Fortinet NSE 5 study plan

Fortinet NSE 5 · Give each week a clear focus.

8 weeks · About 6 hours per week

Week 1

FortiGate Security

Map every FortiGate Security objective to a personal checklist, marking each as confident, shaky, or unknown before studying anything.
Explain the packet flow through a FortiGate (ingress, policy lookup, UTM inspection, egress) in your own words without notes.
Configure interfaces, zones, and static routes on a lab FortiGate and verify connectivity with a ping and a policy route lookup.
Compare flow-based and proxy-based inspection modes and state one scenario where each is the correct choice.

A one-page packet-flow diagram plus a scored objective checklist (confident/shaky/unknown counts) for Domain 1.

Week 2

Build firewall policies that allow, deny, and NAT traffic, then prove each rule matches using policy lookup and log entries.
Configure SNAT and DNAT (VIP) and verify both directions with packet captures.
Set up authentication (local user, LDAP or RADIUS) and apply it to a policy, then test a successful and a failed login.
Interpret forward-traffic log fields well enough to identify which policy and NAT rule handled a session.

A working lab with at least three policies, one VIP, and one authenticated rule, documented with the matching log lines.

Week 3

Configure SSL/TLS inspection, including a certificate-inspection profile and a deep-inspection profile with a test CA.
Enable antivirus, IPS, web filter, and application control on a single policy and confirm each blocks its test sample.
Explain how security profiles attach to policies and where inspection happens in the flow.
Troubleshoot one deliberately broken profile (wrong certificate, disabled sensor) using debug and logs.

A UTM test report showing each profile blocking or logging a known test case, with the log evidence attached.

Week 4

Configure IPsec site-to-site VPN between two lab FortiGates and bring the tunnel up.
Configure a dial-up (client) VPN and connect one remote client.
Verify tunnel status, routes, and interesting traffic, then break and restore the tunnel intentionally.
Review Domain 1 weak spots from weeks 1-3 and re-test them.

A verified site-to-site and client VPN, plus a scored Domain 1 practice set with at least 80% correct.

Week 5

Configure VDOMs, split administrative access, and move an interface between VDOMs.
Set up inter-VDOM links and route traffic between two VDOMs.
Create administrative profiles and an admin account limited to read-only or a single VDOM.
Explain HA modes (active-passive, active-active) and the role of the heartbeat and session synchronization.

A two-VDOM lab with routed inter-VDOM traffic and a restricted admin account, documented with config excerpts.

Week 6

Build an HA cluster of two FortiGates and verify failover by pulling a heartbeat link or powering off the primary.
Configure SD-WAN with two WAN links and a rule that prefers the better link, then simulate a link failure.
Configure routing (static and at least one dynamic protocol) and verify the routing table and failover behavior.
Capture and read HA and SD-WAN logs to confirm the expected event sequence.

A working HA pair with a demonstrated failover, plus an SD-WAN rule that shifts traffic when a link drops.

Week 7

Configure logging to a syslog or FortiAnalyzer destination and confirm events arrive.
Set up a backup schedule and restore a configuration from a backup file.
Configure certificate management, including importing or generating a certificate used by a policy or VPN.
Diagnose a connectivity problem end to end using sniffer, debug flow, and logs.

A troubleshooting runbook with the exact commands and log filters you used to solve one real lab fault.

Week 8

Re-take scored practice sets for both domains and log every missed objective.
Re-study only the missed objectives and re-test them until confident.
Review the packet-flow diagram, HA failover steps, and VPN verification commands from memory.
Simulate exam timing with a full mixed set and record your score and pacing.

A final score sheet across both domains with all previously missed objectives re-tested and passed.

Week 2: Can explain packet flow, policy lookup, and NAT behavior from memory and show matching logs for each rule.

Week 4: Domain 1 practice score at or above 80%, with a working site-to-site and client VPN in the lab.

Week 6: HA failover and SD-WAN link failover both demonstrated, with logs confirming the event sequence.

Week 8: Full mixed practice set completed within time, both domains at or above 80%, and no objective left marked unknown.