I85PREP
⌘ K
Fortinet NSE 5 study materials
Fortinet NSE 5 study resources

Fortinet NSE 5: FortiGate Infrastructure

Fortinet NSE 5 · Work through your exam, one topic at a time.

All guide sections

FortiGate Infrastructure

The FortiGate Infrastructure domain tests the forwarding and high-availability layer: routing decisions, interface types, virtual domains, and FortiGate Clustering Protocol (FGCP) behavior. Expect questions that ask why a packet took a particular path or why a cluster failed over.

Routing and forwarding

  • The FortiGate uses longest-prefix match in the routing table; administrative distance and priority break ties.
  • Policy routes are checked before the routing table for matching traffic and can override the destination interface or gateway.
  • Reverse path forwarding (RPF) checks can drop traffic arriving on an interface that is not the expected route back to the source.
  • SD-WAN rules can steer traffic by application or link quality, but they still depend on valid routes.

Interfaces and VDOMs

  • Interfaces can be NAT/route mode or transparent mode; VLAN subinterfaces and aggregate interfaces change the Layer 2 path.
  • VDOMs partition the configuration. Inter-VDOM links carry traffic between VDOMs, and the admin VDOM manages the device.
  • Zones group interfaces so one policy can reference several ports.

HA (FGCP)

  • In active-passive FGCP, the primary is elected by priority; higher priority wins. Override controls whether a recovered higher-priority unit preempts the current primary.
  • Monitored interfaces trigger failover when a link fails. Heartbeat interfaces carry HA synchronization; session pickup maintains sessions.
  • HA mode changes and some VDOM changes require a reboot or cause a brief outage.

Worked example

Two FortiGates form an HA cluster. FG-1 has priority 200, FG-2 has priority 100, and override is disabled on both. FG-1 is primary at boot. Its monitored WAN interface fails, so FG-2 becomes primary. When FG-1's WAN link recovers, FG-1 does not reclaim the primary role because override is disabled. If the design requires FG-1 to resume primary after recovery, enable override and verify priorities and monitored interfaces on both units.

Traps

  • Reversing HA priority (higher numeric value wins).
  • Assuming a recovered unit always preempts; override must be enabled.
  • Forgetting that policy routes are evaluated before the routing table.
  • Changing VDOM mode without planning for a reboot.
  • Using a zone in a policy but forgetting that member interfaces must be up.