Fortinet Certification NSE7_NST-7.2 Release Date

RTT (Round Trip Time):

RTT in the context of the FortiGuard server list indicates the time it takes for a request to be sent to a FortiGuard server and for a response to be received.

This metric helps determine the latency between the FortiGate device and the FortiGuard servers, which is crucial for ensuring efficient and quick updates and responses for services like web filtering and antivirus updates.

Server Selection:

The FortiGate device uses RTT values to prioritize servers. Servers with lower RTT values are preferred as they respond faster, ensuring minimal delay in processing requests.

This improves the overall performance of FortiGuard services by reducing the time it takes to communicate with the servers.

References:

Fortinet Community: Troubleshooting FortiGuard server connections and RTT values​(Welcome to the Fortinet Community!)​​(Fortinet Docs)​.

Fortinet Documentation: FortiGuard server settings and RTT explanation​(Welcome to the Fortinet Community!)​​(Fortinet Docs)​.

The exhibit shows log entries from the FSSO (Fortinet Single Sign-On) collector agent logs. These logs provide insights into why there might be issues with the collector agent connecting to workstations or the registry.

Remote registry is not running on the workstation: The failure to connect to the workstation registry can occur if the remote registry service on the workstation is not running. This service needs to be active to allow the FSSO collector agent to query the workstation for user login information.

DNS resolution is unable to resolve the workstation name: The logs indicate a failure in connecting to a workstation by name, which can happen if the DNS server is unable to resolve the workstation's name to an IP address. This is a common issue when the DNS settings are incorrect or the workstation name is not properly registered in the DNS.

A firewall is blocking traffic to port 139 and 445: Communication issues to the workstation or registry are often caused by firewall rules blocking essential ports. Ports 139 (NetBIOS) and 445 (SMB) are critical for these operations. Ensure these ports are open on both the workstation and any intermediate firewalls.

References

Fortinet Community Documentation on FSSO Troubleshooting

Fortinet Community on FSSO Collector Agent Issues

The exhibit shows a sniffer capture where TCP port 8013 is being used for communication. The communication appears one-way, indicating potential issues with the upstream FortiGate receiving the necessary packets or being able to respond.

To ensure successful communication in a Security Fabric setup:

Ensure TCP port 8013 is not blocked along the way: Verify that no firewalls or network devices between the downstream and upstream FortiGates are blocking TCP port 8013. This port is crucial for Security Fabric communication.

Authorize the downstream FortiGate on the root FortiGate: In the Security Fabric, the root FortiGate must recognize and authorize the downstream FortiGate to allow proper communication and management.

Enable Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate: The upstream FortiGate must have the Security Fabric or Fortitelemetry enabled on the interface that receives the communication from the downstream FortiGate. This enables proper data exchange and monitoring within the Security Fabric.

References

Fortinet Documentation on Security Fabric Configuration

Fortinet Community Discussion on Port Requirements

Soft Reset of BGP:

Performing a soft reset of BGP is a common method to resolve issues where prefixes are not being received. It forces both BGP peers to resend their complete routing tables to each other.

This can be done using the command:execute router clear bgp soft inandexecute router clear bgp soft out.

Network Import Check:

Thenetwork-import-checkcommand controls whether the FortiGate should verify that the prefix exists in the routing table before advertising it.

Disabling this check can resolve issues where valid prefixes are not advertised due to stringent verification.

The command to disable this is:config router bgp set network-import-check disable end.

BGP Configuration Verification:

Ensure that the BGP configuration on FGT-B is correctly set to advertise the network 172.16.54.0/24.

Verify that the network statement is correctly configured and matches the intended prefix.

References:

Fortinet Community: Technical Note on Configuring BGP​(Welcome to the Fortinet Community!)​.

Fortinet Documentation: Configuring BGP on FortiGate​(Fortinet Document Library)​.