TheInternet Service Database (ISDB)in FortiGate is used to enforce content filtering atLayer 3 (Network Layer) and Layer 4 (Transport Layer)of the OSI model by identifying applications based on their predefined IP addresses and ports.
FortiGate has a predefined list of all IPs and ports for specific applications downloaded from FortiGuard:
# FortiGate retrieves and updates apredefined listof IPs and ports for different internet services from FortiGuard.
# This allows FortiGate to block specific services atLayer 3 and Layer 4without requiring deep packet inspection.
The ISDB blocks the IP addresses and ports of an application predefined by FortiGuard:
# ISDB works by matching traffic to knownIP addresses and portsof categorized services.
# When an application or service is blocked, FortiGate prevents communication bydenying traffic based on its destination IP and port number.

When FortiGate processes the first packets of a session, it follows a sequence of steps to determine how the traffic should be handled before establishing a session. The initial step involves:
# Access Control List (ACL) checks: Determines if the traffic should be allowed or blocked based on predefined security rules.
# Hardware Packet Engine (HPE) inspections: Ensures that packet headers are valid and comply with protocol standards.
# IP Integrity Header Checking: Verifies if the IP headers are intact and not malformed or spoofed.
Once these security inspections are completed and the session is validated, FortiGate then installs the session in hardware (if offloading is enabled) or processes it in software.

In atransparent mode Virtual Domain (VDOM)configuration, FortiGate operates as aLayer 2 bridgerather than performing Layer 3 routing. Theset forward-domain <domain_ID>command is used to control how traffic is forwarded between interfaces within the sametransparent VDOM.
Aforward-domainacts as abroadcast domain, meaning only interfaces with thesame forward-domain ID can exchange traffic. This setting is commonly used toseparate different VLANs or network segments within the transparent VDOM while still allowing FortiGate to apply security policies.

Zero phase selectors inIPsec Phase 2mean thatno specific traffic selectors (subnets) are defined, allowing any traffic to be encryptedthrough the VPN tunnel. This can causeunintended traffic forwarding issues and disrupt network operations.
To prevent this from happening during future migrations:
#Using routing protocolsensures thatonly specific subnets are advertised over the tunnel. Dynamic routing (such as OSPF or BGP) helps define which networks should use the tunnel, preventing unintended traffic from being encrypted.
#Clearly defining phase 2 selectorsavoids the problem of encrypting all traffic byexplicitly stating the allowed source and destination subnets. This prevents the tunnel from affecting unrelated network traffic.