NSE5 FortiSwitch 7.6 study plan
NSE5 FortiSwitch 7.6 · Give each week a clear focus.
8 weeks · About 6 hours per week
FortiSwitch Deployment and Management
Map the FortiSwitch product family and FortiLink topology options, then draw from memory a three-tier deployment (FortiGate, core switch, access switches) labeling each management path
Configure a FortiGate-to-FortiSwitch FortiLink connection in a lab and verify the switch appears authorized and managed
Explain the difference between standalone mode and FortiLink-managed mode and list what changes in configuration ownership
Document the firmware upgrade workflow for a managed switch, including how the FortiGate pushes images and how to confirm version parity
Your checkpoint
A one-page topology diagram plus a lab log showing an authorized FortiLink switch with matching firmware versions on both devices
FortiSwitch Deployment and Management
Configure MCLAG on a two-switch pair and verify the peer link and ISL come up cleanly
Describe how FortiLink splits management across multiple FortiGates and when to use a tiered FortiLink architecture
Set up SNMP and syslog export from a managed switch to an external collector
Compare how VLANs, trunks, and port settings are provisioned from the FortiGate versus locally on the switch
Your checkpoint
A working two-switch MCLAG lab with a written checklist of the pre-conditions required before forming the MCLAG pair
FortiSwitch VLANs and Layer 2 Configuration
Configure access ports, trunk ports, and a native VLAN mismatch scenario, then confirm behavior with show commands
Create VLANs on both the FortiGate and the switch and trace how a FortiLink-managed VLAN is pushed to member switches
Configure an 802.1Q trunk between two switches and verify tagged and untagged traffic paths
Explain the role of the internal VLAN and why some VLAN IDs are reserved on FortiSwitch
Your checkpoint
A VLAN matrix table listing every lab VLAN, its ID, which ports carry it tagged or untagged, and the verification command output proving it
FortiSwitch VLANs and Layer 2 Configuration
Configure spanning tree (RSTP and MSTP) and force a root election change, then confirm the resulting topology
Tune STP edge ports and BPDU guard to protect access ports from loops
Configure link aggregation (static and LACP) between switches and verify member status
Diagnose a deliberate Layer 2 loop and document the log and counter evidence that identifies it
Your checkpoint
A troubleshooting write-up of the induced loop showing the commands used, the evidence found, and the fix applied
FortiSwitch Security Features and Port Security
Configure port security with allowed MAC address limits and the action taken on violation
Configure 802.1X port-based authentication with a RADIUS server and test both authenticated and rejected supplicants
Set up DHCP snooping and dynamic ARP inspection on a VLAN and verify that a rogue DHCP server is blocked
Configure storm control on an access port and confirm the threshold triggers under generated traffic
Your checkpoint
A security feature test sheet with pass/fail results for port security, 802.1X, DHCP snooping, DAI, and storm control, each with the verifying command output
FortiSwitch Security Features and Port Security
Configure MAC-based VLAN assignment and explain when it is preferred over 802.1X
Apply a QoS policy that trusts DSCP on uplinks and remark traffic on access ports, then verify with queue statistics
Configure ACLs on a managed switch and confirm they are applied in the expected direction and order
Explain how FortiLink-managed switches inherit security profiles from the FortiGate and where local overrides are permitted
Your checkpoint
A configuration export of the switch showing the security and QoS policies in place, annotated with a sentence per policy explaining its purpose
FortiSwitch Troubleshooting and Monitoring
Build a monitoring routine using interface counters, transceiver diagnostics, and CPU and memory output, and record baselines
Use log filtering on the FortiGate to isolate switch events and identify the source of a simulated port flap
Practice diagnosing three failure modes: a down trunk, an unauthorized switch, and a firmware mismatch, using only CLI and GUI evidence
Configure alerting for link state changes and confirm a notification is delivered
Your checkpoint
A three-scenario troubleshooting log with symptoms, commands run, root cause, and resolution for each failure mode
FortiSwitch Deployment and Management & FortiSwitch Troubleshooting and Monitoring
Rebuild the full lab from a blank configuration within a timed session to test retention across all four domains
Review every missed item from earlier weeks and re-run the specific lab that covers it
Write a one-page quick-reference of the verification commands you used most often
Take a full-length practice assessment and analyze results by domain to target final review
Your checkpoint
A timed rebuild completed end to end plus a domain-by-domain score summary with the two weakest areas and a remediation note for each
Milestones
Week 2: Can form an MCLAG pair and explain the peer link and ISL roles without notes
Week 4: Can identify and resolve a Layer 2 loop using show commands alone
Week 6: Can configure port security and 802.1X from a blank port profile without reference
Week 8: Can rebuild the lab topology from scratch and score above 80 percent on a practice assessment