Fortinet NSE 4 cheat sheet

FortiOS interface types: physical, VLAN, aggregate (LACP), redundant, loopback, tunnel, zone, software switch, hardware switch, virtual wire pair, and EMAC-VLAN; each is created under config system interface with a unique name.

Administrative protocols per interface are controlled by set allowaccess, whose values include HTTPS, HTTP, SSH, Telnet, SNMP, FMG-access, FTM, and ping; no allowaccess entry means the interface answers no management traffic.

Factory-default management: the admin account has a blank password and HTTPS listens on TCP 443; the reserved management port is typically the lowest-numbered physical port on small models.

Multi-VDOM mode is enabled with config system global, set vdom-mode multi-vdom (requires reboot); each VDOM then owns its own interfaces, routing table, policies, address book, and admin accounts.

FGCP is the FortiGate HA protocol, supporting active-passive and active-active; heartbeat interfaces are set with set hbdev and session synchronization is carried over those links. FGSP provides session sync only, with no failover.

DNS resolvers are set under config system dns (primary, secondary, and protocol: cleartext, DoT, or DoH); DNS filter profiles are separate security profiles and do not change resolver settings.

DHCP servers are per-interface under config system dhcp server with an IP range, netmask, default gateway, and lease time; DHCP relay is enabled per interface with set dhcp-relay-service enable plus relay-ip.

Session helpers (ALGs) are listed in config system session-helper; disabling an entry stops FortiOS from opening expected data channels for that protocol, which is the standard fix for helper-related port conflicts.

Policies are evaluated from the lowest sequence number downward and processing stops at the first full match; an implicit deny sits below the last policy, drops unmatched traffic, and does not log by default.

Match criteria for a policy are ingress interface, source address, source user/group, destination address, service, and schedule; destination interface (set dstintf) may also be specified and, when set, becomes part of the match.

Policy actions are accept, deny, and ipsec; deny policies may still carry logging and a schedule, and should be placed at the bottom with logging enabled to record blocked traffic.

Policy NAT is enabled with set nat enable and uses the outgoing interface address unless an IP pool is attached via set ippool enable. Pool types are overload, one-to-one, fixed-port-range, and port-block-allocation.

Central NAT (config system settings, set central-nat enable) removes NAT from firewall policies and moves source and destination translation into separate central SNAT and DNAT rule tables.

Policy types include firewall policy, security policy (NGFW policy mode, which bundles profiles with the match), explicit proxy, local-in, DoS, multicast, shaping, and interface policy; each is stored in its own configuration branch.

Policy lookup tools such as diagnose firewall iprope lookup take a five-tuple plus ingress interface and return the policy ID that would be applied, which isolates ordering and address-object mistakes.

Processing order for a new session is policy match, then route lookup, then NAT application: destination NAT is applied before the route lookup and source NAT before the packet leaves the egress interface.

Inspection mode is set per firewall policy with set inspection-mode flow or proxy: flow-based scans in a single pass through the IPS engine, while proxy-based buffers traffic through per-protocol proxies and is required for some DLP and file-handling actions.

A security profile has no effect unless it is attached to an accepting firewall policy in that policy's Security Profiles section; the profile object itself is only a definition.

SSL inspection modes: certificate-inspection reads the server certificate and SNI without decrypting; deep-inspection (full) decrypts and re-encrypts using a FortiGate CA-signed certificate, which client devices must trust.

Web filter static URL filter entries are evaluated ahead of category-based rating and can be allow, block, monitor, exempt, or warning; the exempt action skips all remaining web-filter and content checks for that URL.

Application control signatures are organized into categories; the Unknown Applications category action (allow, block, or monitor) determines how traffic no signature identifies is treated by that profile.

A shared traffic shaper limits the combined bandwidth of every session matching it; a per-IP shaper applies the same guarantee and maximum to each individual source IP address.

Guaranteed bandwidth in a shaper is only honoured when the interface is congested, whereas maximum bandwidth is enforced at all times; priority (high, medium, low) governs queueing when contention occurs.

Traffic shaping policies are evaluated before firewall policies and assign a shaper or DSCP value by matching addresses, users, applications, or services; the first matching shaping policy wins.

A firewall policy references shapers with set traffic-shaper and set traffic-shaper-reverse, where the reverse shaper shapes the return direction of the same session; DSCP marking uses set diffserv-forward and set diffserv-reverse.

Authentication sources: local users (config user local), LDAP, RADIUS, TACACS+, PKI/certificate, FSSO, RADIUS SSO, SAML, and Kerberos; remote servers support primary and secondary entries for failover.

Active authentication prompts the user through a captive portal or HTTP/HTTPS challenge; passive authentication derives identity from logon events (FSSO), NTLM, or RADIUS accounting without prompting.

Two-factor authentication is enabled per user and combines the password with a token: FortiToken (hardware, mobile, or email-delivered) or SMS one-time codes.

IPsec phase 1 negotiates the IKE SA: remote gateway, authentication method (pre-shared key or certificate), DH group, encryption and hash proposals, and DPD settings.

IPsec phase 2 defines the IPsec SA: ESP or AH, PFS group, key lifetime, and the local and remote traffic selectors (subnets) that are permitted through the tunnel.

Policy-based VPN references an ipsec action plus a tunnel in the firewall policy; route-based VPN binds phase 1 and phase 2 to a tunnel interface and reaches the remote subnet through a static route or dynamic routing protocol.

Dial-up IPsec uses remote-gw 0.0.0.0 with set type dynamic; with set net-device enable all dial-up clients share a single tunnel interface and address, and with it disabled each client gets its own interface.

SSL VPN is configured under config vpn ssl settings with a listening port (443 by default), authentication rules, and portal mappings; tunnel mode delivers a virtual adapter and routes, web mode delivers bookmarks only.

Verification commands: diagnose vpn ike gateway list shows phase 1 state, diagnose vpn tunnel list shows phase 2 selectors and counters, and diagnose vpn ssl list shows connected SSL VPN sessions.

Route selection order is longest prefix match first, then lowest administrative distance, then lowest metric or priority; equal distance and priority install multiple paths as ECMP.

FortiOS default distances: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200. Changing a static route's distance changes where it sits relative to learned routes.

A static route carries destination/prefix, gateway (or interface-only for point-to-point links), distance, and priority; priority breaks ties for ECMP when distance is equal.

Policy routes (config router policy) are evaluated before the routing table and match on source address, destination address, protocol, port, and ingress interface; the action can permit with a gateway/interface or deny.

SD-WAN configuration lives under config system sdwan and consists of members (interface plus gateway), zones, health checks (performance SLAs), and rules; each member must reference an existing interface.

An SD-WAN zone groups member interfaces so that firewall policies and static routes reference the zone instead of individual members, allowing members to be added or removed without policy changes.

Performance SLA probes can be ping, tcp-echo, udp-echo, HTTP, or DNS; the configured latency, jitter, and packet-loss targets determine whether a member is in or out of SLA.

SD-WAN rules match on source and destination address, internet service database, application, user group, protocol, or DSCP, and select members using a strategy: manual (priority/weight), lowest cost, maximize bandwidth, or best quality.

OSPF neighbour adjacency requires matching area, hello interval, dead interval, and network type; BGP uses config router bgp with neighbours, remote-as, prefix lists, and route maps for filtering and attribute control.

Packet capture syntax: diagnose sniffer packet '' <verbosity 1-6> <timestamp a/l>; interface 'any' captures across all interfaces and a count of 0 means unlimited.

Flow trace workflow: diagnose debug flow filter (addr, port, proto), then diagnose debug flow trace start , then diagnose debug enable; stop with diagnose debug flow trace stop and diagnose debug disable.

Session table inspection: diagnose sys session list, narrowed by diagnose sys session filter (src, dst, dport, sport, proto), and cleared with diagnose sys session clear while a filter is active.

Health snapshot: get system performance status reports uptime, CPU, memory, session counts, and interface throughput; diagnose sys top shows per-process CPU and memory for identifying a runaway daemon.

HA verification: get system ha status shows role, priority, and sync state; diagnose sys ha checksum show (or diagnose sys ha checksum cluster) compares per-VDOM checksums between cluster units.

Interface and neighbour checks: diagnose hardware deviceinfo nic reports link, speed, duplex, and error counters, while diagnose netlink interface list and get system arp show ARP and neighbour state.

Log destinations are memory, disk, FortiAnalyzer, syslog, and FortiGate Cloud, configured under config log setting; whether a session is logged is decided per policy with set logtraffic.

Log filtering: execute log filter with category, subtype, and field criteria, then execute log display, to read event, traffic, or security logs from the CLI.

Reachability tests from the FortiGate itself: execute ping, execute traceroute, and execute telnet verify routing and upper-layer reachability from the unit's own source address.