Fortinet NSE 4 key terms

A virtual domain that splits one FortiGate into separate logical firewalls, each with its own interfaces, routing table, policies, and administrators. VDOMs let a single device serve multiple customers or departments with isolated configurations.

A permission template assigned to an administrator account. It controls which menus and commands the admin can reach, whether they may read or change configuration, and which VDOMs they can manage.

An operating mode where the FortiGate forwards traffic at Layer 2 like a bridge without changing IP addresses. Interfaces are paired in virtual wire pairs and NAT is not applied, so the device stays invisible to the network.

A named grouping of two or more interfaces that share the same security requirements. Policies, routing, and profiles can target the zone instead of each interface, which reduces the number of rules to maintain.

A cluster of two or more FortiGates that share configuration and synchronize sessions so traffic continues if one unit fails. One device is primary and the others stand by as backups.

Two interfaces bound together so traffic entering one is passed unchanged out the other at Layer 2, with no IP address on either interface. It is used in transparent mode deployments.

The core rule that matches source address, destination address, and service, and optionally user or schedule, then allows or denies the traffic. Policies also attach security profiles, NAT, and logging.

The default behavior at the end of the policy table: any traffic not matched by an explicit allow rule is dropped. It enforces a default-deny posture without requiring a written rule.

A named container for one or more IPv4 or IPv6 addresses, subnets, ranges, or FQDN entries. Policies and profiles reference the object name instead of hard-coded addresses.

A named definition of a protocol and its port range, such as TCP 443 or UDP 5060. Firewall policies match traffic against service objects to decide whether the rule applies.

A destination NAT object that maps a public IP address and port to a private server address and port. Inbound connections to the external address are translated to the internal host.

A defined range or block of addresses used for source NAT. Firewall policies use the pool so outbound traffic appears to come from those addresses rather than from the interface address.

A configuration where NAT is defined in a separate table of SNAT and DNAT rules instead of inside each firewall policy. Those rules perform address translation before policy matching occurs.

A policy that controls traffic addressed to the FortiGate itself, such as management access, routing protocols, or VPN termination. It is evaluated separately from normal forwarding policies.

An interface-level set of anomaly thresholds, such as packets per second per source, that drops or logs traffic exceeding the configured baseline. It protects the FortiGate and the network from flood attacks.

A security profile that scans traffic for viruses, worms, and other malware using signatures and heuristics, then blocks or monitors infected files. Scanning can be proxy-based or flow-based.

A security profile holding intrusion prevention signatures and filters. It inspects traffic for known attack patterns and can reset, block, or only log matching sessions.

A profile that classifies web requests by URL, domain, or FortiGuard category and applies allow, block, monitor, or warning actions. It can also enforce safe search and block uncategorized sites.

A profile that identifies applications by their traffic signatures rather than by port, then allows, blocks, or shapes them. It can control evasive apps that use standard ports like 80 or 443.

Decrypting TLS traffic so security profiles can examine the payload, then re-encrypting it. It relies on a certificate the FortiGate presents to clients, and can be full or certificate-only.

A profile that checks DNS queries against FortiGuard ratings and botnet lists, blocking resolution of malicious or disallowed domains before a connection is even made.

An object that defines a bandwidth limit in kbps plus optional priority and guaranteed bandwidth. Shared shapers cap the total for all traffic; per-IP shapers cap each source address.

A rule that matches traffic by address, service, application, or user and applies a traffic shaper and priority to it. It works alongside firewall policies and can reverse the shaper for the download direction.

Two inspection modes. Flow-based scans packets as they stream through, adding less latency but buffering little; proxy-based reassembles and buffers content for deeper scanning and features such as content disarm.

A collection of accounts that are local, remote (LDAP or RADIUS), guest, or FSSO-based, used in policies for identity-based rules. Membership can be static or filled dynamically at login.

Configuration that tells the FortiGate how to reach a directory server: server IP, port, bind credentials, base DN, and attribute mappings. It is used to authenticate users and look up group membership.

Fortinet Single Sign-On. It learns which user is logged into which workstation from domain controller events, so policies can apply by user without prompting for credentials again.

Requiring a second proof of identity beyond a password, typically a one-time code from a FortiToken app, hardware token, or email. It can protect admin logins and VPN users.

A remote-access VPN that runs over TLS, usually on port 443. Web mode gives browser-based access to internal resources; tunnel mode gives the client a virtual adapter with full network access.

The IKE negotiation that builds a secure channel between VPN peers: it agrees on encryption and hash algorithms, an authentication method such as pre-shared key or certificate, and the peer addresses.

The IPsec security association that defines which traffic is protected: local and remote subnets, protocol, and the ESP encryption and authentication algorithms. It runs inside the phase 1 tunnel.

A manually configured path saying traffic for a destination network should go to a next-hop gateway or interface. Each route carries a distance and priority that break ties between overlapping routes.

A rank from 1 to 255 that decides which route to the same destination is preferred: lower is better. Connected routes are 0, static routes default to 10, and each dynamic protocol has its own default.

A rule that chooses which WAN link or links carry matching traffic, based on criteria such as application, source, destination, or measured link health. It replaces static routes for multi-link selection.

A probe that sends traffic such as ping or HTTP to a target and measures latency, jitter, and packet loss. SD-WAN rules use the results to decide whether a member link meets its SLA.

A check that the packet's source address is reachable through the interface it arrived on, according to the routing table. If it is not, the packet is dropped as a possible spoofing attempt.

The diagnose sniffer packet command captures live packets on an interface with filters and verbosity levels, showing what really traverses the device. It is the first tool for confirming traffic flow.

The diagnose debug flow command prints step by step what happens to a packet: route lookup, policy match, NAT, and session creation. It shows exactly why traffic was allowed or dropped.

The FortiGate's list of active connections, showing source, destination, NAT translation, policy ID, and timeout. Inspecting it confirms whether a session exists and how it is being handled.

A set of GUI dashboards that aggregate logs into views of top sources, destinations, applications, and threats. It helps spot trends and find the cause of performance or security issues.