Fortinet NSE 4 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

VDOM mode

Multi-VDOM mode splits one FortiGate into independent virtual devices, each with its own interfaces, routing table, firewall policies, and administrators. Enable it under config system global with set vdom-mode multi-vdom; changing modes requires a reboot.

FGCP active-passive

FortiGate Clustering Protocol HA mode where one unit is primary and forwards all traffic while the secondary stays synchronized and takes over on failure. Heartbeat and session synchronization use dedicated HA interfaces.

Virtual wire pair

Two FortiGate interfaces paired to pass all traffic transparently between them with no MAC or IP changes. Firewall policies still apply, but only the pair's two interfaces can be referenced.

Interface zone

A zone groups multiple interfaces so a single firewall policy or IPsec dial-up configuration can apply to all of them. Interfaces in a zone share the same security settings.

Default admin access

Factory-default FortiGate management uses the admin account with a blank password over HTTPS on port 443; administrative protocols per interface are controlled with set allowaccess (HTTPS, SSH, ping, SNMP, FMG-access).

Hardware switch vs software switch

A hardware switch uses the unit's switch chip to forward between member ports at wire speed, while a software switch forwards in the CPU. Both give members one shared IP subnet.

Implicit deny

An invisible final policy drops any traffic that matched no earlier policy. It does not log by default, so add an explicit deny with logging at the bottom to record blocked traffic.

Policy sequence evaluation

FortiGate checks firewall policies from the lowest sequence number down and stops at the first full match of interface, source, user, destination, service, and schedule. Order therefore changes behaviour.

Central NAT

When enabled under config system settings, NAT is removed from firewall policies and handled by separate central SNAT and DNAT rule tables. Useful for large rule sets and many-to-many address translation.

IP pool types

Dynamic pools come as overload (many-to-one PAT), one-to-one (fixed mapping), fixed-port-range (limited ports per host), and port-block-allocation (blocks of source ports per host, useful for logging).

Local-in policy

A policy that controls traffic destined to the FortiGate itself, such as administrative or VPN traffic, instead of traffic passing through. It can allow or deny local traffic by source address and service.

Flow-based inspection

Default inspection mode where the IPS engine scans traffic in a single pass without buffering whole files. It is faster and supports most profiles, but some DLP and file-handling actions need proxy mode.

Deep SSL inspection

The FortiGate decrypts TLS, inspects it, then re-encrypts toward the server using a certificate signed by its own CA. Client devices must trust that CA; certificate-inspection only reads the server certificate without decrypting.

Shared vs per-IP shaper

A shared traffic shaper applies one bandwidth limit to the total of all sessions matching it, while a per-IP shaper applies the limit to each source IP separately.

Traffic shaping policy

Evaluated before firewall policies, it matches on addresses, users, applications, or services and assigns a traffic shaper or DSCP value. The first matching shaping policy wins.

Web filter URL override

A web filter profile can allow users to reach a blocked category after entering a password. Override settings define the duration and which users or groups may override.

Application control unknown apps

Application control includes a category for traffic no signature identifies. Its action (allow, block, or monitor) determines how unrecognized applications are handled by that profile.

IPsec phase 1 vs phase 2

Phase 1 (IKE) negotiates authentication, encryption and DH proposals and builds the IKE SA with the peer. Phase 2 defines the IPsec SA: ESP/AH, PFS, key lifetime, and traffic selectors.

Route-based IPsec VPN

The tunnel is bound to a virtual tunnel interface and reached through a static route, so firewall policies reference interfaces rather than an ipsec action. Required for dynamic routing and SD-WAN over VPN.

Dial-up IPsec net-device

With set net-device enable on a dynamic phase 1, all dial-up clients share one tunnel interface address. Without it, FortiOS creates a separate interface and IP per connecting client.

FSSO collector agent

A Windows agent that collects Active Directory logon events and reports user-to-IP mappings to the FortiGate, letting firewall policies match users without prompting for credentials.

SSL VPN tunnel mode

A client establishes a virtual network adapter and receives an IP from the SSL VPN address range, then routes configured subnets through the FortiGate. Web mode only proxies bookmarked applications.

Policy route

Configured under config router policy, it is checked before the routing table and can forward matching traffic out a specified gateway or interface, or drop it. It does not appear in the routing table.

Performance SLA

An SD-WAN health check that probes a server using ping, tcp-echo, udp-echo, HTTP, or DNS and compares results to latency, jitter, and packet-loss targets to mark members in or out of SLA.

SD-WAN zone

A logical grouping of SD-WAN member interfaces. Firewall policies and static routes reference the zone, so adding or removing members does not require changing policies or routes.

ECMP

Equal-cost multipath installs several routes to the same destination when distance and priority tie, and sessions are distributed across them. The maximum number of paths is set in config system settings.

SD-WAN rule strategy

Each rule selects members by strategy: manual (priority and weight), lowest cost, maximize bandwidth, or best quality based on performance SLA. Rules match on addresses, applications, internet services, or users.

diagnose sniffer packet verbosity

Verbosity 1 prints only IP headers, while 6 prints the full packet payload in hex and ASCII with timestamps. Higher verbosity produces more console output and more CPU load.

debug flow trace

diagnose debug flow shows how each packet is processed: policy lookup, route lookup, NAT, and session creation. Enable with diagnose debug enable and start the trace after setting filters.

diagnose sys session filter

Narrows session table output and clear operations to matching source, destination, port, or protocol. Set filters, then run diagnose sys session list or clear to affect only those sessions.

HA checksum cluster

diagnose sys ha checksum show lists per-VDOM checksums so you can compare primary and secondary configuration. Mismatched checksums usually mean configuration is not synchronizing.

get system performance status

Displays uptime, CPU and memory usage, session counts, and network interface throughput figures, giving a quick baseline before deeper troubleshooting.