FCSS Enterprise Firewall 7.6 study plan

Map the deployment lifecycle from interface and zone creation through firewall policy and NAT, writing your own one-page ordering diagram of how zones, interfaces, and policies reference each other

Configure a lab FortiGate with at least three zones (LAN, WAN, DMZ), static routes, and a policy plus SNAT and DNAT rule, then verify session flow with a packet capture on each interface

Explain the difference between the implicit deny, explicit deny, and policy lookup order including central NAT versus policy NAT, and predict which rule matches for five written scenarios

List the Security Fabric prerequisites and identify which Fabric connectors require FortiGate Cloud or a FortiManager connection

Configure administrative access controls: admin profiles, trusted hosts, MFA for administrators, and password policy, then test that an untrusted host is rejected

Set up logging to a remote syslog server and confirm that traffic, event, and security logs arrive in the correct categories

Explain how FortiOS handles session helpers and protocol options, and adjust a profile to disable a helper that breaks a specific application

Describe the role of the FortiGuard subscription services available to the firewall and which ones require a license versus being built in

Configure antivirus, IPS, web filter, application control, and DNS filter profiles and attach them to a policy, then confirm each profile blocks a test case you generate

Explain the difference between flow-based and proxy-based inspection, including which features only work in proxy mode and the performance trade-offs

Tune an IPS sensor by disabling low-value signatures and adding a custom signature, then verify the custom signature triggers on test traffic

Describe SSL/TLS deep inspection: certificate requirements, exemptions, and how to avoid breaking pinned applications

Build a web filter that uses category filtering, URL override, and safe-search enforcement, and prove each control works with test URLs

Configure firewall authentication using a local user, a group, and an LDAP server, and verify the login portal and captive portal behavior for each

Explain the authentication timeout, firewall versus proxy authentication, and how authenticated user identity appears in logs and policy matching

Diagnose a failed LDAP authentication by reading debug output and correcting a bind DN or base DN mistake

Configure static routes, policy routes, and at least one dynamic routing protocol (OSPF or BGP) between two FortiGates, then verify the routing table and failover behavior

Explain route lookup order including longest-prefix match, administrative distance, and how policy routes preempt the routing table

Create two VDOMs, assign interfaces, and configure inter-VDOM links, then write a policy that permits traffic between them

Describe VDOM-level versus global administration, including how to share objects between VDOMs and which settings are per-VDOM

Configure an HA pair in active-passive mode with session pickup and verify failover by disconnecting a monitored interface

Explain HA synchronization scope: which objects sync, which do not, and how to handle configuration drift between members

Describe how authentication sessions and user identity behave across an HA failover, and test whether an authenticated session survives

Identify HA heartbeat and session-sync traffic requirements and the effect of a split-brain scenario

Use diagnose and get commands to troubleshoot a policy that is not matching, including session listing, policy lookup, and debug flow

Interpret debug flow output line by line to identify where a packet is dropped (route lookup, policy, inspection, or NAT)

Capture and analyze packets on the FortiGate and explain how to filter captures to a single host and port

Explain how to collect a crash log, a configuration backup, and a diagnostic report for a support case

Re-run every lab deliverable from weeks 1 through 7 in a single clean topology without referring to your notes

Complete a timed set of scenario questions weighted by domain percentage and review every missed item against documentation

Write a one-page summary of the five concepts you found hardest and the specific commands or dialogs that resolve them

Verify your weak domains by self-scoring against the domain weights and schedule any remaining review