InFortiManager,pre-run CLI templatesare used inZero-Touch Provisioning (ZTP)andLow-Touch Provisioning (LTP)to configure a FortiGate devicebeforeit is fully managed by FortiManager.
These templatesapply configurationswhen a device is initially provisioned.Once the pre-run CLI template is executed, FortiManagerautomatically unassignsit from the device because it isnot meant to persistlike other policy configurations. This prevents conflicts and ensures that the FortiGate configuration isnot repeatedly appliedafter the initial setup.

IKEv2 (Internet Key Exchange version 2) is an improvement over IKEv1, offering enhanced security, efficiency, and flexibility in VPN configurations.
It includes stronger Diffie-Hellman (DH) groups, such as Elliptic Curve (ECP) groups.
IKEv2 supports stronger cryptographic algorithms, includingElliptic Curve Diffie-Hellman (ECDH) groups such asECP256 and ECP384, providing improved security compared to IKEv1.
It supports the extensible authentication protocol (EAP).
IKEv2 natively supports EAP authentication, which allows integration with external authentication mechanisms such asRADIUS, certificates, and smart cards. This is particularly useful forremote access VPNswhere user authentication must be flexible and secure.

Applying anaggressive IPS profilewithout prior testing candisrupt legitimate applicationsby incorrectly identifying normal traffic as malicious. To prevent disruptions while still monitoring for threats:
#Enable IPS in "Monitor Mode" first:
# This allows FortiGate tolog and analyzepotential threatswithout actively blockingtraffic.
# Administrators can review logs and fine-tune IPS signatures to minimize false positives before switching to blocking mode.
#Verify and adjust signature patterns:
# Some signatures might trigger unnecessary blocks for legitimate application traffic.
# By analyzing logs, administrators candisable or modifyspecific rules causing false positives.

From the exhibit, ISFW is part of a Security Fabric environment with NGFW-1 as the Fabric Root. In this architecture, FortiGate devices share security intelligence, including logs and detected threats.
ISFW is in a Security Fabric environment:
# Security Fabric allows devices like ISFW toreceive threat intelligencefrom NGFW-1, even if UTM is not enabled locally.
# If NGFW-1 detects malware fromIP 10.1.10.1 to 89.238.73.97, this information can bepropagated to ISFW and FortiAnalyzer.
The firewall policy in NGFW-1 has UTM enabled:
# Even thoughISFW does not have UTM enabled, NGFW-1 (which sits between ISFW and the external network)does have UTM enabledand is scanning traffic.
# Since NGFW-1 detects malware in the session, it logs the event, which is then sent toFortiAnalyzer.

FortiGate, like other security appliances, cannot analyze encrypted HTTPS traffic unless itdecryptsit first. If only certificate inspectionis enabled, FortiGate can see the certificate details (such as the domain and issuer) butcannot inspect the actual web content.
To fully analyze the traffic and detect potential malware threats:
#Full SSL inspection (Deep Packet Inspection)must be enabled in theSSL/SSH Inspection Profile.
# This allows FortiGate todecrypt the HTTPS traffic, inspect the content, and then re-encrypt it before forwarding it to the user.
# Without full SSL inspection, threats embedded in encrypted traffic may go undetected.