Fortinet FCSS NST study plan
Fortinet FCSS NST · Give each week a clear focus.
8 weeks · About 7 hours per week
Network Security Architecture and Design
Map each of the four exam domains to a written outline of subtopics, marking which ones you already know versus which need study, and rank them by confidence.
Sketch a reference enterprise topology on paper that separates management, internal, DMZ, and internet zones, then annotate where each FortiGate interface role and VDOM boundary sits.
Explain aloud, without notes, how FortiGate security fabric components (FortiGate, FortiManager, FortiAnalyzer, FortiSwitch, FortiAP, FortiClient EMS) hand off telemetry and policy enforcement.
Configure a single-VDOM FortiGate with at least three interfaces, static routes, and a working management access path in a lab, then verify connectivity with ping, traceroute, and a policy hit counter.
Your checkpoint
A one-page annotated topology diagram plus a confidence-ranked subtopic checklist covering all four domains.
Network Security Architecture and Design
Compare NAT modes (static, dynamic, port address translation, central NAT) and choose the correct one for four written scenarios, justifying each choice.
Design a VDOM partitioning scheme for a multi-tenant scenario, specifying inter-VDOM link addressing and which global resources stay shared.
Configure a transparent-mode segment in the lab and document which security profiles still function and which routing features are disabled.
Explain how FortiGate handles asymmetric routing and session helpers, then predict what breaks when a helper is removed.
Your checkpoint
A written design document for a two-tenant VDOM deployment with NAT mode rationale and inter-VDOM link addressing table.
FortiGate Infrastructure and Routing
Configure and verify static, policy, and dynamic routing (OSPF and BGP) between at least three lab FortiGates, capturing neighbor and routing table output for each.
Trace a packet through the FortiGate forwarding path using debug flow and packet capture, and document each lookup stage it passes.
Build a link-load-balancing and route-failover setup, then force a failure and record measured convergence behavior.
Explain when SD-WAN is preferable to policy routes and plain ECMP, and configure a minimal SD-WAN rule with two members.
Your checkpoint
A routing lab report with captured neighbor tables, routing tables, and debug-flow output showing a successful end-to-end packet trace.
FortiGate Infrastructure and Routing
Configure VXLAN over IPsec between two FortiGates and verify Layer 2 extension with a host-to-host ping across the tunnel.
Tune session timers, TCP MSS, and MTU settings to resolve a simulated fragmentation problem, documenting the before and after values.
Explain FortiGate interface types (physical, VLAN, aggregate, loopback, tunnel, redundant) and pick the right one for five written scenarios.
Diagnose a deliberately broken lab topology using only CLI diagnostics and write the root cause for each fault you find.
Your checkpoint
A troubleshooting log covering at least five injected faults with symptom, diagnostic command used, and root cause for each.
Advanced Security Profiles and Content Inspection
Configure antivirus, IPS, web filter, application control, DNS filter, and file filter profiles, and attach them to a policy with correct SSL inspection mode.
Compare certificate-inspection and full SSL-inspection modes, and list exactly which traffic categories break under each.
Tune an IPS sensor to reduce false positives by adjusting signatures and filters, and record the before and after alert volume.
Explain FortiGuard rating lookup and local category override behavior, then test a category override in the lab.
Your checkpoint
A profile matrix spreadsheet mapping each security profile to its inspection mode, expected traffic impact, and lab test result.
Advanced Security Profiles and Content Inspection
Build a DLP profile with at least two sensors and verify detection against synthetic test files you create yourself.
Configure antivirus and IPS quarantine and FortiSandbox-style submission flow, and describe what happens to a file at each verdict stage.
Explain how content disarm and reconstruction, video filtering, and inline CASB differ in deployment and what each requires on the FortiGate.
Write detection-log queries in FortiAnalyzer and build one report that surfaces top blocked applications and top IPS hits.
Your checkpoint
A FortiAnalyzer report plus a written verdict-flow diagram showing a file moving from receipt through inspection to quarantine or release.
VPN, Authentication, and High Availability
Build a site-to-site IPsec VPN with certificate authentication, then break and repair it by changing one phase 1 or phase 2 parameter at a time.
Configure dial-up IPsec and SSL VPN for remote users, applying split tunneling and a restricted firewall policy for each.
Implement multi-factor authentication with FortiToken or an external RADIUS/LDAP server and verify the full login path including failure cases.
Explain the differences between policy-based and route-based IPsec, and convert one lab tunnel from policy-based to route-based.
Your checkpoint
A VPN build-and-break journal with the working configuration for each tunnel type and a table of the parameters that caused failure when changed.
VPN, Authentication, and High Availability & Network Security Architecture and Design
Configure FGCP active-passive HA with session pickup, then fail over and measure the outage with continuous pings.
Compare FGCP and FGSP, and state which one suits load sharing versus pure redundancy in written scenarios.
Review your weeks 1-7 deliverables, list every weak subtopic, and redo the two labs you scored worst on.
Take a timed 60-question practice set across all four domains and review every missed item down to the underlying concept.
Your checkpoint
A final readiness scorecard per domain with your practice-test percentage, a list of remaining weak areas, and completed remediation labs for the two weakest.
Milestones
Week 2: Can you explain NAT mode selection and VDOM partitioning decisions for a multi-tenant design without referring to notes?
Week 4: Have you captured a successful end-to-end debug-flow trace and resolved at least five injected faults using only CLI diagnostics?
Week 6: Does your FortiAnalyzer report correctly surface the top blocked applications and IPS hits from your own lab traffic?
Week 8: Did you score at least 80 percent on the timed 60-question practice set and complete remediation labs for your two weakest subtopics?