I85PREP
⌘ K
Fortinet FCSS NST study materials
Fortinet FCSS NST study resources

Fortinet FCSS NST: Network Security Architecture and Design

Fortinet FCSS NST · Work through your exam, one topic at a time.

All guide sections

Network Security Architecture and Design

This section covers Network Security Architecture and Design, the part of FCSS NST that tests whether you can turn segmentation, inspection, resilience and scale requirements into a FortiGate design rather than simply a device that routes packets.

Core rules

  • Segment by trust and function first: users, servers, guests, OT/IoT and management. Map each segment to an interface or VLAN subinterface, then group interfaces with similar policy into zones.
  • Use VDOMs for administrative or tenant separation, not as a substitute for zones. Zones cannot span VDOMs; inter-VDOM links consume resources and complicate routing and HA design.
  • Choose inspection mode deliberately: flow mode for most production traffic and scale; proxy mode only where a feature or content handling genuinely requires it.
  • Size for inspected throughput and concurrent sessions, not just firewall throughput. TLS inspection, IPS and AV change the appliance's practical capacity.
  • Design HA before addressing: FGCP active-passive is the default perimeter pair. Active-active helps only specific traffic patterns and still depends on session sync.
  • Keep routing symmetric. Asymmetric paths break stateful inspection, return-path checks and HA session synchronization.

Worked example

A campus needs user, server and guest segments, dual ISPs, and an HA pair. Use a single VDOM, zones LAN-USERS, LAN-SERVERS, LAN-GUEST, and a WAN zone containing both ISP links; SD-WAN governs ISP selection. Policies: guest to internet only; users to internet and limited server ports; servers to internet only for updates. Apply deep inspection to user internet traffic, certificate inspection to server updates, and only web filtering to guest traffic. Place the HA pair at the perimeter, with heartbeat on a dedicated link and monitored interfaces toward both ISP handoffs.

Traps

  • Creating a VDOM per VLAN: operational overhead without an isolation benefit.
  • Forgetting that zone membership is per VDOM and per interface.
  • Designing HA with mismatched models, firmware or licence levels.
  • Exposing management access on an internet-facing interface.
  • Assuming active-active HA load-balances every session; per-session flow and hashing matter.