Comprehensive and Detailed 150 to 200 words of Explanation From Exact Extract of Enterprise Firewall 7.6 Administrator documents:
Based on the FortiOS 7.6 Administration Guide and the Life of a Packet documentation (Parallel Path Processing), the FortiGate follows a specific, hardcoded sequence when processing the first packet of a new session. This process is divided into several stages: Ingress, Kernel, and Egress.
The very first stage is Ingress, where all packets accepted by a network interface are processed by the TCP/IP stack. Immediately following this, the packet must pass through IP integrity header checking. This step involves reading the packet headers to verify that the packet is a valid protocol (TCP, UDP, ICMP, etc.) and that the header length is correct. This sanity check is performed before any other security functions, such as decryption (which occurs later in the Ingress stage) or the Reverse Path Forwarding (RPF) check (which occurs even later during the Routing step in the Kernel stage).
Installation of the session key (Option A) only occurs after the packet has matched a firewall policy and the session has been fully established and offloaded to the NPU. Therefore, IP integrity header checking is the absolute first security-related validation performed on an incoming packet.

The output of the get router info ospf status command provides key information about the OSPF (Open Shortest Path First) configuration on the FortiGate device.
The FortiGate device is connected to multiple areas
# The output states: "This router is an ABR"
# ABR (Area Border Router) means the device is connected to multiple OSPF areas and maintains routing information between them.
# This confirms that the FortiGate is not just in one area, but at least one backbone area (Area 0) and another OSPF area.
The FortiGate device injects external routing information
# The output states: "Supports opaque LSA"
# Opaque LSAs (Type 9, 10, and 11) are used in OSPF extensions, including those that support external route injection.
# Typically, ABRs or ASBRs (Autonomous System Boundary Routers) inject external routes, allowing routes from other routing protocols (such as BGP or static routes) to be advertised into OSPF.

In most networks, that's enough for the switches to update their MAC forwarding tables with the new information.
However, some high-end switches might not clear their MAC tables correctly after a failover. So, they keep sending packets to the former primary even after receiving the gratuitous ARPs. In these cases, you should use the command shown on this slide to force the former primary to shut down all its interfaces for one second when the failover happens, excluding heartbeat and reserved management interfaces. This simulates a link failure that clears the related entries from the MAC table of the switches.

The best way to automate a firewall policy using a daily updated list of IP addresses is by using an external connector from Threat Feeds. This allows FortiGate to dynamically retrieve real-time threat intelligence from external sources and apply it directly to security policies.
By configuring Threat Feeds, the administrator can:
Automatically update firewall policies with the latest malicious IPs daily. Block traffic from those IPs in real-time without manual intervention. Integrate with FortiGuard, third-party threat intelligence sources, or custom feeds (CSV, STIX/TAXII, etc.).