Fortinet NSE 5 flashcards
Fortinet NSE 5 · Build recall with a focused review session.
32 cards. Read the term and the definition here. The deck at the top of this page is optional.
- Implicit deny policy
- The last policy in the FortiGate policy table that drops all traffic not explicitly permitted by earlier policies. It is not editable and logging is disabled by default, so denied traffic may not appear in logs unless explicitly configured.
- Policy order evaluation
- FortiGate evaluates firewall policies from top to bottom and applies the first matching policy. No further policies are evaluated after a match, so more specific policies must be placed above broader ones to avoid unintended matches.
- Source NAT (SNAT)
- Network address translation that changes the source IP of outgoing packets, typically to the outgoing interface address or an IP pool. Configured within a firewall policy by enabling NAT and selecting the address type.
- Destination NAT (VIP)
- A virtual IP object maps an external IP and port to an internal IP and port. Referenced in the destination field of a firewall policy, it performs destination NAT for inbound traffic to internal servers.
- Security profile modes
- FortiGate security profiles can operate in flow-based mode (default, faster, less granular inspection) or proxy-based mode (more inspection features and granular control). The mode affects available UTM options and performance.
- SSL deep inspection
- A method where the FortiGate decrypts SSL/TLS traffic using a forward proxy certificate, inspects it with UTM profiles, then re-encrypts it. Requires the FortiGate CA certificate to be trusted by clients.
- Certificate inspection
- SSL inspection mode that reads the server certificate's CN or SAN without decrypting traffic. Used for web filtering and application control based on certificate details, but cannot inspect encrypted payload.
- Firewall authentication
- Authentication of users against local, LDAP, RADIUS, or other servers before policy access. FortiGate supports captive portal and explicit proxy methods; user groups are referenced in policies to enforce identity-based rules.
- UTM profile group
- A container that combines multiple security profiles (AV, IPS, web filter, app control) into a single object. Applied to a firewall policy to simplify configuration and ensure consistent inspection across policies.
- High availability (HA)
- A configuration of two or more FortiGates in active-passive or active-active mode for redundancy. Heartbeat links and session synchronization maintain connectivity during failover; priority and override determine the primary unit.
- Logging in policies
- Per-policy setting to record traffic or security events. Options include logging all sessions or only security events; logs can be stored locally or sent to FortiAnalyzer or syslog for retention and analysis.
- Application control
- A UTM profile that identifies and controls applications based on signatures, regardless of port or protocol. Actions include allow, block, or traffic shaping; it can be applied per policy to enforce application usage policies.
- Web filter categories
- FortiGuard-based URL categorization used to allow or block web content by category. Overrides can permit specific URLs; the profile can also enforce safe search and block malicious sites.
- Antivirus profile
- A security profile that scans traffic for viruses and malware using signature and heuristic detection. It can be applied to protocols such as HTTP, FTP, SMTP, and POP3, with actions like block or monitor.
- IPS profile
- Intrusion prevention profile that detects and blocks known attack signatures and anomalies. It uses FortiGuard signatures and can be tuned by severity and action (block, monitor, reset).
- DNS filter
- A security profile that inspects DNS queries and responses to block malicious domains, botnets, and phishing. It can use FortiGuard DNS categories and enforce safe search or block DNS over HTTPS.
- VLAN interface
- A logical interface that carries 802.1Q tagged traffic on a parent physical interface. Configured with a VLAN ID and parent interface; used to segment networks and apply policies per VLAN.
- Aggregate interface
- A logical interface that bundles multiple physical links using LACP or static aggregation for increased bandwidth and redundancy. Member interfaces must be added to the aggregate; the aggregate is then configured with IP and policies.
- Zone
- A group of interfaces treated as a single entity for firewall policies. Traffic between interfaces in the same zone is allowed by default but can be blocked with the intrazone deny setting. Zones simplify policy management.
- VDOM
- Virtual Domain that partitions a FortiGate into independent virtual firewalls, each with its own interfaces, routing, policies, and administrators. Inter-VDOM links connect VDOMs; global settings are managed in the global VDOM.
- Policy route
- A route that overrides the routing table for matching traffic based on criteria such as source, destination, protocol, or port. Policy routes are evaluated before the routing table and can direct traffic to a specific gateway or interface.
- Static route
- A manually configured route specifying destination network, gateway, outgoing interface, and optional distance and priority. Static routes are used when dynamic routing is not desired or for default routes.
- OSPF on FortiGate
- A dynamic routing protocol supported by FortiGate. Configure areas, networks, and interfaces under 'config router ospf'. OSPF neighbors form adjacencies and exchange link-state advertisements to build the routing table.
- BGP on FortiGate
- Border Gateway Protocol configuration under 'config router bgp'. Define local AS, neighbors, and network advertisements. BGP is used for exchanging routes with external networks and supports attributes like AS path and local preference.
- IPsec phase 1
- Defines IKE parameters for an IPsec VPN: version (IKEv1/v2), mode (main/aggressive), encryption, authentication, DH group, pre-shared key or certificate, remote gateway, and NAT traversal. It establishes the IKE SA.
- IPsec phase 2
- Defines the IPsec SA parameters: encryption and authentication algorithms, perfect forward secrecy (PFS), and local/remote subnets. Phase 2 SAs are negotiated within the phase 1 IKE SA to protect data traffic.
- Route-based VPN
- An IPsec VPN configuration that uses a tunnel interface. Routes direct traffic into the tunnel, and firewall policies allow traffic between the tunnel and other interfaces. It supports dynamic routing and multiple subnets.
- SSL VPN portal
- A configuration that defines user access methods for SSL VPN: tunnel mode (full network access) or web mode (bookmarks). Portals are assigned to user groups and can enforce split tunneling, host checks, and client certificates.
- IP pool
- A range of IP addresses used for NAT. Types include overload (many-to-one), one-to-one, fixed-port-range, and port-block-allocation. IP pools are referenced in firewall policies or central NAT for source NAT.
- Central NAT
- A NAT configuration under 'config firewall central-snat-map' that applies source NAT globally, taking precedence over policy NAT. It simplifies NAT management by separating NAT rules from firewall policies.
- Diagnose sniffer packet
- A CLI command to capture packets on an interface with optional filters and verbosity. Syntax: diagnose sniffer packet <interface> <filter> <verbose> <count>. Used for troubleshooting traffic flow and connectivity.
- Diagnose debug flow
- A CLI tool that traces the life of a packet through the FortiGate, showing policy lookups, routing decisions, and NAT. Enabled with 'diagnose debug flow trace start' and viewed with 'diagnose debug flow filter'.