I85PREP
⌘ K
Fortinet FCX study materials
Fortinet FCX study resources

Fortinet FCX: Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

Fortinet FCX · Work through your exam, one topic at a time.

All guide sections

Secure Networking (NGFW, SD-WAN, Switching, Wireless LAN)

Secure Networking covers the FortiGate as an NGFW, as an SD-WAN edge and as the controller for FortiSwitch and FortiAP. The exam tests whether you can predict which policy, SD-WAN rule or VLAN will win for a given packet, and whether you know which knob is evaluated first.

NGFW policy fundamentals

  • Firewall policies are evaluated first-match, top-down, per VDOM, with an implicit deny. Security profiles are attached to the policy and run only on permitted traffic.
  • Address objects can come from ISDB entries, FQDNs (resolved and cached by TTL), geography, or SDN/Fabric Connector objects. Overlapping objects are a common source of unexpected matches.
  • NAT is configured either per policy or centrally. VIPs and hairpin policies are where most NAT troubleshooting lands.
  • DoS policies are separate from firewall policies and are bound per interface, so an interface-level anomaly policy can drop traffic before any firewall policy is seen.
  • Virtual patching with IPS signatures is the standard compensating control for servers you cannot patch.

SD-WAN

  • Configuration lives in config system sdwan: members carry cost, priority and status; zones let one policy reference several links.
  • Health checks define SLA targets (latency, jitter, packet loss). Members failing the SLA are removed from selection for that rule.
  • Service rules are matched top-down with strategies: manual (priority), best quality, lowest cost (SLA) and maximize bandwidth.
  • ADVPN with BGP builds spoke-to-spoke shortcuts so branch traffic need not hairpin through the hub.

Switching and wireless

  • FortiLink auto-discovery turns the FortiGate into the switch manager; VLANs, MCLAG pairs and 802.1X/NAC dynamic VLAN assignment are configured there.
  • FortiAP profiles control tunnel versus local-bridge mode, SSIDs, WPA3-Enterprise and WIDS/rogue suppression.

Worked example

A site has wan1 (cost 10, 100/20 Mbps, 22 ms) and wan2 (cost 5, 50/10 Mbps, 95 ms). The health check sets latency 60 ms, jitter 10 ms, loss 1%. Rule 1 sends ERP traffic with lowest cost (SLA); rule 2 sends guest traffic with maximize bandwidth. wan2 is cheaper but fails the latency SLA, so rule 1 evaluates only wan1 and ERP stays on the expensive link. Rule 2 ignores cost, again choosing wan1 for its 100 Mbps. Remove the SLA target from rule 1 and ERP instantly moves to wan2 - the classic "SD-WAN moved my traffic" ticket.

Traps that cost marks

Mixing up firewall policy order with SD-WAN rule order; referencing a member interface instead of the SD-WAN zone in a policy; forgetting that a failing health check excludes a member entirely; creating a FortiLink VLAN on the switch but not on the FortiGate.