I85PREP
⌘ K
Fortinet FCX study materials
Fortinet FCX study resources

Fortinet FCX: Cloud Security

Fortinet FCX · Work through your exam, one topic at a time.

All guide sections

Cloud Security

Cloud Security tests how Fortinet controls are deployed and operated in AWS, Azure and GCP: FortiGate-VM sizing and licensing, HA without Layer 2, insertion through cloud load balancers, auto-scaling, cloud SDN connectors, FortiCNP for posture and FortiCASB for SaaS. The questions are usually "why did traffic drop" or "why did failover not move the address".

Deployment and licensing

  • FortiGate-VM is licensed BYOL (FortiFlex or a VM license tied to vCPU/RAM ceilings) or PAYG through the marketplace. Licensing mode changes what HA and scaling designs are practical, so confirm it before drawing the diagram.
  • Auto-scaling uses a launch template with bootstrap configuration plus config system auto-scale, normally paired with FortiManager for licence and policy sync.

HA in the cloud

  • Clouds give no broadcast domain, so FGCP runs over unicast with a dedicated HA interface and secondary private IPs.
  • AWS HA needs API credentials (IAM role or keys) so the surviving unit can move the Elastic IP; Azure uses a load balancer or service principal; GCP uses API calls for the external address.
  • Health checks and security groups must allow the HA heartbeat ports, or the cluster splits.

Load balancer insertion and east-west

  • Gateway Load Balancer designs put FortiGate-VM in the data path as a transparent appliance. The instance interface must have source/destination check disabled and appliance mode enabled so return traffic uses the same appliance.
  • Cloud SDN connectors resolve tags and resource groups into dynamic address objects; read-write connectors can also update route tables.

Posture and SaaS

  • FortiCNP is agentless and API-driven for CSPM/CWPP findings, forwarding into FortiAnalyzer or FortiSOAR.
  • FortiCASB covers SaaS via APIs where inline inspection is not possible.

Worked example

Internet traffic enters a Gateway Load Balancer, is forwarded to FortiGate-VM port2, inspected, and returned to the GWLB. If source/destination check stays enabled, the cloud fabric drops the returned packets and the symptom looks like a firewall policy problem. If appliance mode is not enabled, flows from the same 5-tuple can land on different appliances and break inspection. Enable both, then confirm the GWLB health check target port matches something the FortiGate actually answers.

Traps that cost marks

Forgetting source/destination check or appliance mode; assuming the Elastic IP follows failover without API credentials; designing HA on a licensing mode that does not support it; security groups blocking health probes; using a read-only SDN connector and then expecting route-table updates.