FCP FortiGate Administrator key terms

An ordered rule that tells the FortiGate whether to accept or deny traffic by matching source interface, destination interface, source address, destination address, schedule, and service. Each policy also controls NAT, security profiles, and logging for matched sessions.

A FortiGate mode where NAT is configured in dedicated, reusable NAT rules referenced by firewall policies instead of being set inside each policy. It centralizes address translation and simplifies management across many policies.

A named range of external addresses used for source NAT, so internal hosts appear to originate from those addresses on the internet. Pools can be overloaded, one-to-one, or fixed-port-range depending on the translation type.

Translation that rewrites the source address of outbound packets, typically so private hosts can share a public address when reaching the internet. It is enabled per policy or in central NAT rules.

A virtual IP object that maps a public address and port to an internal server address and port, allowing external clients to reach hosted services. The VIP is applied as the destination address in a firewall policy.

A routing rule evaluated before the main routing table that forwards matching traffic out a specified interface and gateway, optionally changing the source address. It is used for source-based routing and traffic steering.

A manually configured path that tells the FortiGate which next-hop gateway or interface to use to reach a destination network. Administrative distance and priority determine which route is preferred when several match.

The FortiGate's internal list of known networks and their next hops, built from connected, static, and dynamic sources. The best matching entry decides where each packet is forwarded.

A routing behavior that installs multiple routes with the same destination and distance and distributes sessions across them. It improves bandwidth use and redundancy for traffic to a shared network.

A FortiGate feature that groups multiple WAN links into one logical interface and steers traffic by health checks, priority, and rules. It provides failover and load balancing across connections.

A separate routing instance with its own routing table and interfaces, used to isolate traffic between tenants or networks. Interfaces are assigned to a VRF, and policies route traffic between them.

A FortiGate framework that connects FortiGate, FortiAnalyzer, FortiManager, endpoints, and other Fortinet products so they share topology, logs, and threat intelligence. It enables centralized visibility and coordinated response.

A permission set assigned to an admin account that defines which areas of the FortiGate the admin can view or change. Profiles can be read-only, read-write, or limited to specific menus.

A method where the FortiGate validates user credentials against an external directory server such as Active Directory. It is commonly used for firewall and SSL VPN user authentication.

A method where the FortiGate sends user credentials to a RADIUS server for validation and receives an accept or reject response. It supports centralized authentication and accounting for network access.

A login requirement that combines something the user knows, such as a password, with something they possess, such as a one-time code from a token or email. It strengthens access to admin and VPN accounts.

A collection of local or remote user accounts referenced by firewall policies and VPN settings. Group membership lets one policy apply to many users and simplifies permission management.

A set of content-inspection settings such as antivirus, web filter, IPS, and application control that a firewall policy applies to matching traffic. Profiles determine how the FortiGate inspects and acts on sessions.

A security profile that scans files and protocols for malware using signatures and other detection methods. It can block, monitor, or quarantine infected content depending on configured actions.

A security profile that inspects traffic for known attack patterns and anomalies using signatures. It can reset, block, or log matching traffic based on severity and configured actions.

A security profile that controls access to websites by category, URL, or reputation and can inspect content. It supports allow, block, monitor, and warning actions for matched web requests.

A security profile that identifies and controls traffic by application, regardless of port or protocol. It can allow, block, or shape applications and supports per-category actions.

A feature that decrypts TLS traffic so security profiles can inspect the content, then re-encrypts it before delivery. It requires a certificate and is often exempted for sensitive categories.

A remote-access service that lets users connect to the FortiGate over TLS through a web portal or tunnel client. Access is controlled by portal settings, user groups, and firewall policies.

A site-to-site or dial-up tunnel that encrypts and authenticates traffic between networks using IKE and ESP. Phase 1 negotiates the tunnel, and phase 2 defines the protected subnets.

The first stage of IPsec negotiation that authenticates peers and establishes a secure channel for later negotiations. It defines encryption, hashing, authentication method, and Diffie-Hellman group.

The second stage of IPsec negotiation that creates the security association protecting actual user traffic. It defines the encryption and authentication algorithms and the interesting traffic selectors.

A secret string configured on both IPsec peers to authenticate them during tunnel negotiation. It must match exactly and should be long and random to resist guessing.

The recording of events such as traffic, security detections, and system changes for auditing and troubleshooting. Logs can be stored locally or sent to FortiAnalyzer or a syslog server.

A Fortinet appliance or VM that collects, stores, and analyzes logs from FortiGate devices. It provides reports, dashboards, and event correlation across the Security Fabric.

A Fortinet centralized management platform used to configure, deploy, and monitor multiple FortiGate devices. It supports policy packages and device groups for consistent configuration.

A ranking of log messages from debug through emergency that indicates how serious an event is. Severity levels help filter which messages are recorded or alerted on.

A live list of active connections tracked by the FortiGate, showing addresses, ports, policy, and state. It is used to verify that traffic matches the expected policy and NAT.

A CLI troubleshooting command that prints each step a packet takes through routing, policy lookup, and NAT decisions. It helps identify why traffic is dropped or translated unexpectedly.

A configuration where two or more FortiGates form a cluster that shares addresses and synchronizes sessions so traffic continues if one unit fails. Members monitor each other with heartbeat links.

The practice of exporting the FortiGate configuration to a file and reloading it later to recover or replicate settings. Backups should be encrypted and stored securely off the device.