Starting with all IPS signatures in monitor mode lets FortiGate detect and log matching traffic without blocking it, so you can observe which signatures affect legitimate application behavior.
After verifying the patterns and confirming they are true positives, you can safely change the relevant signatures to blocking mode without disrupting existing applications.

The best way to automate a firewall policy using a daily updated list of IP addresses is by using an external connector from Threat Feeds. This allows FortiGate to dynamically retrieve real-time threat intelligence from external sources and apply it directly to security policies.
By configuring Threat Feeds, the administrator can:
# Automatically update firewall policies with the latest malicious IPs daily.
# Block traffic from those IPs in real-time without manual intervention.
# Integrate with FortiGuard, third-party threat intelligence sources, or custom feeds (CSV, STIX
/TAXII, etc.).

The exhibit shows an active-passive HA (high availability) cluster with two virtual clusters, where FortiGate_A is the primary device for both Core1 and Core2. If the goal is to have FortiGate_B take over Core2 traffic, its priority must be higher than FortiGate_A for Virtual Cluster 2.
Currently, FortiGate_A has a priority of 150 for Core2, while FortiGate_B has 128. Increasing FortiGate_B's priority to 200 ensures it becomes the primary for Virtual Cluster 2, taking over the Core2 VDOM traffic while keeping Core1 traffic on FortiGate_A.
Disabling override would prevent forced failovers but wouldn't change the role distribution.
Adjusting the load-balancing method is irrelevant in an active-passive setup, as it only applies to active-active configurations.

When using IPsec VPNs and VXLAN, additional headers are added to packets, which can exceed the default 1500-byte MTU. This can lead to fragmentation issues, dropped packets, or degraded performance.
To resolve this, the MTU (Maximum Transmission Unit) should be adjusted only if all devices in the network path support it. Otherwise, some devices may still drop or fragment packets, leading to continued issues.
Why adjusting MTU helps:
* VXLAN adds a 50-byte overhead to packets.
* IPsec adds additional encapsulation (ESP, GRE, etc.), increasing the packet size.
* If packets exceed the MTU, they may be fragmented or dropped, causing intermittent connectivity issues.
* Lowering the MTU on interfaces ensures packets stay within the supported size limit across all network devices.

The diagram shows a multi-area OSPF network where:
* FortiGate A is in OSPF Area 0 (Backbone area).
* FortiGate B is in OSPF Area 0.0.0.1 and is connected to an RIP network.
To ensure that OSPF Area 0 (0.0.0.0) learns routes from the external RIP network, FortiGate B must redistribute RIP routes into OSPF.
Steps to achieve this:
1. Enable route redistribution on FortiGate B to inject RIP-learned routes into OSPF.
2. This allows OSPF Area 0.0.0.1 to forward RIP routes to OSPF Area 0 (0.0.0.0), making the external network visible.