A route-based VPN configured with the branch’s dynamic DNS hostname as the peer address is the most reliable and administrative-friendly solution. The HQ FortiGate will resolve the hostname to the current IP each time a connection is initiated, accommodating the dynamic IP without manual intervention, while route-based VPNs offer more flexibility for routing internal traffic.

When sessions are created (meaning the firewall policy matched) but then immediately torn down, it strongly indicates that a security profile (IPS, Web Filter, Application Control) applied to the policy is inspecting and subsequently blocking the content of the session. The administrator should check the security profile logs for a block message related to this traffic.

Compliance requires both encrypted protocols (HTTPS/SSH) and centralized LDAP authentication. The correct steps are to 1) enable only encrypted services (HTTPS, SSH) on the necessary interfaces, 2) configure the authentication settings to use the LDAP server for admin users, and 3) explicitly disable unencrypted protocols like HTTP and Telnet to enforce the policy.

The most efficient and secure approach is to diagnose the specific cause. Reviewing the triggered signature allows you to determine if it’s a false positive for your legitimate application. Creating a precise, custom exception for that specific signature on the protected web server’s URL maintains protection for other threats while allowing the legitimate form submission to proceed.

The heartbeat link is critical for cluster synchronization and failover decisions. It must be highly reliable with minimal latency and no congestion. Using a dedicated physical cable or a VLAN isolated from regular user traffic on a switch ensures that heartbeat packets are not delayed or dropped, which could cause an unnecessary failover (split-brain scenario).

The most precise and secure policy specifies the exact source (IT subnet), the exact destination (the server’s IP, not the whole DMZ interface), the exact service (SSH, defined by TCP port 22), the action (ACCEPT), and enables logging for all sessions to meet the auditing requirement. This follows the principle of least privilege.

The quickest and most effective method is to use DNS Filtering. By adding the suspicious domain to a block list in the DNS Filter profile (which is likely already applied to your outbound policies), you immediately prevent the resolution of that domain for all hosts, or you can target it to specific source addresses. Blocking at the DNS level is more reliable than targeting a potentially changing IP address.

A common post-restore issue occurs when the backup contains administrators configured to authenticate via an external server (like RADIUS or LDAP). If the new FortiGate cannot reach that server (due to different network config, IP, or server downtime), authentication fails. The console access remains because it’s locally managed and provides a way to fix the issue, such as creating a temporary local admin user.

FortiGate processing follows a logical order where threat prevention (like IPS) often takes priority. The IPS sensor performs deep packet inspection for vulnerabilities and exploits. If the traffic passes this inspection (or matches a monitor-only signature), it then proceeds to the Application Control engine for identification and policy enforcement based on the application type. This order ensures known threats are blocked before application identification occurs.

A route-based VPN configured with the branch’s dynamic DNS hostname as the peer address is the most reliable and administrative-friendly solution. The HQ FortiGate will resolve the hostname to the current IP each time a connection is initiated, accommodating the dynamic IP without manual intervention, while route-based VPNs offer more flexibility for routing internal traffic.0