When full SSL inspection is enabled, FortiGate intercepts HTTPS traffic, decrypts it for inspection, and re- encrypts it using its own SSL certificate before forwarding it to the browser. If the browser does not trust the SSL certificate being used by FortiGate for re-encryption, it will display certificate warning errors. To resolve this, the certificate used by FortiGate for SSL inspection must be installed and trusted in the browser's certificate store.

To deny access to the web server for Remote-User2 while allowing Remote-User1 to access the same web server, two configuration changes can be made:
* Enable match-vip in the Deny policy:By enabling the match-vip option in the Deny policy, the FortiGate will check for virtual IP (VIP) objects during policy matching. This setting allows the firewall policy to correctly identify and block traffic directed to a specific mapped IP address, such as the web server, when using a VIP configuration.
* Set the Destination address as Webserver in the Deny policy:Setting the Destination address to
"Webserver" in the Deny policy ensures that the policy specifically targets traffic attempting to reach the web server. This configuration helps to precisely control which traffic should be blocked, focusing the Deny policy on the intended destination.
References:
* FortiOS 7.4.1 Administration Guide: Deny matching with a policy with a virtual IP applied
* FortiOS 7.4.1 Administration Guide: Configuring Policies with VIPs

The current setting for the root FortiGate (Local-FortiGate) is fabric-object-unification local, which means that new address objects are not shared across the security fabric. Changing this setting to fabric-object- unification default will allow address objects to be synchronized and shared with downstream devices like the ISFW.

Automation stitches on FortiGate can have one or more triggers, which are conditions or events that activate the automation stitch. The trigger defines when the automation stitch should execute the defined actions.
Actions within a stitch can be executed sequentially or in parallel, depending on the configuration.
References:
* FortiOS 7.4.1 Administration Guide: Automation Stitches

The serial console method allows management access to the FortiGate CLI without relying on network connectivity. This method involves directly connecting a computer to the FortiGate device using a serial cable (such as a DB-9 to RJ-45 cable or USB to RJ-45 cable) and using terminal emulation software to interact with the FortiGate CLI. This method is essential for situations where network-based access methods (such as SSH or Telnet) are not available or feasible.
References:
* FortiOS 7.4.1 Administration Guide: Console connection