Examine this FortiGate configuration: Examine the output of the following debug command: Based on the diagnostic outputs above, how is the FortiGate handling the traffic for new sessions that require inspection?
A.
It is allowed, but with no inspection
B.
It is allowed and inspected as long as the inspection is flow based
C.
It is dropped.
D.
It is allowed and inspected, as long as the only inspection required is antivirus.
The answer is C.
FortiGate_Infrastructure_6.2_Study_Guide-Online (Page 394)
It says:
"However, if the memory usage exceeds the extreme threshold, new sessions are ALWAYS DROPPED, regardless of the FortiGate configuration."
Note: "Extreme threshold is when the memory usage goes above 95%, and all NEW sessions are dropped. (page 392).
memory-use-threshold-extreme
The threshold at which memory usage is considered extreme and new sessions are dropped, in percent of total RAM (default = 95).
the traffic is dropped >>> Fortigate is on conserve mode 'extreme'
3 memory thresholds : red, extreme and green
'red' and 'extreme' : Both 'red' and 'extreme' are thresholds to enter in 'conserve mode' when the system memory used is over their thresholds.
When the used memory goes over the defined red threshold, the kernel raises the conserve mode state. FortiGate functions reacting to conserve mode state, like antivirus transparent proxies, would apply their own restriction based on their settings.
If used memory continues to increase and reach the 'extreme' threshold, conserve mode action taken with the red threshold are still active and additionally new sessions will be dropped.
'green' : When used memory goes below the 'green' threshold, kernel releases the conserve mode state. FortiGate functions reacting to conserve mode state would stop their restriction measures.
A is correct until the memory used reaches the "red threashold" but is below the "extreme threshold" level. If the memory reaches the "threashold extreme" level, C is correct as explained in FortiGate_Infrastructure_6.2_Study_Guide-Online (Page 394)
According the following link: https://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD48774&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=183032690&stateId=1%200%20183034101%27)
"Threshold at which memory usage is considered extreme, and new sessions are dropped, in percent of total RAM (default = 95).
'memory-use-threshold-green'." Dont know if is the same for Forti 6.2. :/
So in the output the green treshold is 88%, maybe is A according to Forti Infra p 418
"pass (default): All new sessions pass without inspection"
C because Extreme memory threshold : "If memory use reaches the extreme threshold (95% memory used), new sessions are dropped and red threshold conserve mode actions continue."
https://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-security-profiles/Other_Profile_Considerations/Conserve%20mode.htm
A: What happens when the FortiGate unit enters conserve mode depends on how you have av-failopen configured, in this case is the default, pass:The pass setting allows traffic to bypass the AV proxy and continue to its destination. Since the traffic is bypassing the proxy, no Security Profiles scanning that requires the AV proxy is performed. Security Profiles scanning that does not require the AV proxy continues normally.
Use the pass setting when access is more important than security while the problem is rectified.
Correct answer : C
Explanation : if the memory usage keeps increasing, it might exceed the extreme threshold. While the memory usage is above this highest threshold, all new sessions are dropped.
A voting comment increases the vote count for the chosen answer by one.
Upvoting a comment with a selected answer will also increase the vote count towards that answer by one.
So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
chameleon_eh
Highly Voted 4 years, 10 months agoSamanosuke
Highly Voted 5 years, 7 months agoeinstein85
Most Recent 2 years, 1 month agovirab
2 years, 6 months agofor3nsic
2 years, 10 months agolenz99
4 years, 3 months agohenzoo
4 years, 4 months agoramiropalm
4 years, 5 months agowassimtrabelsi
4 years, 5 months agoramzie
4 years, 6 months agoOCZY
4 years, 7 months agogooz
4 years, 7 months agoMohamed_M
4 years, 7 months agoNull0
4 years, 8 months agoDeep_Purple
4 years, 8 months agoFr4nx
4 years, 11 months agojoeytrib
4 years, 11 months ago