The most effective and immediate step is to eliminate the shared credential by creating a unique, individual account. This establishes individual accountability for actions in the logs (non-repudiation) and is a fundamental security practice. While 2FA and RADIUS are excellent enhancements, they should be implemented after individual accountability is in place.

For traffic originating from a private internal network destined for the internet, Source NAT (often called Outbound NAT or IP Masquerading) is almost always required. Without NAT enabled, the internal private IP addresses are not translated to the FortiGate’s public IP, so return traffic from the internet server cannot be routed back correctly, causing the connection to fail.

Traffic Shaping with Shared Policiers is designed specifically for bandwidth management and prioritization. You can create a policier that guarantees minimum bandwidth and/or prioritizes traffic for the executive user group (identified by a source IP or user/FSSo group). This ensures their critical VoIP/video traffic gets the necessary resources during congestion, unlike features which merely block or filter.

The ‘Log & Report > Forward Traffic’ section is the centralized log viewer for all traffic that has been processed by firewall policies. It allows you to apply filters for source IP (192.168.1.105), destination IP, date/time (last Tuesday), and action. This is the direct and efficient method for forensic log analysis related to traffic flow.

A VIP is bound to a specific external interface. If the VIP is accidentally created on interface ‘wan2’ but the policy and incoming connection are on ‘wan1’, the FortiGate will not match the incoming packet to the VIP. The connection attempt will be dropped as there is no destination. Always double-check that the VIP’s External Interface matches the interface where the traffic is actually arriving.

The fundamental method for controlling inter-subnet traffic on a FortiGate is through firewall policies. By default, there is an implicit deny between interfaces/zones. However, creating an explicit deny policy from Guest to Corporate provides a clear, auditable rule that documents the compliance requirement and appears in the logs, which is better practice than relying solely on the implicit deny.

The ‘System > Maintenance’ section allows you to create schedules for automated tasks. You can configure the ‘AV and IPS Database Update’ schedule to run daily at 2:00 AM. This ensures the FortiGate automatically retrieves and installs the latest application control, IPS, and antivirus signatures during the approved maintenance window without manual intervention.

A DNS Filter profile is specifically designed to inspect and control DNS traffic. It can filter domains based on categories, block malicious domains from FortiGuard, and crucially, it can enable ‘DNS Exfiltration’ detection. This feature analyzes DNS queries for patterns that indicate data is being encoded and leaked within DNS requests, which is the exact threat described.

To achieve sub-second failover, you must use Active-Passive HA with session pickup (sometimes called session synchronization) enabled. In this mode, the passive unit is synchronized and aware of all active sessions passing through the primary. When a failure occurs, the passive unit can immediately take over the sessions, minimizing disruption. Active-Active is for load sharing, not minimal failover time, and disabling session pickup would cause all active sessions to drop during failover.

The most effective and immediate step is to eliminate the shared credential by creating a unique, individual account. This establishes individual accountability for actions in the logs (non-repudiation) and is a fundamental security practice. While 2FA and RADIUS are excellent enhancements, they should be implemented after individual accountability is in place.0