FCP FortiGate Administrator study plan
FCP FortiGate Administrator · Give each week a clear focus.
8 weeks · About 6 hours per week
Firewall Policy and NAT
Map the FortiGate policy evaluation order and explain how policy lookup, NAT, and session setup interact
Build 5 IPv4 firewall policies that use service, schedule, and user/group objects and verify the resulting sessions
Configure source NAT and destination NAT (VIP) on a lab FortiGate and confirm behavior with session and packet captures
Diagnose a policy that blocks traffic by tracing the matching policy and identifying the first failing criterion
Your checkpoint
A lab topology with at least 5 policies plus SNAT and DNAT rules, documented with session-table evidence showing each rule matched
Firewall Policy and NAT & Routing and Network Configuration
Create address, service, and schedule objects and reuse them across multiple policies without duplication
Configure static routes and policy routes and demonstrate which one wins for a given flow
Set up ECMP and explain how route selection and priority affect outbound traffic
Verify routing and NAT together by testing traffic from a client subnet through two different egress paths
Your checkpoint
A routing cheat sheet plus a working lab where policy routes override static routes for a specific source subnet, proven with traceroute or session output
Routing and Network Configuration
Configure interfaces (VLAN subinterfaces, zones, and aggregate links) and assign addressing correctly
Implement a DHCP server and relay and confirm leases are issued to lab clients
Configure and verify DNS settings on interfaces and as a system setting
Troubleshoot an interface that is administratively up but not passing traffic by checking link, MTU, and zone membership
Your checkpoint
A network diagram with a working VLAN/zone configuration and DHCP leases shown for at least two client VLANs
Authentication and User Access
Configure local users and groups and bind them to policies with identity-based rules
Integrate the FortiGate with an external LDAP or RADIUS server and test authentication
Set up two-factor authentication (token or email) for a test user and verify the login flow
Configure captive portal or explicit proxy authentication and confirm users appear in the firewall user monitor
Your checkpoint
A working identity-based policy where a group member gets access and a non-member is denied, with authentication logs as proof
Security Profiles and Content Inspection
Apply antivirus, IPS, and web filter profiles to a policy and confirm blocking and logging behavior
Configure application control and SSL inspection and explain the certificate trust implications
Tune a security profile to reduce false positives using exemptions or adjusted actions
Verify content inspection results in logs and the FortiView dashboards
Your checkpoint
A policy with at least three security profiles applied, plus a log excerpt showing one blocked and one allowed event for each profile
VPN Configuration
Build a site-to-site IPsec VPN between two lab FortiGates and bring the tunnel up
Configure a dial-up IPsec VPN with a pre-shared key and verify a remote client connects
Set up SSL VPN with a portal, user group, and split or full tunneling
Troubleshoot a tunnel that fails phase 1 or phase 2 by reading the IKE debug output
Your checkpoint
A working site-to-site IPsec tunnel plus a remote-access VPN, documented with tunnel status and a successful ping across the VPN
Logging, Monitoring, and Management
Configure local and remote logging and verify events reach a syslog server
Set up SNMP monitoring and an alert email for a critical event
Create a backup of the configuration and restore it to a clean device
Use the CLI to inspect logs, sessions, and routing tables and interpret the output
Your checkpoint
A logging/monitoring setup that captures events to syslog and a verified config backup/restore cycle documented step by step
Firewall Policy and NAT & Routing and Network Configuration & Authentication and User Access & Security Profiles and Content Inspection & VPN Configuration & Logging, Monitoring, and Management
Re-run a timed practice set across all domains and review every missed item against the source material
Rebuild the full lab from a blank configuration using only your own notes
Write a one-page summary of the top 10 pitfalls per domain and quiz yourself on them
Complete a final full-length timed mock and record your per-domain accuracy
Your checkpoint
A scored full-length mock exam with per-domain accuracy logged and a written remediation list for any domain below 80%
Milestones
Week 2: Can explain and demonstrate the difference between static and policy routes on the lab FortiGate without notes
Week 4: Identity-based access works end to end, with a group member allowed and a non-member denied in the logs
Week 6: Both a site-to-site IPsec tunnel and a remote-access VPN are up and passing traffic
Week 8: Full-length mock completed on time with at least 80% accuracy in every domain