FCSS-NST-SE-7.6 Sample Questions & Answers

Without deep inspection, the FortiGate cannot see the HTTPS URL. For flow-based web filtering it rates the hostname from the SNI in the TLS Client Hello, or the server certificate's CN when there is no SNI. If the site is served under a hostname (for example a CDN or shared hosting name) whose FortiGuard category differs from the category the administrator checked, the session is blocked by that other category. The log's category field shows which one. If 'Rate URLs by domain and IP address' is enabled, the IP rating can also override the domain rating by weight. Checking the category in the log, adding a local rating or URL filter exemption, or using deep inspection so the full URL is rated resolves the discrepancy. (FortiOS 7.6 Administration Guide: Configuring a web filter profile; Rating options.)

If a static route is in the routing table but traffic is not forwarded, check whether the next hop is actually reachable at Layer 2 and Layer 3. diagnose ip arp list shows whether the FortiGate has resolved the gateway's MAC address; an incomplete or missing entry points to a Layer 2 or addressing problem. execute ping tests Layer 3 reachability of the gateway directly. get router info routing-table all only confirms what is already known (the route is present). get system performance status shows resource usage, and diagnose debug flow traces a packet's policy and route decisions rather than gateway reachability.

If a static route is in the routing table but traffic is not forwarded, check whether the next hop is actually reachable at Layer 2 and Layer 3. diagnose ip arp list shows whether the FortiGate has resolved the gateway's MAC address; an incomplete or missing entry points to a Layer 2 or addressing problem. execute ping tests Layer 3 reachability of the gateway directly. get router info routing-table all only confirms what is already known (the route is present). get system performance status shows resource usage, and diagnose debug flow traces a packet's policy and route decisions rather than gateway reachability.

diagnose test application autod 3 displays statistics for all automation stitches: how many times each stitch was triggered (local hit), the last trigger time, and each action's done/drop counters. It shows which stitches ran and whether their actions succeeded or failed. diagnose automation stitch-history, diagnose automation stitch-trace and diagnose sys csf-log aren't FortiOS commands, and get system automation stitch doesn't show execution history. Reference: FortiOS 7.6 Administration Guide, Diagnosing automation stitches.

When Dead Peer Detection (DPD) is configured as 'On Idle' on one FortiGate, it will only send DPD probes when there is no outbound traffic to send. If the other side has DPD disabled, it will not respond to these probes. After a few failed probes, the 'On Idle' FortiGate will tear down the tunnel, assuming the peer is dead. If there is periodic keep-alive or monitoring traffic, the tunnel will re-establish, creating a flapping cycle. A DPD timer mismatch would not typically cause this issue, and Phase 2 lifetime expiry would be on a much longer interval (usually hours).

The ExStart state is where OSPF routers decide which router will be the master for exchanging Database Descriptor (DBD) packets. If the routers have different interface MTU values, the larger DBD packets from the router with the higher MTU will be dropped by the router with the lower MTU. This prevents the DBD exchange from completing, causing the adjacency to be stuck in ExStart. Timer mismatches would prevent the state from even reaching 2-Way, and area ID or authentication mismatches would also cause earlier failures.

The ipsmonitor test menu offers: 1 = display IPS engine information, 2 = toggle IPS engine enable/disable status, 3 = display restart log, 4 = clear restart log, 5 = toggle bypass status, 97/98/99 = start/stop/restart all IPS engines. diagnose test application ipsmonitor 5 therefore toggles IPS bypass. It is a quick, reversible way to confirm whether the IPS engine is behind the CPU load and latency, and it leaves the policy configuration unchanged. Option 99 restarts all IPS engines, which the Fortinet Community article on IPS memory optimization uses after changing IPS global settings. Option 1 only shows engine information, and option 3 shows the restart log. Run the same command again to leave bypass mode.

The Collector Agent can apply a group filter (Set Group Filters > Monitored groups) per FortiGate. Once a filter is configured, logon events for users who are not in a monitored group are received from the DC Agent but not forwarded to that FortiGate. If the filter lists 'Domain Admins' but not 'Sales_Users', only the Domain Admins users appear. With no filter configured, all groups are forwarded. The fix is to add 'Sales_Users' to the monitored groups (Fortinet Community: Configure FSSO in DC Agent mode / FSSO Group Filter configured on Collector Agent).

With execute traceroute-options device auto (the default), FortiOS chooses the egress interface for self-originated traceroute traffic from the routing table of the current VDOM, and uses that interface's IP as the source. When the best route to the destination is a default route out the WAN interface, the probes are sourced from the WAN. To make the probes originate from the LAN side, set the source explicitly with execute traceroute-options source (or set device to the LAN interface). Reference: FortiOS 7.6 CLI Reference, execute traceroute-options.

With IKEv2, set transport auto makes FortiOS start IKE over UDP. If the UDP negotiation does not establish within auto-transport-threshold (1–300 s, default 15), it automatically falls back to TCP, as the debug line 'auto transport timeout, use tcp port 4500' shows. The TCP port comes from ike-tcp-port under config system settings, which defaults to 4500. The transport option is only available when ike-version is 2, and NAT-T does not switch IKE to TCP. Sources: FortiOS 7.6 New Features, 'Automatic selection of IPsec tunneling protocol'; FortiOS 7.6 Administration Guide, 'Dialup IPsec VPN using custom TCP port'.

In config router ospf, set distribute-list-in ('Filter incoming routes') stops matching OSPF routes from being installed in the routing table. The LSAs are still received and kept in the OSPF database, which matches the symptom: FULL adjacencies and a learned but not installed default route. database-filter-out (under config ospf-interface) only controls flooding of LSAs out of an interface. Router priority only affects DR/BDR election. The hub is already advertising the default route, since the spokes learn it. Source: FortiOS 7.6 CLI Reference, config router ospf.