In an FGSP (FortiGate Session Life Support Protocol) cluster, sessions are synchronized between members to provide seamless failover or handle asymmetric traffic. By default, FortiGate only synchronizes connection- oriented sessions (TCP). For connectionless sessions such as ICMP or UDP , synchronization must be explicitly enabled using the session-pickup-connectionless setting under the HA configuration. Without this setting, connectionless traffic remains local to the device that processed it and is not reflected in the session table of peer members.

When configuring ADVPN (Auto-Discovery VPN) to connect overlay networks across different hubs using IBGP and EBGP, special configurations are required to allow spokes from different overlay networks to dynamically establish tunnels.
# set auto-discovery-crossover enable
# This allows cross-hub tunnel discovery in an ADVPN deployment where multiple hubs are used.
# Since Hub A and Hub B belong to different overlays, enabling crossover discovery ensures that spokes from one overlay can dynamically create direct tunnels to spokes in the other overlay when needed.
# set enforce-multihop enable
# This setting ensures that BGP peers using loopback interfaces can establish connectivity even if they are not directly connected.
# Multihop BGP sessions are required when using loopback addresses as BGP peer sources because the connection might need to traverse multiple routers before reaching the BGP neighbor.
# This is especially useful in ADVPN deployments with multiple hubs, where routes might need to cross from one hub to another.

The diagram shows a FortiGate connected to two FortiSwitches, which suggests the use of FortiLink, Fortinet
' s protocol for managing switches directly from a FortiGate. Since multiple connections are being used, the LAN interface must be set to 802.3ad (LAG) mode to aggregate the links for redundancy and load balancing.
This setup allows FortiGate to handle VLAN assignments dynamically, as seen with VLAN 10 (192.168.15.1
/24). FortiLink ensures seamless integration between FortiGate and FortiSwitches, making STP unnecessary because Fortinet ' s MCLAG prevents loops at Layer 2. SD-WAN, on the other hand, is used for WAN interfaces and does not apply to switch connectivity in this scenario.

The Multi-Exit Discriminator (MED) is a BGP attribute used to influence the preferred path for incoming traffic from an external autonomous system (AS). The diagram shows that FortiGate_1 advertises MED 200, while FortiGate_2 advertises MED 300, meaning the ISP will prefer the route through FortiGate_1 because a lower MED is preferred in BGP.
To modify the MED value on FortiGate_1 for routes advertised to AS 30, the administrator must configure a route-map-out. A route map can match specific routes and set the MED value before sending them to the BGP neighbor.

When FortiGate is operating in proxy mode with full SSL inspection enabled, it inspects encrypted HTTPS traffic by default on port 443. However, some websites may use non-standard HTTPS ports (such as 8443), which FortiGate does not inspect unless explicitly configured.
To ensure that FortiGate inspects HTTPS traffic on port 8443, administrators must manually add port 8443 in the Protocol Port Mapping section of the SSL/SSH Inspection Profile. This allows FortiGate to treat HTTPS traffic on port 8443 the same as traffic on port 443, enabling proper inspection and enforcement of FortiGuard category-based web filtering.