I85PREP
⌘ K
Fortinet FCF study materials
Fortinet FCF study resources

Fortinet FCF: Network Security Fundamentals

Fortinet FCF · Work through your exam, one topic at a time.

All guide sections

Network Security Fundamentals

The Network Security Fundamentals domain tests whether you can explain how modern perimeter and internal security is built, and where the FortiGate and the Fortinet Security Fabric fit. Expect questions on firewall generations, unified threat management (UTM), policy evaluation, segmentation, and secure remote access.

Firewall generations

  • Packet filters match a static 5-tuple (source and destination IP, port, protocol) with no memory of the connection.
  • Stateful inspection keeps a session table, so return traffic is permitted automatically.
  • A next-generation firewall (NGFW) adds application awareness and content inspection: IPS, application control, web filtering, antivirus, TLS inspection, plus identity from LDAP, RADIUS or FSSO.

The FortiGate is an NGFW running FortiOS. Its value is consolidation: one policy can carry several security profiles instead of a chain of single-purpose appliances.

Policies and address translation

Policies are evaluated top-down and the first match wins; traffic matching nothing hits the implicit deny at the bottom. A policy binds incoming interface, outgoing interface, source, destination, schedule, service and user, plus any profile.

Source NAT rewrites the source address, typically to hide internal hosts behind an external IP on egress. Destination NAT is configured as a virtual IP (VIP) mapping a public IP and port to an internal server.

Segmentation and remote access

VLANs, zones and micro-segmentation limit lateral movement after a host is compromised. Site-to-site IPsec links branches; dial-up IPsec and ZTNA serve remote users. ZTNA grants access to one application after identity and device-posture checks instead of placing the user on the network. Recent FortiOS releases have been steering remote access away from SSL VPN tunnel mode toward these alternatives.

The Security Fabric

The Fabric is Fortinet's broad, integrated, automated architecture: the FortiGate usually acts as the root, exchanging telemetry with FortiAnalyzer, FortiManager, FortiSandbox, FortiClient, FortiNAC and FortiEDR through Fabric Connectors and automation stitches.

Worked example

A branch user cannot reach an internal application that other sites use. Check the policy hit counter first. Zero hits means the traffic never matched a permit rule - look for a deny rule ordered above it, or a routing or interface mismatch. If hits increment but sessions still fail, inspect the attached profiles: an IPS or web-filter block is logged as an action, not a silent drop. Finally verify NAT - a VIP bound to the wrong external port forwards nothing.

Traps that cost marks

  • Treating the implicit deny as the first rule rather than the last.
  • Confusing source NAT with a VIP.
  • Assuming a security profile applies globally; it only inspects traffic matching the policy that carries it.
  • Equating ZTNA with a VPN.
  • Believing the Fabric requires identical hardware everywhere; integration happens through connectors and APIs.