Fortios

---
name: fortios
description: "Expert coverage of Fortinet FortiOS across all versions: FortiASIC hardware acceleration, VDOM, Security Fabric, SD-WAN, ZTNA, flow vs proxy inspection, FortiManager, FortiAnalyzer, FGCP/FGSP HA, and CLI diagnostics. Use for \"FortiOS\", \"FortiGate\", \"Fortinet\", \"FortiManager\", \"FortiAnalyzer\", \"VDOM\", \"Security Fabric\", \"FortiASIC\", \"NP7\", \"SD-WAN FortiGate\", \"ZTNA FortiGate\", \"FortiGuard\". Do NOT use for cross-vendor comparison, platform selection, or category-wide architecture -- use the `firewall` skill."
license: MIT
---

# FortiOS

This skill covers Fortinet FortiOS across all supported versions (7.2 through 7.6). Areas of expertise include:

- FortiASIC hardware acceleration (NP7, SP5/SoC5)
- Packet flow architecture (fast path NP-offloaded vs. software path)
- Flow-based vs. proxy-based UTM inspection (per-policy selection)
- Virtual Domains (VDOMs) and multi-tenancy
- Security Fabric (FortiSwitch, FortiAP, FortiClient EMS, FortiSandbox integration)
- SD-WAN (zones, members, health checks, rules, ADVPN)
- ZTNA (access proxy, FortiClient EMS tags, continuous posture)
- FortiManager centralized management (ADOMs, policy packages, templates)
- FortiAnalyzer log management and FortiSOC
- FGCP and FGSP high availability
- CLI diagnostics (diagnose commands, debug flow, sniffer, session inspection)
- Automation (REST API, Ansible fortinet.fortios, Terraform fortinetdev/fortios)

When a question is version-specific, consult the matching `references/versions/` file. When the version is unknown, provide general guidance and note differences.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for diagnose commands and flow debug
   - **Performance** -- Load `references/best-practices.md` for NP offloading and optimization
   - **Architecture** -- Load `references/architecture.md` for FortiASIC, packet flow, VDOMs, HA
   - **Policy design** -- Apply FortiOS-specific best practices below
   - **SD-WAN / ZTNA** -- Deep guidance available below and in reference files

2. **Identify version** -- Determine which FortiOS version. If unclear, ask. Version matters for: feature availability, firmware lifecycle, upgrade paths, hardware support.

3. **Load context** -- Read the relevant reference file.

4. **Analyze** -- Apply FortiOS-specific reasoning, not generic firewall advice.

5. **Recommend** -- Provide actionable CLI examples or GUI paths.

6. **Verify** -- Suggest validation steps (diagnose debug flow, session list, sniffer).

## Core Architecture

### FortiASIC Hardware Acceleration
FortiGate platforms use purpose-built ASICs for high-performance processing:
- **NP7**: Network processor for L3/L4 forwarding, NAT, IPsec, QoS. Up to 200 Gbps. Hardware session table.
- **SP5/SoC5**: Content processor for L7 inspection -- SSL/TLS, pattern matching (IPS), AV, application ID.
- **Fast Path**: After CPU establishes a session, NP handles all subsequent packets at hardware speed.

**NP offloading restrictions** (sessions that cannot be hardware-accelerated):
- Proxy-based inspection traffic
- Sessions using session helpers/ALGs (FTP, DNS, SIP, H.323, PPTP)
- PPPoE interfaces
- Software-switch traffic (unless `intra-switch-policy = explicit`)
- Fragmented packets (NP7Lite only)

### Flow-Based vs. Proxy-Based Inspection

| Aspect | Flow-Based | Proxy-Based |
|---|---|---|
| Engine | IPS engine (DFA pattern matching) | Full proxy with content buffering |
| Latency | Lower (streaming) | Higher (buffering) |
| Throughput | Higher | Lower |
| Detection depth | Good for most threats | Best for evasive content (chunked encoding) |
| AV scanning | Signature-based streaming | Full file reconstruction + hash comparison |
| SSL inspection | Must use "Inspect All Ports" | Full SSL proxy (re-sign + re-encrypt) |
| NP offloading | Eligible after inspection | Not eligible |
| Use case | Most enterprise policies | DLP, email scanning, max detection |

**Per-policy selection** (since 6.2): Each policy can independently use flow or proxy mode.

## Policy Design

### Policy Types
- **IPv4/IPv6 Policies** (`config firewall policy`): Primary traffic rules
- **Proxy Policies** (`config firewall proxy-policy`): ZTNA access proxy, explicit web proxy
- **Local-in Policies** (`config firewall local-in-policy`): Protect the FortiGate itself
- **DoS Policies**: Rate limiting per interface

### Policy Lookup Order
1. Local-in policies (traffic to FortiGate)
2. DoS policies (early drop)
3. Firewall policy table (top-to-bottom, first match wins)
4. Implicit deny (last rule)

### NGFW Mode
Two modes per VDOM (`config system settings > set ngfw-mode`):
- **Profile-based (default)**: Traditional UTM model; security profiles attached to policies
- **Policy-based NGFW**: Match on application signatures and URL categories directly in the policy

### Best Practices
- Never use `srcaddr=all, dstaddr=all, service=ALL` without UTM profiles
- Use ISDB (Internet Service Database) objects for cloud services (M365, AWS, etc.)
- Use named address objects, never raw IPs in policies
- Apply UTM profiles selectively: purpose-specific profiles (`utm-outbound-web`, `utm-inbound-dmz`)
- Push FortiGate CA cert via GPO/MDM before enabling SSL deep inspection
- Use FQDN address objects for cloud services (dynamic DNS resolution)

## SD-WAN

SD-WAN is built into FortiOS (no separate license):
- **SD-WAN Zones**: Virtual zones used in firewall policies
- **Members**: Physical or VPN interfaces included in SD-WAN
- **Performance SLA (Health Checks)**: Monitors per link (ping, http, dns, tcp-echo, twamp)
- **SD-WAN Rules**: Traffic steering strategies (manual, best-quality, lowest-cost, maximize-bandwidth)
- **ADVPN**: Hub-spoke IPsec with dynamic spoke-to-spoke shortcuts

Key commands:
```
diagnose sys sdwan health-check status    # SLA health check results
diagnose sys sdwan member                 # SD-WAN member state
diagnose sys sdwan service               # SD-WAN rule matches
```

## ZTNA

Zero Trust Network Access replaces broad VPN with per-application access:
- **FortiGate**: ZTNA gateway (access proxy)
- **FortiClient**: Endpoint agent with posture telemetry
- **FortiClient EMS**: Assigns ZTNA tags based on compliance rules
- Tags synced to FortiGate via Fabric connector in real time
- ZTNA proxy policies match on tags as dynamic address objects

**ZTNA vs VPN**: ZTNA provides per-application access with continuous posture; VPN provides full network access checked only at connection time.

## VDOMs

- Partition a FortiGate into independent firewall instances
- Each VDOM: own interfaces, routing, policies, security profiles, VPN
- Root VDOM manages global settings; cannot be deleted
- **Split-Task VDOM mode**: Management VDOM (root) + Traffic VDOM (FG-traffic)
- Inter-VDOM communication via VDOM links
- Per-VDOM operating mode: NAT or Transparent

## High Availability

### FGCP (FortiGate Clustering Protocol)
- **Active-Passive**: Primary processes traffic; secondary synced and idle
- **Active-Active**: Primary receives traffic and distributes sessions to secondaries
- Dedicated heartbeat links required (not shared with production)
- Session synchronization over heartbeat or dedicated sync interface
- Failover time: under 1 second for new sessions; existing sessions maintained if session sync enabled

### FGSP (FortiGate Session Life Support Protocol)
- Active-active without virtual MAC/IP; each unit has its own addresses
- Commonly used with ECMP routing or external load balancers
- Synchronizes TCP sessions and IPsec tunnels
- Can nest inside FGCP clusters (clustered FGSP)

## Common Pitfalls

1. **Flow vs proxy confusion**: Flow-based is less thorough for some content types but much faster. Use proxy-based only where maximum detection is required (DLP, email scanning).

2. **NP offloading failures**: Traffic using session helpers, proxy-mode, or PPPoE interfaces cannot be hardware-accelerated. Check offload status: `diagnose npu np7 session list`

3. **FortiManager overwrite**: Making config changes directly on a FortiManager-managed FortiGate will be overwritten on next policy install. Use FortiManager or set the device to Backup mode.

4. **ADOM version mismatch**: Managing a 7.6 FortiGate in a 7.4 ADOM causes schema errors. Match ADOM version to FortiOS version.

5. **SSL inspection without CA deployment**: Deep inspection causes browser cert warnings for all HTTPS sites. Push FortiGate CA via GPO/MDM first.

6. **SD-WAN health check unreachable**: Using unreachable probe targets falsely marks links down. Use reliable, always-up probe targets (8.8.8.8, ISP DNS).

7. **Phase2 selector mismatch in VPN**: IKE negotiates but traffic never flows. Verify local/remote subnet selectors match on both sides.

8. **Firmware version selection**: Community guidance often recommends specific patch builds (e.g., 7.4.11+). Check the Fortinet community and release notes, not just the latest available build.

## Version-Specific Guidance

| Version | Reference | What's version-specific |
|---|---|---|
| 7.4 | `references/versions/7.4.md` | Hybrid Mesh Firewall, ZTNA enhancements, Multi-Instance 3100, OT/ICS security |
| 7.6 | `references/versions/7.6.md` | FortiAI, 20+ SD-WAN features, ADVPN 2.0, ZTNA UDP/QUIC, PQC, Wi-Fi 7 MLO |

## Reference Files

- `references/architecture.md` -- FortiASIC (NP7, SP5), packet flow, VDOMs, Security Fabric, HA (FGCP/FGSP), VXLAN, SD-WAN architecture. Read for "how does X work" questions.
- `references/diagnostics.md` -- diagnose commands, debug flow, session table, sniffer, routing, VPN, HA, NP offload, SD-WAN health checks. Read when troubleshooting.
- `references/best-practices.md` -- Policy design, SSL inspection, firmware lifecycle, HA deployment, logging, FortiManager ADOM design, performance tuning, security hardening. Read for design and operations.