FortiGate-VM with AWS Gateway Load Balancer (GWLB) is the designed solution for scalable, centralized east-west traffic inspection in a VPC. It allows you to insert firewall inspection into the traffic flow between subnets or VPCs via the GWLB, distributing traffic across a fleet of FortiGate-VMs for high performance and availability, unlike a single appliance which creates a bottleneck.

FortiManager’s Install Wizard allows for targeted policy installations to specific device groups (ADOMs or subgroups). By selecting only the ‘Cloud Gate’ device group, the administrator can preview exactly which devices will receive the changes, ensuring the on-premises devices are excluded. This is more efficient and less error-prone than manual configuration or creating entirely separate policy packages unless a fundamentally different policy structure is required.

SD-WAN performance SLA rules trigger failover only when measured performance (latency, jitter, packet loss) exceeds the defined thresholds. If the primary link’s latency of 800ms did not trigger a failover, the most direct explanation is that the configured latency threshold in the SLA rule was set to a value equal to or greater than 800ms (e.g., 1000ms). The link remained ‘up’ because reachability probes succeeded, but it performed poorly according to the business intent, which wasn’t captured by the misconfigured threshold.

The ZTNA access proxy is the core component designed for this purpose. It acts as a reverse proxy to broker secure, least-privilege access to specific applications (not networks). By linking the access proxy rule to a ZTNA tag, it integrates with FortiClient EMS to enforce endpoint compliance checks before the connection to the application is ever established. This is distinct from traditional network-level access methods like VIPs or firewall policies.

FortiSIEM uses a combination of Roles and Collections for granular access control. Collections define a logical group of monitored objects (like a BU’s devices). A Role can be scoped to a specific Collection. By creating a role with analytical permissions (View Incidents, Run Reports) but restricted to the BU’s Collection, the junior analyst will only see events and incidents relevant to their assigned scope, achieving effective data segregation without full system access.

FortiAnalyzer’s Multi-ADOM (Administrative Domain) mode is designed specifically for MSSP and multi-tenant deployments. Each ADOM provides complete data isolation (logs, reports, configurations) for a single customer or entity. The MSSP’s super-admins can access all ADOMs, while restricted admin accounts can be created and limited to managing only their specific customer ADOM, providing both isolation and centralized oversight.

Session synchronization is the key HA feature that replicates stateful session information (like SSL VPN tunnels, firewall sessions, DHCP leases) from the primary unit to the secondary unit in real-time. When this is enabled and functioning, a failover is seamless for existing connections because the new primary unit already has the state table information, allowing it to continue handling packets for those sessions without interruption. ‘Session pickup’ is related to FGSP (FortiGate Session Life Support Protocol) for standalone units, not HA cluster session sync.

The FortiGate’s FortiSwitch Manager interface provides the operational status of the managed switch, including whether the security policy (which contains port settings, VLANs, etc.) has been successfully pushed and is in a ‘Applied’ state. Checking this GUI provides an immediate, centralized view of the configuration synchronization health before diving into CLI diagnostics on the switch itself. It confirms whether the intended config left the FortiGate successfully.

In Reverse Proxy mode, FortiWeb inspects HTTP/HTTPS traffic for threats. A new application update often introduces changes in parameters, URLs, or traffic patterns that can inadvertently trigger positive matches in the signature-based (or heuristic/learning-based) protection features. A 403 error from FortiWeb typically indicates a request was blocked by a security policy. Reviewing the attack logs and the active signatures in the Web Protection Profile will most quickly identify if a legitimate new behavior is being classified as a SQL injection, cross-site scripting, or other violation.

FortiGate-VM with AWS Gateway Load Balancer (GWLB) is the designed solution for scalable, centralized east-west traffic inspection in a VPC. It allows you to insert firewall inspection into the traffic flow between subnets or VPCs via the GWLB, distributing traffic across a fleet of FortiGate-VMs for high performance and availability, unlike a single appliance which creates a bottleneck.0