The Fortinet Collector Agent can use the following methods to poll Active Directory (AD) for user logon events:
NetAPI - Queries the domain controllers directly to obtain user logon information.

FSSO REST API - Allows integration and polling via modern API-based communication for user

authentication updates.
WMI (Windows Management Instrumentation) - Retrieves logon data from domain controllers

using WMI queries.

NGFW (Next Generation Firewall) profile-based mode in FortiGate allows policies to use both flow- based and proxy-based inspection modes, providing flexibility depending on security and performance requirements. Additionally, profile-based mode supports applying applications and web filtering profiles directly in a firewall policy, allowing granular control over the traffic.

When the action is set to Allow in an application override, traffic matching this override is allowed without generating security logs because it bypasses deeper inspection and blocking.

Pre-shared key and certificate signature as authentication methods
FortiGate supports both pre-shared keys and digital certificates for IKEv1 authentication, providing flexibility in securing IPsec VPN tunnels.
Extended authentication (XAuth) to request the remote peer to provide a username and password FortiGate supports XAuth in IKEv1 to add an extra layer of user-level authentication, where the remote peer must provide a username and password in addition to the IKE credentials.

For active authentication (such as captive portal) to trigger, the FortiGate must intercept the user's initial web request. This requires DNS traffic to pass through the FortiGate so it can redirect the request to the login page. If the firewall policy does not include the DNS service, the user's browser resolves domains directly, and the authentication portal is never triggered.