Fortinet NSE 5 cheat sheet

Firewall policy matching is top-down; the first matching policy is applied and no further policies are evaluated. Implicit deny drops all traffic not explicitly permitted, and logging of denied traffic is off by default for the implicit deny.

Policy order matters: more specific policies must be placed above broader ones. Use the 'Move' action or drag-and-drop in the GUI; sequence numbers are assigned in multiples of 10 and can be renumbered via CLI 'config firewall policy' then 'move' or 'edit ' with 'set policyid'.

NAT is configured within the firewall policy. For source NAT (SNAT), enable NAT and select 'Use Outgoing Interface Address' or a pool. For destination NAT (DNAT/VIP), create a virtual IP object and reference it in the policy's destination field; the VIP maps external IP:port to internal IP:port.

Security profiles (AV, IPS, Web Filter, App Control, DNS Filter, SSL Inspection) are applied per policy. Profile mode can be 'flow-based' (default, faster, less granular) or 'proxy-based' (more inspection features). Profile groups combine multiple profiles for a single policy.

Authentication: Local users, LDAP, RADIUS, TACACS+ and PKI. FortiGate supports firewall authentication (captive portal), explicit web proxy, and SSL VPN. User groups can be referenced in policies; authentication timeout and HTTP redirect settings are configured under 'config firewall auth-portal' or per-policy.

SSL/TLS inspection requires a CA certificate on the FortiGate and the same CA installed as trusted on clients. Deep inspection uses a forward proxy with a certificate; certificate inspection only reads the CN/SAN without decrypting. Exempt categories or domains to avoid breaking pinned applications.

Logging: Traffic logs are stored locally or sent to FortiAnalyzer/syslog. Enable logging per policy; 'Log Allowed Traffic' can be set to 'All Sessions' or 'Security Events'. Log settings include 'generate-log-for-invalid-traffic' and 'log-invalid-packets' under 'config log setting'.

High availability (HA) in security context: two FortiGates in A-P or A-A. A-P uses heartbeat and session synchronization; A-A requires cluster configuration with redundant interfaces. HA override and priority determine primary; monitor interfaces can trigger failover. Configuration sync includes firewall policies, objects, and UTM profiles.

UTM/NGFW inspection order within a policy: typically flow-based inspection order is IPS, Application Control, then AV; proxy-based order may differ. SSL inspection occurs before most UTM profiles. Web filter can block or allow based on category and override; application control can shape or block by application signature.

Interfaces: physical, VLAN (802.1Q), aggregate (LACP), redundant (active-passive), loopback, and tunnel (IPsec, SSL, GRE). VLAN interfaces are created under 'config system interface' with 'set vlanid' and 'set interface '. Aggregate interfaces require 'set type aggregate' and member interfaces.

Routing: static routes are configured under 'config router static' with destination, gateway, device, distance, and priority. Policy routes (formerly policy-based routing) override the routing table for matching traffic. Dynamic routing supports OSPF, BGP, RIP, and IS-IS; OSPF areas and BGP neighbors are configured under 'config router ospf' and 'config router bgp'.

Zones: a zone groups multiple interfaces for policy simplification. Interfaces in a zone share the same firewall policies. Zones are configured under 'config system zone' and can be used as source/destination in policies. Intra-zone traffic is allowed by default but can be blocked with 'set intrazone deny'.

VDOMs: Virtual Domains partition a FortiGate into independent virtual firewalls. Each VDOM has its own interfaces, routing table, policies, and administrators. Inter-VDOM links connect VDOMs. Global settings are configured in the 'global' VDOM; VDOM mode is enabled under 'config system global' with 'set vdom-mode multi-vdom'.

IPsec VPN: Phase 1 defines IKE parameters (version, mode, encryption, authentication, DH group, PSK or certificate, remote gateway, NAT traversal). Phase 2 defines the IPsec SA (encryption, authentication, PFS, local/remote subnets). Route-based VPN uses a tunnel interface; policy-based VPN uses a policy with IPsec as action. 'set auto-negotiate enable' and 'set nattraversal enable' are common.

SSL VPN: configured under 'config vpn ssl settings' and 'config vpn ssl web portal'. Modes include tunnel (full network access) and web (bookmarks). Authentication uses user groups; split tunneling can be enabled. SSL VPN requires a server certificate. Host check and client certificate can be enforced.

FortiGate routing and NAT: SNAT can be configured via IP pools (overload, one-to-one, fixed-port-range, port-block-allocation). Central NAT (formerly NAT46/64) is configured under 'config firewall central-snat-map' and takes precedence over policy NAT. IP pools are under 'config firewall ippool'.

Diagnostics: 'diagnose sniffer packet ' captures packets. 'diagnose debug flow' traces session flow. 'get system status' shows firmware and serial. 'diagnose sys session list' shows session table. 'execute ping' and 'execute traceroute' test connectivity. 'diagnose hardware deviceinfo' lists hardware.

Firmware and backup: 'execute backup config' saves configuration; 'execute restore config' restores. Firmware upgrade via GUI or 'execute restore image'. HA checksum and configuration synchronization can be verified with 'diagnose sys ha checksum show'. 'execute factoryreset' resets to defaults.