Fortinet NSE 4 study guide
Fortinet NSE 4 · Work through your exam, one topic at a time.
The Fortinet NSE 4 - FortiOS Administrator exam is the proctored assessment that leads to the NSE 4 FortiOS certification. Fortinet describes that certification as validating your ability to configure, operate, and administer FortiGate devices to secure networks and applications, and recommends it for network and security professionals who need the expertise to configure and administer firewall solutions in an enterprise network security infrastructure. The Fortinet NSE 4 study guide has 5 sections and about 1,963 words.
01System and Network Settings
Administrative access is granted per interface : HTTPS, SSH, ping, SNMP, RADIUS accounting and FortiManager access are checkboxes on each interface. A classic exam trap is disabling HTTPS (or changing the management port) on the interface you are managing through, locking yourself out; the safe habit is to enable the new access method, verify it works, then disable the old one.
335 words, about 2 min02Firewall Policy, Security Profiles, and Traffic Shaping
Firewall policies are evaluated top-down, first match wins , regardless of how specific the match is. A broad any → any accept rule placed above a specific block rule makes the block rule unreachable.
671 words, about 3 min03Authentication and VPN
User authentication starts with user objects: local users, or remote servers referenced as LDAP, RADIUS, TACACS+, PKI or FSSO. Firewall policies match user groups , not individual users, and a policy with multiple groups matches if the user belongs to any of them.
312 words, about 2 min04Routing and SD-WAN
Static routes carry a destination/prefix, an optional gateway, an outgoing interface, a distance and a priority . Lower distance wins first; if distances tie, lower priority wins; if both tie, the routes are equal-cost and traffic is load-balanced (ECMP).
313 words, about 2 min05Diagnostics, Monitoring, and Troubleshooting
Troubleshooting follows the packet: did it arrive, was it routed, did a policy accept it, and what did the profiles do with it? Arrival is verified with interface counters, ARP ( diagnose ip arp list , get system arp ) and the packet sniffer: diagnose sniffer packet any 'host 10.0.0.10 and port 443' 4 a .
332 words, about 2 min