Fortinet NSE 5 case studies
Fortinet NSE 5 · Put your knowledge to work in context.
The Fortinet NSE 5 designation sits in the middle of Fortinet's Network Security Expert (NSE) certification ladder, above the entry-level NSE 1–3 awareness and fundamentals tiers and below the advanced NSE 6 and NSE 7 specialist levels. It is aimed at network and security professionals who already understand basic firewall concepts and now need to operate FortiGate equipment day to day - security administrators, network engineers, and managed-service staff who deploy, configure, and troubleshoot FortiGate devices in production. The Fortinet NSE 5 case studies are 5 cases and about 4,078 words.
1Publishing an Internal Web App to Staff Without Split DNS
HQ runs a FortiGate 100F on FortiOS 7.2 in a single VDOM. wan1 is 203.0.113.10/29 and holds the default route; port2 carries the staff VLAN (10.10.10.0/24); port3 holds servers (10.10.20.0/24), including 10.10.20.50, which listens on TCP 8443.
766 words, about 4 min2HA Cluster Failover Storm After a Switch Stack Upgrade
Two FortiGate 200F appliances run FGCP active-passive. Heartbeat and session sync share two links (port1 primary, port2 secondary); session-pickup is enabled, override is disabled, and priorities are 200 on unit 1 and 100 on unit 2.
827 words, about 4 min3HTTPS Blocking Bypassed by HTTP/3 in a Branch
A branch office FortiGate 60F on FortiOS 7.4.6 (single VDOM) protects staff on port2 (10.40.0.0/22) with one internet policy, port2 - wan1, NAT enabled, and a UTM profile containing: application control that blocks the Peer-to-peer and Proxy categories and sets Unknown applications to Allow; a flow-based web filter using the certificate-inspection SSL/SSH profile; flow-based antivirus and IPS. Legal has forbidden TLS deep inspection outside the finance VLAN, so no FortiGate CA is installed on endpoints.
791 words, about 4 min4BGP Over IPsec: Tunnel Up, BGP Up, Half the Subnets Unreachable
An MPLS replacement project uses a FortiGate 100F at HQ and 14 FortiGate 40F units at branches. Each branch has a route-based IPsec tunnel (HQ side 169.254.10.1/30, branch side .2/30) running eBGP: HQ is AS 65001, each branch its own AS in 65010–65023.
795 words, about 4 min5FSSO Group Policy Denying a Quarter of Logins After a DC Build
A retail chain uses a FortiGate 100F with FSSO to gate access to an ERP application. The FSSO collector agent runs on DC1, and DC agents are installed on DC1 and DC3 only.
899 words, about 4 min