CCSE (EC-Council Certifications) cheat sheet

Security Fabric components: FortiGate (policy enforcement), FortiManager (centralized management), FortiAnalyzer (logging/reporting), FortiAuthenticator (identity), FortiSandbox (detonation), FortiClient (endpoint); Fabric connectors bind them via authorization tokens.

Administrative access hardening: restrict HTTPS/SSH to trusted admin subnets on the management interface, enable two-factor authentication for admin accounts, and use admin profiles with least privilege instead of the super_admin profile.

Configuration backup options: local USB/disk, FortiManager revision control, and automated backup to a remote server over SCP/TFTP; backups include the encrypted private keys only if the backup passphrase is supplied.

Firmware upgrade path rule: read the release notes for the upgrade path matrix; skipping intermediate firmware versions is unsupported when the matrix requires stepping through a specific version.

VDOM mode is set at deployment; changing between NAT mode and VDOM-enabled mode requires a reboot and re-creates the management VDOM (root by default).

HA and management: in an A-A or A-P cluster, the primary unit holds the configured management IP; the secondary is reachable only via the dedicated HA management interface or by failing over.

Factory reset and re-provisioning: execute factoryreset (full) versus factoryreset2 (keeps some settings); after reset the default admin account has no password and must be set on first login.

Licensing: FortiCare registration binds the serial number to support and firmware downloads; FortiGuard subscription status is verified under System > FortiGuard and drives signature/profile updates.

Policy evaluation is top-down first-match: once a policy matches, later policies are not evaluated; implicit deny drops unmatched traffic and can be logged explicitly.

NAT order: destination NAT (VIP/central SNAT) is applied before routing, then the route lookup, then source NAT on egress; a VIP must be referenced in the policy destination, not just created.

Central SNAT versus policy NAT: central SNAT applies per source/destination/interface tuple and overrides policy-based NAT; policy NAT is configured inside the firewall policy itself.

Session helpers and ALGs (e.g., SIP, FTP) are needed for protocols that embed IPs/ports in payload; disabling a helper can break the application while tightening security.

Security profiles are attached per policy and evaluated only on traffic that matches that policy; a policy with no profiles performs no UTM inspection.

Policy routes override the routing table for matching traffic and are evaluated before the FIB lookup; they are commonly used for SD-WAN or dual-WAN steering.

Address objects support subnet, IP range, geography, FQDN, and wildcard FQDN; FQDN objects resolve via DNS and update the object automatically when the TTL expires.

Local-in policies control traffic destined to the FortiGate itself (management, routing protocols) and are separate from forwarding policies.

Antivirus scan modes: proxy-based (full buffering, higher latency, stronger inspection) versus flow-based (streaming, lower latency, less deep inspection); choose based on latency budget.

IPS signatures have severity and action (block, monitor, reset); a profile's IPS sensor can override per-signature action, and anomaly-based rules detect protocol deviations.

Web filter categories come from FortiGuard; local categories and custom URL lists override or supplement them; rating lookups can be cached to reduce latency.

Application control identifies applications by signature regardless of port; SSL inspection is required to see encrypted application traffic, otherwise only the TLS handshake metadata is visible.

SSL/SSH deep inspection uses a forward-proxy certificate; the client must trust the inspection CA, and certificate-pinned applications will break unless excluded.

Anti-spam and DLP rely on FortiGuard and pattern matching; DLP sensors match on file type, content patterns, and watermark, and must be attached to a policy to act.

FortiSandbox integration submits suspicious files; verdicts return as clean, suspicious, or malicious, and can be enforced via the antivirus profile's sandbox action.

Routing precedence: policy routes > directly connected routes > static routes > dynamic routes, with longest-prefix match winning within the same source.

Interface modes: NAT (routed), transparent (bridge, no IP change), and VDOM-linked; transparent mode requires matching the bridge interfaces' VLANs.

Static route attributes include distance (administrative distance), priority, and gateway; lower distance wins, and equal distance/priority enables ECMP.

DHCP server options: address range, lease time, default gateway, DNS, and reservations; the FortiGate can also act as a DHCP relay to an external server.

VLAN configuration: create a VLAN sub-interface on the physical interface with an 802.1Q tag, then assign an IP and policy references; native VLAN traffic is untagged.

DNS: the FortiGate can act as a DNS server for internal clients or forward to external resolvers; DNS filter profiles use FortiGuard for category-based resolution.

SD-WAN uses a member interface set with health checks (SLA targets for latency, jitter, packet loss) and rules that steer traffic based on SLA compliance.

IPsec phases: IKE Phase 1 establishes the ISAKMP SA (authentication, encryption, DH group); Phase 2 establishes the IPsec SA (ESP encryption/authentication, PFS).

IPsec troubleshooting order: check Phase 1 status (diagnose vpn ike gateway list), then Phase 2 selectors, then routing and policy for the protected subnets.

SSL VPN modes: tunnel (full network access), web (bookmark portal), and port-forward; authentication can use local, LDAP, RADIUS, or client certificates.

HA modes: active-passive (one primary forwards, secondary standby) versus active-active (both forward, sessions distributed); failover is triggered by heartbeat loss or monitored interface failure.

HA synchronization: configuration, sessions, and (optionally) routing are synchronized; the HA heartbeat uses dedicated ports or a heartbeat interface, and split-brain occurs when heartbeat is lost on both sides.

HA override and priority: with override enabled, the unit with the highest priority becomes primary even after a failover; without override, the current primary retains the role.

Cluster virtual MAC and gratuitous ARP: on failover the new primary sends gratuitous ARP so upstream switches update their MAC tables to the new primary's interface.

Packet capture: diagnose sniffer packet '' ; level 4 includes interface names, level 6 includes packet payload.

Session lookup: diagnose sys session list and diagnose sys session filter narrow output; check the session state (e.g., established, syn_sent) and the policy ID that matched.

Debug flow: diagnose debug flow filter <addr/port> followed by diagnose debug enable shows the policy lookup, NAT, and routing decisions for a packet.

Common causes of traffic drops: implicit deny (no matching policy), asymmetric routing (return path differs), MTU/MSS issues (fragmentation, PMTUD black holes), and session table exhaustion.

Log inspection: use FortiAnalyzer or local logs; filter by policy ID, action (deny), and log subtype (traffic, utm, event) to isolate the failing stage.

HA troubleshooting: verify heartbeat interface status, cluster uptime, and that both units run the same firmware and configuration checksum; mismatched firmware prevents cluster formation.

Routing issues: check the FIB with get router info routing-table all and verify the return route exists on the FortiGate for the reply traffic.

Log types: traffic, event, utm, anomaly, and voip; each policy can log at session start, end, or both, and logging all sessions increases storage and CPU load.

FortiAnalyzer stores logs for reporting and correlation; log retention is governed by the device's disk quota and the ADOM policy; forwarding uses OFTP over TCP 514.

SNMP monitoring exposes interface counters, CPU, memory, and session counts; SNMPv3 adds authentication and encryption over v1/v2c.

Health checks: monitor CPU, memory, session count, and disk usage; high session counts with low throughput often indicate a DoS or a session-table limit.

Firmware maintenance: schedule upgrades in a maintenance window, take a configuration backup, verify the upgrade path, and confirm HA synchronization after upgrade.

FortiGuard updates: signature and engine updates are scheduled and can be pushed manually; stale updates leave the device exposed to new threats.

Reporting: scheduled reports in FortiAnalyzer summarize top applications, threats, and bandwidth consumers; dashboards provide real-time widgets for the same metrics.