I85PREP
⌘ K
Fortinet FCSS SOC study materials
Fortinet FCSS SOC study resources

Fortinet FCSS SOC: Network Security: FortiGate Policy, NAT, Routing, and Inspection

Fortinet FCSS SOC · Work through your exam, one topic at a time.

All guide sections

Network Security: FortiGate Policy, NAT, Routing, and Inspection

What this domain tests

Network Security tests FortiGate policy processing, routing, NAT, inspection, high availability, and Security Fabric integration. The exam favors policy-lookup scenarios: given an interface, source, destination, service, and NAT requirement, decide which policy matches and what the FortiGate does next.

Core rules and concepts

  • FortiGate policies are evaluated top-down and first match wins; traffic that matches no policy hits the implicit deny. The implicit deny is not an editable policy, so a missing rule looks like a silent drop unless denied-traffic logging is enabled.
  • Policy matching uses incoming interface, source address, destination address, service, schedule, and user or group. UTM profiles attach to an accepting policy; they do not create a permit.
  • FortiGate order is broadly: destination NAT and policy routes before route lookup, then policy lookup, then source NAT. With interface NAT, the source is translated to the outgoing interface address; with central NAT, a central SNAT table decides.
  • Flow inspection is the default and suits most traffic; proxy inspection gives deeper content handling and is common for explicit web proxy and some UTM profiles. Deep SSL inspection requires a certificate trust chain on clients.
  • FGCP HA synchronizes sessions and configuration; session pickup matters for failover. VDOMs partition policy, routing, and administration.
  • SD-WAN rules select a member by SLA, priority, or application; they do not replace the firewall policy that permits the traffic.

Worked example

A LAN subnet 10.10.10.0/24 browses an internet web server 203.0.113.20 on TCP 443. The FortiGate has a default route to the WAN next hop and two policies: policy 1 LAN to WAN, all sources, all destinations, ALL, NAT enabled, web-filter profile; policy 2 LAN to WAN, 10.10.10.0/24 to 203.0.113.20, TCP 443, no UTM. Policy 1 matches because lookup is top-down and all fields match; the web-filter profile applies, and source NAT uses the WAN interface address. To make policy 2 effective, place it above policy 1. Reasoning: first-match, not most-specific-match.

Traps that cost marks

  • Expecting the most specific policy to win; FortiGate does not behave that way.
  • Forgetting that NAT requires an accepting policy and that central NAT changes where translation is configured.
  • Assuming an SD-WAN rule bypasses policy or UTM inspection.
  • Missing asymmetric routing, which can break stateful inspection and HA session synchronization.