Fortinet NSE 5 key terms

Fortinet's integrated architecture that links FortiGate firewalls with other Fortinet and partner products so they share topology, logs, and threat intelligence and can be managed and automated as one system.

A scored checklist on FortiGate that audits configuration against best practices across areas such as system, WAN, logging, and segmentation, showing pass, fail, or uncovered items with remediation guidance.

A separate, independent configuration and routing instance inside a single FortiGate, letting one physical device serve multiple tenants or functions with isolated policies, interfaces, and administrators.

A setting that restricts an administrator account to managing only specified VDOMs, optionally with a profile that limits which commands and objects the account can view or change.

A permission template assigned to an administrator account that grants read-write or read-only access per configuration area, such as firewall policy, routing, or system settings.

Login protection that requires a second proof of identity beyond a password, commonly a time-based token from FortiToken or an SMS or email code, applied to administrator or user accounts.

Method where FortiGate forwards user credentials to a directory server such as Active Directory or another LDAP server and uses the returned group membership for identity-based policy decisions.

Integration with a domain controller or collector agent that learns which user is logged on to which workstation, so FortiGate applies identity-based policy without prompting for credentials again.

A named collection of local users, remote directory groups, or devices used as a source or destination match in firewall policy, enabling policy to follow identity rather than IP address.

The central rule object that matches traffic by incoming and outgoing interface, source, destination, service, and schedule, then applies an action such as accept or deny plus security profiles and logging.

A reusable bundle of inspection profiles, such as antivirus, web filter, IPS, application control, and SSL inspection, that can be attached to many policies at once for consistent enforcement.

Signature-based inspection that detects and can block known exploit and attack patterns in traffic, with the option to reset or drop offending sessions and log the matched signature.

Inspection that identifies applications by behavior and signature rather than by port, allowing policy to permit, block, or shape specific applications and categories regardless of the ports they use.

Profile that classifies and controls web destinations by category and reputation, supports URL allow and block lists, and can apply actions such as block, warning, or authentication prompt.

Decryption of TLS traffic so security profiles can inspect the payload, using either a forward proxy with a certificate authority certificate or certificate inspection that reads only the server name.

A lighter SSL inspection mode that does not decrypt payload; it reads the server certificate or TLS handshake to extract the server name and apply category and allow or block decisions.

SSL inspection mode where FortiGate terminates and re-establishes TLS using its own signing certificate, enabling full payload scanning by antivirus, IPS, and other profiles.

Rewriting of source or destination addresses and ports as packets traverse the firewall, used to share public addresses, publish internal servers, or redirect traffic to a proxy or load balancer.

A NAT mode where translation is defined in dedicated NAT rules referenced by policy, instead of per-policy NAT settings, giving reusable and ordered source and destination translation behavior.

A defined range or block of addresses used as the translated source for outbound NAT, with options for overloading, fixed port ranges, and address pairing behavior.

A destination NAT object that maps a public address and port to an internal server address and port, optionally including a load-balance group of multiple real servers.

A rule evaluated before the routing table that forwards matching traffic out a chosen interface and next hop, commonly used for source-based routing, dual WAN steering, or protocol-based redirection.

Feature that groups multiple WAN links into one logical interface and selects links per traffic rule using measured performance such as latency and jitter, with health checks and failover.

A probe that periodically tests reachability and quality of a WAN link, such as latency and packet loss, so SD-WAN rules can prefer or avoid that member link.

A virtual point-to-point interface pair connecting two VDOMs on the same device, allowing traffic to pass between them under firewall policy like a physical cable would.

An isolated routing table instance on FortiGate that keeps overlapping address ranges separate, with interfaces and static or dynamic routes assigned to a specific virtual router.

Deployment of two or more FortiGates as a cluster that synchronizes configuration and sessions, with one primary forwarding traffic and others ready to take over on failure.

Fortinet's proprietary clustering protocol that elects the primary, synchronizes configuration and connection state, and manages failover and link monitoring among cluster members.

A cluster setting that lets device priority decide the primary instead of uptime and monitor status; when disabled, the longest-running healthy unit keeps the primary role.

HA feature that replicates connection state tables to secondary units so established sessions survive a failover, with options to sync only certain traffic or firewall sessions.

A MAC address that an HA cluster presents on its interfaces so peers and switches keep sending traffic to the same address after a failover to another cluster member.

A management mode where a FortiGate port controls supported FortiSwitch and FortiAP devices, letting the firewall authorize, configure, and monitor them as part of the Security Fabric.

A configuration object that authorizes another device to join the Security Fabric, defining its role and enabling exchange of logs, topology, and threat information with the root FortiGate.

A logical interface that carries traffic for one 802.1Q VLAN tag on a physical or aggregate link, allowing multiple separated networks to share one port.

A virtual switch object that groups several interfaces so they act as one Layer 2 broadcast domain with a shared IP address, useful for combining ports or wireless and wired segments.

A named grouping of one or more interfaces that can be referenced as a single source or destination in policy, simplifying rules when many ports serve the same role.

A manually configured path that tells FortiGate which next-hop gateway or interface to use for a destination prefix, with optional distance and priority for selection and backup.

A proxy service on FortiGate that clients are configured to send web requests to directly, enabling user authentication and web filtering without transparent interception of the connection.

The set of protocols, such as HTTPS, SSH, ping, or SNMP, enabled on a specific interface, controlling how administrators and monitoring systems can reach the device.