FortiGate firewall-policy problems are easiest to solve when you stop thinking of a policy as a single allow-or-deny line and instead trace the whole session […]

FortiGate Clustering Protocol high availability is designed to keep firewall services available when a member or monitored path fails. The cluster presents a unified security […]

Site-to-site IPsec troubleshooting becomes manageable when you separate tunnel establishment from traffic forwarding. Phase 1 creates the IKE security association between peers. Phase 2 creates […]

FortiGate SD-WAN is more than a bundle of internet links. It is a policy-driven forwarding system that combines available WAN members, measured path health, application […]

FortiOS supports two major inspection approaches in firewall policies: flow-based inspection and proxy-based inspection. Both can apply security controls to allowed traffic, but they process […]

Administrative domains, or ADOMs, are one of the most important FortiManager design concepts because they decide where devices, policy packages, objects, administrators, and operational responsibility […]

FortiManager separates centralized policy management from device-specific configuration. That separation is why a change can exist in Policy & Objects without immediately changing a FortiGate, […]

A failed FortiManager install is rarely solved by pressing Install again. The useful question is where the installation failed: target selection, policy validation, device database […]

FortiManager can allow administrators to edit without locking, or it can require explicit locks before changes are made. Workspace mode exists to solve a coordination […]

FortiManager’s JSON API allows centralized network-management workflows to be automated without reproducing every operation through the GUI. The API can retrieve managed objects, change configuration, […]

FortiAnalyzer turns device logs into searchable evidence, normalized security data, dashboards, events, incidents, and reports. Those capabilities depend on a pipeline: logs must arrive, be […]

FortiAnalyzer distinguishes raw logs from events and incidents. Logs are individual records generated by devices and services. Event handlers evaluate those records for conditions that […]

FortiAnalyzer can move beyond detection by running playbooks that automate investigation and response. A playbook starts with a trigger and then executes one or more […]

FortiAnalyzer reporting is built from layers. Logs provide the raw evidence. Datasets define which data is extracted from the database. Charts turn dataset results into […]

FortiAnalyzer gives analysts several ways to look at security data. Log View exposes records directly. FortiView summarizes activity through dashboards and widgets. The SOC Dashboard […]