Fortinet FCSS_EFW_AD-7.6 - Fortinet NSE 7 - Enterprise Firewall 7.6 Administrator

The set tcp-mss-sender and set tcp-mss-receiver commands in a firewall policy allow an administrator to adjust the Maximum Segment Size (MSS) of TCP packets.

This setting controls the largest payload size that a device can handle in a single TCP segment, ensuring that packets do not exceed the allowed MTU (Maximum Transmission Unit) along the network path.

● set tcp-mss-sender adjusts the MSS value for outgoing TCP traffic.

● set tcp-mss-receiver adjusts the MSS value for incoming TCP traffic.

This helps prevent issues with fragmentation and MTU mismatches, improving network performance and avoiding retransmissions.

The FortiGate SSL/SSH inspection profile is configured for Full SSL Inspection, which is necessary to analyze encrypted HTTPS traffic. However, the firewall policy is protecting an SSL server (the Linux server hosting the website), and currently, the SSL/SSH profile only applies to client-side SSL inspection.

To detect HTTPS-based attacks targeting the Linux server:

● FortiGate must act as an SSL intermediary to inspect encrypted traffic destined for the web server.

● The administrator must upload the SSL certificate of the Linux web server to FortiGate so that the server-side SSL inspection can decrypt incoming HTTPS traffic before analyzing it.

This IPsec Phase 1 configuration defines a dynamic VPN tunnel that can accept connections from multiple peers. The settings chosen here suggest a configuration optimized for networks with intermittent traffic patterns while ensuring resources are used efficiently.

Key configurations and their impact:

● set type dynamic → This allows multiple peers to establish connections dynamically without needing predefined IP addresses.

● set ike-version 2 → Uses IKEv2, which is more efficient and supports features like EAP authentication and reduced rekeying overhead.

● set dpd on-idle → Dead Peer Detection (DPD) is triggered only when the tunnel is idle, reducing unnecessary keep-alive packets and improving resource utilization.

● set add-route enable → FortiGate automatically adds the route to the routing table when the tunnel is established, ensuring connectivity when needed.

● set proposal aes128-sha256 aes256-sha256 → Uses strong encryption and hashing algorithms, ensuring a secure connection.

● set keylife 28800 → Sets a longer key lifetime (8 hours), reducing the frequency of rekeying, which is beneficial for stable connections.

Because DPD is set to on-idle, the tunnel will not constantly send keep-alive messages but will still ensure connectivity when traffic is detected. This makes the configuration ideal for networks with regular but non-continuous traffic, balancing security and resource efficiency.

VXLAN (Virtual Extensible LAN) is an overlay network technology that extends Layer 2 networks over Layer 3 infrastructure. When VXLAN is used extensively on FortiGate, hardware acceleration is crucial for maintaining performance.

● NP7 (Network Processor 7) is Fortinet’s latest network processor designed to accelerate high-performance networking features, including:

● VXLAN encapsulation/decapsulation

● IPsec VPN offloading

● Firewall policy enforcement

● Advanced threat protection at wire speed

NP7 significantly reduces latency and improves throughput when handling VXLAN traffic, making it the best choice for large-scale VXLAN deployments.

The Internet Service Database (ISDB) in FortiGate is used to enforce content filtering at Layer 3 (Network Layer) and Layer 4 (Transport Layer) of the OSI model by identifying applications based on their predefined IP addresses and ports.

FortiGate has a predefined list of all IPs and ports for specific applications downloaded from FortiGuard:

● FortiGate retrieves and updates a predefined list of IPs and ports for different internet services from FortiGuard.

● This allows FortiGate to block specific services at Layer 3 and Layer 4 without requiring deep packet inspection.

The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard:

● ISDB works by matching traffic to known IP addresses and ports of categorized services.

● When an application or service is blocked, FortiGate prevents communication by denying traffic based on its destination IP and port number.

From the Root FortiGate - System Administrator Configuration exhibit:

● The AdminSSO account has the super_admin_readonly role.

From the Downstream FortiGate - Security Fabric Settings exhibit:

● The Security Fabric role is set to Join Existing Fabric, meaning it will authenticate with the root FortiGate.

● SAML Single Sign-On (SSO) is enabled, and the default admin profile is set to super_admin_readonly.

When the AdminSSO user logs into the downstream FortiGate using SSO, the authentication request is sent to the root FortiGate, where AdminSSO has super_admin_readonly permissions. Since the downstream FortiGate inherits this permission through the Security Fabric configuration, the user will be granted super_admin_readonly access.

ADVPN (Auto-Discovery VPN) 2.0 is the optimal solution for enabling direct spoke-to-spoke communication without passing through the hub, while also allowing automatic link selection based on quality metrics.

● Dynamic Direct Tunnels:

● ADVPN 2.0 allows spokes to establish direct IPsec tunnels dynamically based on traffic patterns, reducing latency and improving performance.

● Unlike static VPNs, spokes do not need to pre-configure tunnels for each other.

● Automatic Link Optimization:

● ADVPN 2.0 monitors the quality of multiple internet connections on each spoke.

● It automatically switches to the best available connection when the primary link degrades or fails.

● This is achieved by dynamically adjusting BGP-based routing or leveraging SD-WAN integration.

When standardizing the deployment of FortiGate devices across branches using FortiManager, the best practice is to use metadata variables. This allows for dynamic interface configuration while maintaining a single, consistent policy package for all branches.

● Metadata variables in FortiManager enable interface roles and configurations to be dynamically assigned based on the specific FortiGate device.

● This ensures scalability and consistent security policy enforcement across all branches without manually adjusting interface settings for each device.

● When a new branch FortiGate is deployed, metadata variables automatically map to the correct physical interfaces, reducing manual configuration errors.

The Multi-Exit Discriminator (MED) is a BGP attribute used to influence the preferred path for incoming traffic from an external autonomous system (AS). The diagram shows that FortiGate_1 advertises MED 200, while FortiGate_2 advertises MED 300, meaning the ISP will prefer the route through FortiGate_1 because a lower MED is preferred in BGP.

To modify the MED value on FortiGate_1 for routes advertised to AS 30, the administrator must configure a route-map-out. A route map can match specific routes and set the MED value before sending them to the BGP neighbor.