Fortinet FCSS NST key terms

Fortinet's integrated architecture that lets FortiGate, FortiAnalyzer, FortiManager, FortiSwitch, and endpoints exchange telemetry and enforce coordinated policy through a shared fabric connector and root FortiGate.

The FortiGate designated as the Fabric leader; it aggregates topology, shares objects with downstream devices, and distributes fabric-wide settings such as telemetry and rating configuration.

A configuration object that authorizes a downstream device or Fabric product to join the Security Fabric, typically keyed by serial number and a shared authorization token over a management or fabric link.

A scored assessment of a FortiGate's configuration and posture, covering categories such as hardening, fabric coverage, and best practices, with remediation recommendations for low-scoring checks.

Restricting management protocols to trusted interfaces, enforcing strong admin authentication and trusthosts, and disabling unused services such as Telnet or HTTP on FortiGate interfaces.

A per-administrator or per-user source-address restriction that limits from which IP addresses or subnets a login is accepted, regardless of valid credentials.

A virtual domain that partitions a single FortiGate into independent routing, policy, and VPN instances, each with its own interfaces and administrators.

A virtual interface pair connecting two VDOMs on the same FortiGate, allowing traffic to traverse them under firewall policy just like a physical link.

The VDOM enabled to host administrative access and management-plane traffic when multi-VDOM mode is active, isolating admin services from data VDOMs.

A route evaluated before the routing table that forwards matching traffic out a specified interface and gateway, optionally applying NAT or a different destination.

The FortiGate's forwarding database built from connected, static, and dynamic routes; the longest-prefix match with the lowest administrative distance and metric wins.

A preference value used to rank routes from different sources, such as connected, static, or OSPF, so that lower values are installed when prefixes are equal.

A logical grouping of OSPF routers that limits link-state flooding; all routers in one area share an identical topology database, and area 0 forms the backbone.

Bidirectional Forwarding Detection, a lightweight hello protocol that detects path failures in sub-second time and can trigger faster route or SD-WAN failover.

A policy that selects among member links using measured SLA criteria such as latency, jitter, and packet loss, and can steer traffic per application or per source.

A health check that sends periodic probes to configured servers over each SD-WAN member and reports latency, jitter, and loss against thresholds in the SLA definition.

A single-pass inspection mode that scans packets as they traverse the FortiGate without buffering the whole file, trading some detection depth for throughput.

An inspection mode that buffers and reassembles content so full files can be scanned and modified before delivery, enabling features such as content disarm and file filtering.

Decrypting TLS traffic with a certificate the FortiGate presents to clients, inspecting the plaintext, then re-encrypting to the server; requires a CA certificate trusted by clients.

Full SSL inspection using a re-signing CA certificate so that the FortiGate can see and scan the decrypted payload, including URLs, files, and application data.

SSL inspection that reads only the server certificate and SNI without decrypting payload, used for category-based control where full decryption is impractical or prohibited.

A proxy-based technique that strips active and embedded objects from files and rebuilds a safe version, neutralizing exploits even when no signature exists.

A security profile that blocks, logs, or quarantines files by type, size, or direction, and can hand files to FortiSandbox for dynamic analysis.

A dynamic analysis appliance or cloud service that detonates suspicious files and returns a verdict the FortiGate uses to block previously unknown malware.

A profile that scans traffic for malware using signatures and heuristics, with per-protocol options for HTTP, FTP, SMTP, POP3, and IMAP and actions such as block or monitor.

A container of signature filters and overrides that determines which intrusion-prevention signatures are active, their severity thresholds, and the action taken on a match.

An administrator-authored IPS signature written in Fortinet's syntax to detect traffic patterns unique to an environment when no built-in signature covers the behavior.

A profile that identifies applications by behavior and signature and applies actions such as allow, block, or traffic shaping, with categories and per-application overrides.

A profile that classifies URLs and domains into categories and applies allow, block, warning, or authenticate actions, optionally with safe-search and YouTube restrictions.

The IKE negotiation that establishes a secure management channel between peers, agreeing on encryption, hashing, authentication method, and lifetime.

The negotiation that defines the actual data tunnels, specifying selectors, protocol, encryption and hashing for ESP, and perfect forward secrecy settings.

A property in which each Phase 2 key exchange uses fresh Diffie-Hellman material, so compromise of one key does not expose previously recorded sessions.

The choice between IKEv1 and IKEv2 for Phase 1 negotiation; IKEv2 supports more robust exchange, MOBIKE, and EAP authentication and must match the peer.

A dynamic IPsec or SSL VPN configuration in which remote clients or peers with changing addresses connect to a hub FortiGate that accepts unknown initiators.

A web or tunnel interface presented to SSL VPN users that defines bookmarks, split tunneling, and accessible resources, often mapped per user group.

Requiring a second proof of identity beyond a password, such as a one-time token, certificate, or push approval, typically enforced per user group on VPN or admin logins.

FortiGate Clustering Protocol, the proprietary HA mechanism that elects a primary, synchronizes sessions and configuration, and fails over on monitored interface or link failure.

A setting that lets a cluster member with higher HA priority preempt the current primary, useful for deterministic failback but risky if priorities are misconfigured.

A numeric value used during primary election; the member with the highest priority becomes primary, subject to override, monitor-interface health, and uptime tie-breaking.

A cluster feature that lets a new primary take over existing sessions from a failed peer so established flows survive failover without renegotiation.

Continuous replication of session and connection state between cluster members over the HA heartbeat links, enabling stateful failover for TCP and UDP traffic.