In FortiManager, per-device mapping (also known as dynamic mapping ) is a fundamental feature used to manage objects that must have different values or names on different FortiGate units within the same ADOM.
According to the Fortinet Enterprise Firewall 7.6 Administrator Study Guide:
* Policy Package View: When an administrator views a policy package in the FortiManager GUI, they see the ADOM-level object . In this case, the object is named or contains the value " 10.0.5 " .
* Reinstall Preview/Installation: When FortiManager prepares the configuration for a specific device (like HQ-DCFW ), it checks for any per-device mappings defined for the objects used in the policy.
* The Result: If a mapping exists, FortiManager replaces the ADOM-level object with the device- specific object or value. The reinstall preview shows the actual CLI commands that will be pushed to the device. In the exhibit, it is clear that the ADOM object " 10.0.5 " has been mapped to the device- specific address object " SSLVPN_tunnel_addr1 " for the HQ-DCFW unit.
This mechanism allows an administrator to maintain a single " Golden Policy " package for the entire enterprise while ensuring that device-specific details (like local subnet names or unique tunnel addresses) are correctly applied to each physical or virtual firewall.

In enterprise hub-and-spoke environments, the most scalable and efficient way to ensure the corporate Hub learns the internal networks of remote branches (such as 192.168.1.0/24) is through the use of dynamic routing protocols. Implementing OSPF over IPsec allows the Hub and Spoke units to exchange routing information automatically through the VPN tunnel. Once the OSPF adjacency is established over the IPsec interface, the spoke will advertise its local 192.168.1.0/24 network to the Hub, which then installs the route into its routing table. This avoids the administrative burden and potential errors associated with manually adding static routes for every remote site.

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:
When importing a policy package from a FortiGate into a FortiManager ADOM, the Import Wizard compares the objects on the FortiGate with the objects already existing in the FortiManager ADOM database. If an object (e.g., an Address Object) has the same name but different values, a conflict occurs.
* To resolve this, the administrator must choose which version to keep. Choosing FortiManager accept (or " Use FortiManager value " ) resolves the conflict by keeping the existing object in the FortiManager database and applying its settings to the imported policy. This maintains global consistency across the ADOM.

Comprehensive and Detailed Explanation From Exact Extract documents and Knowledge:
In enterprise environments, " scaling " refers to increasing the total throughput or processing capacity of the security fabric.
* FGCP Active-Active (B): This clustering mode uses all members of the cluster to process traffic simultaneously, effectively distributing the UTM/IPS load and scaling performance beyond the limits of a single unit.
* FGSP (A): The FortiGate Session Life Support Protocol allows independent FortiGate units (or clusters) to synchronize session information. This is used to scale performance in asymmetrical routing environments or when using external load balancers to distribute traffic across multiple FortiGates.
* Note: FGCP Active-Passive (D) and VRRP (C) provide redundancy/high availability but do not scale performance, as only one unit processes traffic at any given time.

The Internet Service Database (ISDB) is a robust repository maintained by FortiGuard that contains the public IP addresses and port numbers of thousands of popular cloud-based services and applications.
FortiGate utilizes the ISDB in two primary ways:
* Provides predefined IPs and ports: It functions as a dynamic database of known services (like Microsoft 365 or AWS), saving administrators from the impossible task of manually creating and updating hundreds of address objects for these services.
* Blocks (or allows) IPs and ports: These ISDB objects can be used directly as the " Destination " in firewall policies. This allows the FortiGate to effectively block or allow traffic based on the specific IP ranges and ports associated with that internet service, providing granular control over application-level traffic at the network layer.