I85PREP
⌘ K
FCP study materials
FCP study resources

FCP: Security Fabric and Network Security Fundamentals

FCP · Work through your exam, one topic at a time.

All guide sections

Security Fabric and Network Security Fundamentals

The Security Fabric and Network Security Fundamentals domain tests how FortiGate fits into the FortiOS fabric architecture and how packets traverse a FortiGate. Questions often ask about fabric roles, VDOMs, interface modes, and the order of operations.

Fabric building blocks

  • FortiGate is the fabric root; FortiSwitch, FortiAP, FortiExtender, and FortiClient telemetry join via FortiLink or fabric connectors.
  • Fabric connectors integrate external services such as syslog, RADIUS, FortiSandbox, and cloud services; they can be global or per-VDOM.
  • FortiGuard updates for IPS, antivirus, web filtering, and DNS filtering arrive through the FortiGuard Distribution Network. The root FortiGate aggregates fabric topology, and telemetry can be shared with FortiAnalyzer and FortiManager.

Packet flow essentials

  1. Ingress interface and zone assignment.
  2. Destination route lookup; policy routes are evaluated before the routing table.
  3. Stateful policy match on source/destination interface, address, user, service, schedule, and action.
  4. Session setup, NAT, UTM profiles, and logging.

Interface modes matter: NAT mode routes between subnets, while transparent mode forwards at Layer 2 but still enforces security policies. VDOMs create separate routing tables and policies; global settings and per-VDOM admin scope depend on configuration.

Worked example

A user at 10.1.10.5 browses an internet IP. FortiGate receives traffic on port1 in the LAN zone, routes it to port2 in the WAN zone via the default route, and matches a policy from LAN to WAN with source 10.1.10.0/24, service HTTP/HTTPS, action accept, and NAT enabled. The source is translated to port2's address. If no policy matches, FortiOS drops the traffic and logs it only if logging is enabled on the implicit deny. Route lookup must succeed before policy evaluation; if the route points to a different outgoing interface than the policy, the policy does not match.

Traps

  • HA config sync is not fabric connector synchronization; connector data may not replicate.
  • A zone member cannot be referenced individually in the same policy that references the zone.
  • Transparent mode still requires correct policy direction and does not route.

Key points

  • FortiGate is the fabric root; FortiLink joins FortiSwitch and FortiAP.
  • Route lookup precedes policy match in FortiOS.
  • VDOMs isolate routing and policies, not all global settings.
  • Zones simplify policy creation but constrain how members are referenced.
  • The implicit deny drops unmatched traffic; logging depends on policy settings.