展示資料を参照してください。
展示資料には、ネットワークに接続されたFortiGateデバイスの図と、ファイアウォールの設定図が示されている。
管理者は、Remote-User2 による Web サーバーへのアクセスを拒否するために、デフォルト設定の拒否ポリシーを作成しました。
このポリシーは、Remote-User1がWebサーバーにアクセスできる一方で、Remote-User2がWebサーバーにアクセスできないように動作する必要があります。管理者は、デフォルトの動作に加えて、拒否ファイアウォールポリシーにどのような追加設定を追加すれば、Remote-User2によるWebサーバーへのアクセスをブロックできるでしょうか？
(いずれか1つを選択してください)
正解：C
"The example on this slide shows how FortiGate handles two incoming connections to the same external address, but on different ports... Both connections match the firewall policy ID, which references two VIPs as destination."
"In FortiOS, VIPs and firewall address objects are completely different. They are stored separately with no overlap. Starting in version 7.2.4, the parameter match-vip is enable by default and allows the firewall address objects to match VIPs."
"In the example shown on this slide, the destination of the first firewall policy is set to all . This means all destination addresses (0.0.0.0/0), by default, including the external addresses defined on the VIPs." Technical Deep Dive:
The correct answer is C. Set the Destination address as Webserver in the Deny policy.
FortiGate allows VIP objects to be used as destination objects in firewall policies . The study guide explicitly shows incoming connections matching firewall policies that reference VIPs as the destination. That means if the administrator wants to deny only Remote-User2 # Webserver , the clean and specific way is to set the Destination in the Deny policy to the Webserver VIP .
Why this is the best answer:
* With the default deny-policy behavior, destination = all plus match-vip enabled by default means the deny rule can match VIP external addresses too.
* But that is broader than necessary. If the intent is specifically to block access only to the published Webserver , then the deny rule should explicitly reference the Webserver VIP as the destination.
Why the other options are wrong:
* A is incorrect because match-vip is relevant to deny policy behavior, and the study guide notes that match-vip is available only when the firewall policy action is set to DENY . An allow policy is not where this setting applies.
* B is unrelated. IP pools are for SNAT behavior, not for selectively denying inbound access to a VIP.
* D is incorrect because Deny_IP is the source object representing the remote user, not the destination web server.
So the proper additional configuration is to make the deny policy specific by setting:
* Source = Deny_IP
* Destination = Webserver
* Action = DENY
That blocks Remote-User2 from the VIP-published web server while still allowing Remote-User1 to reach it through the lower allow policy.
