FCP FortiNAC-F Administrator study plan
FCP FortiNAC-F Administrator · Give each week a clear focus.
8 weeks · About 7 hours per week
FortiNAC-F Deployment and Initial Configuration
Deploy a FortiNAC-F virtual appliance in a lab hypervisor and complete the initial setup wizard through the admin UI.
Configure the appliance's management IP, hostname, DNS, NTP, and default gateway, then verify each setting persists after a reboot.
Map the FortiNAC-F control and application server roles and explain in writing which services run on each node.
Register the appliance with FortiCare and confirm license status and FortiNAC-F version from the dashboard.
Your checkpoint
A one-page deployment checklist documenting every configuration value used in the lab build, with a screenshot-free written verification that the appliance rebooted cleanly and passed license validation.
FortiNAC-F Deployment and Initial Configuration & Network Device Integration and SNMP/CLI Modeling
Add a firewall or switch as a managed network device using SNMP read/write credentials and verify the device shows online.
Configure SNMP trap and syslog destinations so events from the network device reach FortiNAC-F.
Run the CLI credential test on the managed device and resolve any authentication or privilege-level failures.
Document the L2 and L3 network topology, including which VLANs FortiNAC-F must see and where the appliance sits.
Your checkpoint
A managed-device inventory table listing each lab device, its vendor model, SNMP version and community or user, CLI protocol, and the exact status shown in the FortiNAC-F device view.
Network Device Integration and SNMP/CLI Modeling
Model a FortiSwitch or third-party switch through the CLI/SNMP modeling process and confirm port and VLAN information populates correctly.
Create a device group and apply a role or profile to the managed device, then verify the assignment takes effect.
Test SNMP polling intervals and adjust them to a value that balances freshness against device load.
Troubleshoot one deliberately broken device integration (wrong community string or blocked port 161) using FortiNAC-F logs.
Your checkpoint
A written troubleshooting log for the broken integration that names the failing component, the log or event that revealed it, and the fix applied.
Endpoint Detection, Profiling, and Device Registration
Connect an endpoint to a managed switch port and observe how FortiNAC-F detects it via MAC notification, SNMP, or DHCP.
Build a custom endpoint profiling rule based on DHCP fingerprint, MAC OUI, or vendor attributes and confirm it classifies a test device.
Register an endpoint as a trusted host and explain how registration differs from profiling in FortiNAC-F.
Configure a rogue device or unauthorized host rule and trigger it with a test endpoint.
Your checkpoint
A profiling worksheet showing at least three test endpoints, the attributes FortiNAC-F detected for each, and the profile or role the appliance assigned.
Authentication, Identity Sources, and 802.1X/MAB
Integrate an external identity source such as LDAP or Active Directory and validate user lookup and group import.
Configure 802.1X on a managed switch port and authenticate a supplicant against the identity source.
Configure MAB for a device that cannot run a supplicant and confirm it lands in the expected role.
Explain the RADIUS flow between the switch, FortiNAC-F, and the identity source, and identify which component makes the VLAN decision.
Your checkpoint
An authentication matrix listing each test client, its method (802.1X or MAB), the identity source used, the resulting role, and the pass or fail outcome with a root cause for any failure.
Network Access Policies, VLAN Assignment, and Enforcement
Build a network access policy that maps an endpoint role to a specific VLAN and enforcement method.
Configure and test at least two enforcement techniques, such as VLAN assignment and port disable, on the lab switch.
Create a policy exception for a known device and confirm it bypasses the default enforcement action.
Verify enforcement by capturing the switch port VLAN before and after a policy change.
Your checkpoint
A policy design table listing each policy name, matching condition, assigned role, enforcement action, and the observed result on the lab switch port.
Guest and Bring-Your-Own-Device (BYOD) Onboarding & High Availability, Backup, and System Maintenance
Configure a guest self-registration portal and complete a full guest onboarding flow from sponsor approval to network access.
Set up a BYOD onboarding flow and enroll a test device through the certificate or agent process.
Configure a scheduled configuration backup and perform one manual restore to a lab appliance.
Explain the FortiNAC-F HA options and describe what happens to enforcement state during a failover.
Your checkpoint
A guest and BYOD runbook covering the end-user steps, sponsor steps, and admin steps, plus a backup file and a written record of the successful restore test.
Monitoring, Logging, Reporting, and Troubleshooting & Network Access Policies, VLAN Assignment, and Enforcement
Configure log forwarding and review event, audit, and admin logs to identify a simulated access failure.
Build a report or dashboard view that shows endpoint counts by role and policy hits over the last seven days.
Run a timed practice set covering all eight domains and review every missed item against the official exam objectives.
Re-test the two weakest domains from earlier weeks and close any remaining knowledge gaps.
Your checkpoint
A final readiness report listing practice scores by domain, the three weakest areas, the corrective actions taken, and a go or no-go recommendation for exam day.
Milestones
Week 2: The FortiNAC-F appliance is licensed, rebooted cleanly, and at least one network device shows online with working SNMP and syslog.
Week 4: At least three endpoints are detected and classified by a custom profiling rule, and one rogue device rule has been triggered successfully.
Week 6: An endpoint authenticates via 802.1X or MAB and is placed into the correct VLAN by a network access policy, verified on the switch port.
Week 8: A timed practice exam across all domains is complete, a backup restore has been proven, and every missed objective has a documented corrective action.