FCP common mistakes
FCP · Understand the traps and how to avoid them.
Treating the FortiGate Security Fabric as a single-product feature and answering questions about Fabric connectors, root FortiGate election, and telemetry as if they were separate unrelated tools.
Candidates memorize individual FortiGate features in isolation and never build a mental model of the Fabric topology, so they confuse the roles of root FortiGate, downstream devices, and Fabric connectors under pressure.
What to do instead
Draw the Fabric hierarchy by hand: root FortiGate, downstream FortiGates, FortiManager, FortiAnalyzer, and endpoint connectors. For each, write what it contributes to logging, sharing, and enforcement, then practice mapping a scenario to the correct component.
Reading a firewall policy top-down and assuming the first policy whose source and destination match will apply, ignoring that service, schedule, and NAT settings are also match criteria.
Policy lookup is drilled as a simple source/destination exercise, so candidates forget that an earlier policy with a narrower service or an expired schedule will not match and the packet falls through to a later policy or the implicit deny.
What to do instead
Practice tracing full 5-tuple lookups through multi-policy tables, checking every field in each policy until a complete match is found. Include a policy with a schedule and one with a custom service to force full-criteria checking.
Confusing traffic shaping priority with guaranteed bandwidth and selecting the wrong shaper type (shared vs per-IP) for a scenario that asks about limiting each user individually.
The terminology overlaps and candidates memorize shaper names without linking them to the behavior described in the scenario, so a question about per-user limits gets answered with a shared shaper.
What to do instead
Build a two-column table: shaper type on the left, exact behavior on the right (shared pool vs per-IP allocation, priority handling, guaranteed vs maximum bandwidth). Re-read each scenario and underline the words 'each user' or 'total' before choosing.
Mixing up authentication server types and choosing LDAP when the scenario requires group-based authorization that only comes from a directory-integrated method, or placing the wrong method in a firewall policy.
Candidates learn LDAP, RADIUS, TACACS+, and local users as a list of names without connecting each to what it can return (group membership, attributes, accounting) and where it is referenced in policy.
What to do instead
For each server type, note what it authenticates, what it can return, and where it is used (user group in policy, admin login, VPN portal). Then practice matching scenario clues like 'group membership' and 'accounting' to the right method.
Configuring an SSL VPN and forgetting that firewall policy, portal mapping, and split-tunnel settings must all align, then choosing an answer that only fixes one of those layers.
Candidates treat SSL VPN as a single configuration screen and do not realize that a working tunnel requires the portal, the firewall policy referencing the tunnel interface, and routing to be consistent.
What to do instead
Write a checklist for SSL VPN: portal and split-tunnel mode, firewall policy from the tunnel interface, authentication method, and route to internal subnets. For each practice scenario, verify all four before selecting an answer.
Assuming an IPsec phase 1 that shows as up means the tunnel passes traffic, and failing to distinguish phase 1 negotiation problems from phase 2 selector mismatches.
The status display shows phase 1 as established even when phase 2 fails, so candidates blame the wrong layer and pick a fix for phase 1 when the real issue is a mismatched subnet or proposal in phase 2.
What to do instead
Learn the two-stage model: phase 1 covers IKE proposals, authentication, and peer identity; phase 2 covers selectors, proposals, and PFS. When a scenario says the tunnel is up but no traffic flows, check phase 2 selectors and routing first.
Treating web filter and application control as interchangeable and applying the wrong profile to a scenario that specifies blocking a category versus blocking a specific application behavior.
Both profiles inspect traffic and both appear in the same policy, so candidates default to whichever term appears in the question stem instead of reasoning about whether the target is a URL category or an application signature.
What to do instead
Memorize the split: web filter acts on URL categories and ratings, application control acts on application signatures and behavior regardless of port. Practice classifying scenarios as category-based or application-based before choosing the profile.
Assuming an IPS or anti-malware profile blocks everything once attached to a policy, without checking profile action settings, inspection mode, or whether the traffic is actually inspected.
Candidates see the profile attached in the policy and stop there, missing that the profile's individual signatures may be set to monitor rather than block, or that the traffic bypasses inspection due to flow versus proxy mode settings.
What to do instead
For every IPS and anti-malware scenario, verify three things: the profile is attached to the matching policy, the signature action is set to block, and the inspection mode supports the required inspection. Check these in order before selecting a fix.
Choosing a static route fix for a problem that is actually an SD-WAN rule or policy route ordering issue, or ignoring administrative distance when multiple routes match.
Routing questions often describe symptoms like traffic taking the wrong path, and candidates jump to static routes without considering that SD-WAN rules and policy routes are evaluated before the routing table.
What to do instead
Learn the evaluation order: policy routes and SD-WAN rules are checked before the routing table, then longest-prefix match, then administrative distance. For each scenario, ask which mechanism is consulted first before choosing the fix.
Diagnosing a connectivity or performance issue by guessing at configuration changes instead of following a layered troubleshooting sequence using logs, debug flow, and session tables.
Candidates under time pressure skip evidence gathering and pick the answer that sounds most technical, missing that the correct answer is usually the next diagnostic step rather than a configuration change.
What to do instead
Adopt a fixed sequence: check logs and event history, run debug flow to see where packets are dropped, inspect the session table, then examine policy and routing. Practice scenarios by writing the next diagnostic step before looking at the options.
Assuming HA failover is automatic and complete without verifying session synchronization, heartbeat interface configuration, and HA override settings.
Candidates learn that HA provides redundancy and stop there, so they miss that sessions may not sync, that the heartbeat interface must be dedicated, and that override affects which unit becomes primary.
What to do instead
List the HA prerequisites explicitly: matched firmware and configuration, dedicated heartbeat link, session synchronization enabled, and override behavior understood. For each failover scenario, check these prerequisites before concluding failover will work.