I85PREP
⌘ K
FCSS Enterprise Firewall 7.6 study materials
FCSS Enterprise Firewall 7.6 study resources

FCSS Enterprise Firewall 7.6: Deployment and System Configuration

FCSS Enterprise Firewall 7.6 · Work through your exam, one topic at a time.

All guide sections

Deployment and System Configuration

Deployment and System Configuration

This domain tests whether you can take a FortiGate from the box to a working, manageable, licensed device - and prove you understand the settings everything else depends on. Expect questions on operating modes, interface types, administrative hardening, registration, firmware upgrade practice and configuration backup.

Core rules

  • Operating mode. NAT mode (default) routes between interfaces; transparent mode (config system settings, set opmode transparent) bridges them, needs a management IP (set manageip), and matches policies on the original ingress interface.
  • Interface types. Physical, VLAN (set vlanid), aggregate (LACP), redundant (active/backup), software switch, zone (config system zone), loopback and tunnel. A zone lets one policy cover several interfaces.
  • Admin access. Each interface carries an allowaccess list (ping, https, ssh, fgfm, snmp). Trim it on WAN-facing ports and use trusted hosts so an admin account only authenticates from known subnets.
  • Registration. Register to FortiCare for FortiGuard updates, support and firmware downloads; a FortiGate VM needs a licence or FortiFlex entitlement before it forwards production traffic.
  • Firmware. Follow the documented upgrade path, back up the config and record the current build. Downgrades usually require restoring a backup made on the matching version.
  • Backups and revisions. execute backup config tftp|usb|ftp writes a full config (plain or encrypted); enable revision backup so earlier configurations are recoverable.

Worked example

A branch FortiGate: port1 to the ISP as a DHCP client with only ping allowed; port2 as the LAN at 10.10.0.1/24 with a DHCP server and DNS; default route learned from DHCP; DNS and NTP pointed at internal servers; admin trusted hosts pinned to 10.10.0.0/24 plus a jump host. Reasoning: the WAN interface keeps only what the ISP needs, management rides the LAN, and time synchronisation must be correct before certificates, logs and FSSO behave.

Traps

Removing https/ssh from every interface before trusted hosts are set, then locking yourself out; forgetting that transparent mode still needs a management IP; restoring a configuration from a different model or firmware branch; upgrading an HA pair without reading the upgrade path.