I85PREP
⌘ K
Fortinet FCSS NST study materials
Fortinet FCSS NST study resources

Fortinet FCSS NST: VPN, Authentication, and High Availability

Fortinet FCSS NST · Work through your exam, one topic at a time.

All guide sections

VPN, Authentication, and High Availability

VPN, Authentication, and High Availability tests how you build remote and site-to-site access on FortiGate, bind it to identity sources, and keep it available across an HA pair.

Core rules

  • IPsec uses phase 1 and phase 2. Route-based tunnels use a tunnel interface and routes; policy-based tunnels match traffic in the policy itself. IKEv2 is preferred for modern peers; dial-up tunnels support multiple remote clients.
  • SSL VPN uses portals and realms to define bookmarks, split tunnelling and routes. Authentication can combine local, LDAP, RADIUS, SAML or certificate methods, with MFA layered on top.
  • Authentication policies can require users or groups before traffic is allowed. FSSO passes domain identity; LDAP and RADIUS validate credentials; SAML supports identity-provider flows. Watch authentication timeouts and group membership changes.
  • FGCP HA supports active-passive and active-active. Members must match model, firmware and configuration; heartbeat and monitored interfaces trigger failover. Session sync preserves established sessions, but not every protocol or state is synchronized.

Worked example

Remote workers need SSL VPN with corporate LDAP and one-time passwords. Configure an SSL VPN portal with split tunnelling to internal server subnets, an authentication rule using LDAP as primary and RADIUS for OTP, and a firewall policy from the SSL VPN interface to the internal zone. Deploy an active-passive HA pair at the edge, with the WAN interface monitored and heartbeat on a dedicated link. Test failover by disconnecting the primary WAN; confirm the secondary takes over and that VPN users reconnect where session sync cannot preserve their state.

Traps

  • Overlapping internal and remote subnets, which breaks routing and VPN access.
  • HA pairs with mismatched firmware, models or interface configuration.
  • Assuming session sync preserves every application session after failover.
  • Building an SSL VPN portal without the routes or split-tunnel settings users need.
  • Authentication timeouts or stale group caches causing intermittent policy denial.