Fortinet NSE 5 common mistakes
Fortinet NSE 5 · Understand the traps and how to avoid them.
Treating the order of firewall policy matching as top-down 'best match' and expecting the most specific policy to win regardless of position, so a broad permit rule placed above a deny rule is assumed to be overridden by the deny.
Candidates carry over intuition from ACLs or from NAT where specificity seems to matter, and they memorize policy features (schedules, users, ISDB) without internalizing that FortiGate evaluates policies strictly in sequence and stops at the first match.
What to do instead
Before answering, draw the policy list in numeric order and walk the packet through it top to bottom, marking the first policy whose source, destination, service, schedule, and user all match. Practice with lists that mix broad and narrow rules in both orders, and remember that policy IDs are display order, not priority. FortiGate Security.
Assuming a policy with NAT enabled will translate traffic without checking whether the matching policy is actually the one with NAT, or forgetting that NAT must be enabled on the specific policy that matches, not just somewhere in the path.
NAT is often studied as a separate topic from policy matching, so candidates answer NAT questions by looking for a central NAT table or the interface configuration rather than reading the policy flags.
What to do instead
For every NAT scenario, first identify the exact policy that matches the flow, then read its NAT column (disabled, enabled with a pool, or central NAT). If central SNAT is configured, remember it takes precedence over per-policy NAT. Build a habit of stating the matching policy ID in your reasoning before answering. FortiGate Security.
Mixing up the direction of a VIP (destination NAT) and an IP pool (source NAT), including which address objects go in the external and mapped fields, and which policy direction carries the inbound versus return traffic.
Both are 'NAT' in casual speech, and the field labels (external IP, mapped IP) are easy to reverse under time pressure. Candidates also forget that the return path of a VIP is handled implicitly by the session table, not by a separate policy.
What to do instead
Anchor on the packet's perspective: a VIP rewrites the destination of an inbound packet from the external address to the internal server address, so the external IP is the public address and the mapped IP is the server. An IP pool rewrites the source of an outbound packet. Rehearse one inbound web-server scenario and one outbound internet scenario and label every address in each. FortiGate Security.
Ignoring the implicit deny and the role of the default route and reverse path when diagnosing why traffic is dropped, and answering 'the policy allows it' without checking routing, zones, or interface membership.
Candidates focus on the visible policy list and forget that a packet must also have a valid route in both directions and must enter and leave through interfaces assigned to the correct zones for the policy to match at all.
What to do instead
Use a fixed checklist for every 'why is it dropped' question: route lookup to destination, reverse path check, ingress interface zone, egress interface zone, policy match, then inspection profile. If any step fails, the packet never reaches the next. Practice identifying which step a given symptom points to. FortiGate Infrastructure.
Confusing the roles of static routes, policy routes, and SD-WAN rules, and assuming a policy route overrides everything including connected routes or that SD-WAN members are chosen purely by routing table.
All three influence forwarding but operate at different points, and the terminology overlaps. Candidates memorize definitions without learning the evaluation order and the conditions (source, destination, protocol, port) each mechanism can match on.
What to do instead
Learn the lookup order explicitly: connected and static routes populate the routing table, policy routes are evaluated for matching traffic before the routing table result is used, and SD-WAN rules select among members for traffic that reaches the SD-WAN logic. Answer by naming which mechanism the scenario's match criteria point to. FortiGate Infrastructure.
Treating HA as a simple active/passive label and misanswering questions about which device holds which role, how sessions and configuration synchronize, and what happens to traffic on a failover.
HA is taught as a diagram rather than as behaviour, so candidates cannot reason about heartbeat interfaces, priority, override, and the difference between session pickup and full session synchronization.
What to do instead
Study one failover event step by step: heartbeat loss, role election by priority and override, gratuitous ARP to move traffic, and session table handling. Be able to say what is synchronized (configuration, and sessions if enabled) and what is not. Draw the two-unit topology and label primary, secondary, heartbeat ports, and monitored interfaces. FortiGate Infrastructure.
Answering inspection-profile questions by naming the profile that 'sounds right' instead of identifying where in the flow it applies (flow-based versus proxy-based) and what happens when multiple profiles are attached to one policy.
The security profiles look interchangeable in a list, and candidates do not connect each profile to the protocol layer or to the inspection mode configured on the policy.
What to do instead
Build a table mapping each profile to what it inspects and the mode it requires: antivirus and IPS in flow or proxy mode, web filter and application control, and certificate inspection for HTTPS. For multi-profile policies, remember profiles are applied in a defined sequence and a block in an earlier profile ends inspection. FortiGate Security.
Misreading log and debug output, for example treating a 'deny' log entry as proof of a policy drop when it may be an implicit deny, or ignoring the session's original versus reply direction when reading debug flow output.
The output is dense and candidates skim for keywords instead of reading the tuple fields, the policy ID, and the reason code, so they attribute the drop to the wrong cause.
What to do instead
Practice reading debug flow line by line: identify the packet's source and destination, the matched policy ID (0 usually means no match), and the explicit reason string. Cross-check the corresponding log entry's action and policy ID. Learn to distinguish a routing failure from a policy denial from an inspection block by the message text. FortiGate Infrastructure.
Confusing authentication methods and where they apply: local users versus LDAP or RADIUS, firewall user groups versus administrative accounts, and the difference between user authentication for traffic and admin login for management.
The same user objects appear in policy, in VPN, and in admin configuration, and candidates do not separate the data plane from the management plane.
What to do instead
Sort every authentication question into one of three buckets: admin login to the device, user authentication for traffic through a policy, and VPN peer or user authentication. Then name the server type and the group type used in that bucket. Remember that firewall user groups are referenced by policies and that admin accounts are configured separately with their own trusthost and profile. FortiGate Security.
Skipping the 'what does this setting actually change' step and answering configuration questions from memorized menu paths, so a question about a specific option (for example, NAT on a policy, or the effect of a schedule) is answered by the feature name rather than its effect.
Candidates study the GUI layout as a memory exercise because it feels concrete, and the exam rewards understanding effects and interactions, not navigation.
What to do instead
For each major feature, write one sentence stating its effect on a packet or on device behaviour, then test yourself with 'what changes if I toggle this' scenarios. When a question names an option, restate the option's effect before choosing. This converts menu knowledge into behaviour knowledge, which is what the scenarios test. FortiGate Security.