttl:This setting controls the total time-to-live for an SSL VPN session but does not directly address issues caused by high latency.

References

FortiOS 7.4.1 Administration Guide -SSL VPN Configuration, page 1415.