For SSL VPN to function correctly between two FortiGate devices, the following settings are required:
* B. The server FortiGate requires a CA certificate to verify the client FortiGate certificate: The server FortiGate must have a Certificate Authority (CA) certificate installed to authenticate and verify the certificate presented by the client FortiGate device.
* C. The client FortiGate requires a client certificate signed by the CA on the server FortiGate: The client FortiGate must have a client certificate that is signed by the same CA that the server FortiGate uses for verification. This ensures a secure SSL VPN connection between the two devices.
The other options are not directly necessary for establishing SSL VPN:
* A. The client FortiGate requires the SSL VPN tunnel interface type to connect SSL VPN: This is incorrect as SSL VPN does not require a specific tunnel interface type; it typically uses an SSL VPN client profile.
* D. The client FortiGate requires a manually added route to remote subnets: While routing may be necessary, it is not specifically required for the SSL VPN functionality between two FortiGates.
References
* FortiOS 7.4.1 Administration Guide - Configuring SSL VPN, page 1203.
* FortiOS 7.4.1 Administration Guide - SSL VPN Authentication, page 1210.

The most likely reason for a user not being presented with a login prompt when attempting to access an external website in a FortiGate firewall authentication scenario is:
C. The user was authenticated using passive authentication.
Passive authentication allows the FortiGate to authenticate users transparently without presenting them with a login prompt. This often involves the use of authentication methods such as Captive Portal or single sign-on (SSO) techniques where users are authenticated based on their network activity without actively entering credentials.
Options A, B, and D are less likely to cause the absence of a login prompt in this context: A is less likely because if there was no matching user account, it would typically result in an authentication prompt.
B is less likely unless the guest account profile specifically has a passive authentication mechanism.
D is less likely because super admin accounts are typically not subject to transparent or passive authentication mechanisms.
So, the most likely reason is C.

A. Web filter in flow-based inspection
B. Antivirus in flow-based inspection
E. Application control
These features do require the Intrusion Prevention System (IPS) engine to function effectively. The IPS engine plays a crucial role in inspecting traffic for various security threats and ensuring that these security features can operate efficiently.
It asks what uses the IPS system.
And that is:
Application control
Anti-virus (flow-based)
Web filter (flow-based)
Email filter (flow-based)

One-to-one NAT IP pool is used in the firewall policy.
In one-to-one, PAT is not required.
In the one-to-one pool type, an internal IP address is mapped with an external address on a first-come, first-served basis.
There is a single mapping of an internal address to an external address. Mappings are not fixed and, if there are no more addresses available, a connection will be refused.
Also, in one-to-one, PAT is not required. In the example on this slide, you can see the same source port is shown for both the ingress and egress address.

Local traffic logs
Local traffic logs contain information about traffic directly to and from the FortiGate management IP addresses. They also include connections to the GUI and FortiGuard queries.