You want to protect OT devices that are not updated against known vulnerabilities so you apply virtual patching to the firewall policies. What must…

Virtual patching in a FortiGate OT environment is applied by using an Intrusion Prevention System (IPS) profile with relevant OT signatures on a firewall policy. To confirm that this virtual patch is actively protecting specific OT devices, the administrator must verify the status of the feature on the firewall rules. The CLI command get rule otvp status is specifically designed for this purpose. It displays the firewall policy IDs that have OT virtual patching enabled and lists the IP addresses of the assets being actively protected by those policies, providing direct confirmation of the virtual patch's operational status.

A. The output of the CLI command get virtual-patch profile: This command would show the configuration of a virtual patch profile, not its active enforcement status on traffic passing through a specific firewall policy.

B. The OT View page: The OT View page is a dashboard for asset visibility, network topology, and high-level threat information. It does not provide granular status details for virtual patching on individual firewall policies.

D. The Asset Identity List page: This page lists discovered OT assets and their identified vulnerabilities. While it shows which devices need patching, it does not confirm that a virtual patch is actively being applied.

1. Fortinet Document Library: FortiGate OT Security 7.6.0 Administration Guide.

Section: Virtual patching > Verifying the virtual patch.

Content: "You can use the get rule otvp status command to check the virtual patching status of the firewall policies. The command output shows the policy ID and the IP addresses of the assets that are being virtually patched." This directly supports option C as the correct verification method.