I85PREP
⌘ K
Fortinet FCA study materials
Fortinet FCA study resources

Fortinet FCA: Network Security Fundamentals (FortiGate, FortiOS, NGFW)

Fortinet FCA · Work through your exam, one topic at a time.

All guide sections

Network Security Fundamentals (FortiGate, FortiOS, NGFW)

What this domain tests

Network Security Fundamentals (FortiGate, FortiOS, NGFW) tests how a FortiGate processes traffic and how FortiOS features combine into next-generation firewall protection. Expect firewall policy order, NAT, security profiles, SSL inspection, VDOMs, and high availability at a foundational level.

Core rules and concepts

  • A FortiGate is a stateful NGFW. It inspects flows, tracks sessions, and applies firewall policy plus UTM and security profiles.
  • FortiOS is the operating system. Interfaces, zones, routing, policies, and profiles are configured in FortiOS.
  • Firewall policy lookup is top-down. The first matching policy wins; if no policy matches, the implicit deny drops the traffic.
  • NAT is commonly enabled on the outbound policy so private addresses are translated to the interface address.
  • Security profiles such as IPS, antivirus, application control, web filtering, and DNS filtering must be attached to the policy that permits the traffic.
  • SSL inspection is required to see inside encrypted HTTPS sessions; without it, many web-filter and IPS checks are limited.
  • VDOMs partition one FortiGate into independent virtual firewalls; HA pairs synchronize configuration and sessions.

Worked example

A LAN subnet 10.0.1.0/24 must reach the internet through port1 with web filtering, IPS, and NAT. Create a policy from LAN to WAN with source 10.0.1.0/24, destination all, service HTTP and HTTPS, action accept, NAT enabled, and the web-filter and IPS profiles attached. Place it above any broader deny policy. If users report that HTTPS categories are not filtered, check whether SSL inspection is enabled and whether the certificate is trusted by clients.

Traps that cost marks

  • Creating a security profile but not attaching it to a policy.
  • Putting a broad deny policy above the specific allow policy, so the first match blocks traffic.
  • Confusing NAT with routing: NAT changes addresses; routing decides the next hop.
  • Expecting VDOMs to share routing tables or administrators by default.
  • Assuming HA syncs everything, including licenses and some local settings.