Fortinet NSE 4 study plan

Configure and verify physical/logical interfaces, VLAN sub-interfaces, zones, and software switches on a lab FortiGate

Build a working DNS, DHCP, and NTP service configuration and confirm clients receive correct leases and time

Set up administrative access safely: admin profiles, trusted hosts, strong password policy, and HTTPS/SSH admin ports

Distinguish transparent vs NAT/route operation modes and predict how each changes traffic flow

Describe how FortiGate HA (FGCP) primary/secondary election and session pickup behave at a conceptual level

Order firewall policies correctly and explain first-match behavior using zone-based and interface-based policies

Configure NAT in both policy-based and central NAT modes and verify which source address a server actually sees

Create address, service, and schedule objects and reuse them across policies without duplication

Apply the principle of least privilege by writing policies that use specific services instead of ALL

Trace a packet through a policy pair (inbound/outbound) and predict the session table entry it produces

Attach antivirus, IPS, web filter, application control, and DNS filter profiles to a policy and confirm logging triggers

Configure certificate-based deep inspection and explain when flow-based vs proxy-based inspection is required

Build traffic shaping with shared and per-IP shapers and a traffic-shaper policy, then verify bandwidth enforcement

Set up a static or dynamic (per-IP) shaping rule and measure the effect on a saturated link

Create local users and groups and map them to firewall policies using identity-based policy matching

Configure LDAP and RADIUS integration and verify successful and failed authentication log entries

Set up two-factor authentication (token or email/SMS) for a test admin or SSL-VPN user

Explain FSSO collector agent options and pick the correct mode for a given Windows AD scenario

Build a route-based IPsec site-to-site tunnel between two lab FortiGates and bring both phases up

Configure a dial-up IPsec VPN with a pre-shared key and verify a remote client establishes a tunnel

Set up SSL-VPN web and tunnel mode with split tunneling and a restricted portal

Diagnose a failing phase 1 or phase 2 using IKE debug output rather than guesswork

Configure static routes, policy routes, and ECMP and predict which path a given destination takes

Bring up OSPF between two FortiGates and verify neighbor adjacency and redistributed routes

Configure a basic BGP peering and inspect the BGP table and best-path selection

Build an SD-WAN zone with two members, health-check SLA targets, and rules that steer traffic by application or link quality

Verify SD-WAN failover by disabling one member and confirming traffic shifts per the SLA

Use debug flow and packet capture to prove where a connection is dropped or accepted

Read forward-traffic, event, and security logs to reconstruct a blocked-session timeline

Interpret session tables and diagnose common issues such as asymmetric routing, MTU/PMTU problems, and one-arm sniffer mode limits

Configure log settings, alerts, and basic automation stitches so a failure surfaces without manual checking

Retake a timed mixed-domain assessment and log every missed item by domain and root cause

Re-drill the two weakest domains until accuracy on those items exceeds 85 percent

Re-verify the lab build end to end so every configuration from weeks 1 through 7 still works together

Practice explaining aloud the difference between policy-based and route-based VPN, central NAT vs policy NAT, and flow-based vs proxy-based inspection