Fortinet NSE 6 cheat sheet

FortiGate policies are evaluated top-down; the first matching policy is applied, and implicit deny drops all traffic not matched by any policy.

Security profiles (AV, IPS, Web Filter, App Control, SSL Inspection) attach to a firewall policy; profiles only inspect traffic that the policy accepts.

NAT order: destination NAT (VIP/central NAT) occurs before routing and policy lookup; source NAT occurs after the policy is matched.

FortiGate interfaces have a default administrative distance; connected routes win over static, and static wins over routes learned via OSPF/BGP unless distance is changed.

Flow-based inspection passes packets as they arrive and inspects at the end of the session; proxy-based inspection buffers and reconstructs content for deeper inspection.

UTM/NGFW mode enables full security profile inspection; interface mode requires selecting flow or proxy inspection mode per VDOM.

HA cluster: FGCP primary handles all traffic; session pickup and link failover thresholds determine failover behavior; heartbeat uses the HA reserved link.

VDOMs partition a FortiGate into independent virtual firewalls with separate policies, routing tables, and admin domains.

SSL deep inspection requires installing the Fortinet CA certificate on clients; certificate inspection alone only reads the SNI/CN.

FortiAnalyzer receives logs over TCP 514 (syslog) or OFTP (TCP 514) from FortiGate; log forwarding and ADOMs segregate multi-tenant data.

FortiSIEM correlation rules combine event attributes; incidents fire when rule conditions are met, and CMDB data enriches event context.

FortiManager centralizes policy and object management; policy packages are assigned to ADOMs and installed to managed devices.

Playbooks in FortiSOAR automate response steps; a playbook is a sequence of tasks, and connectors integrate with external tools via API.

Log severity levels follow syslog: 0 emergency through 7 debug; FortiGate alert logs are severity 1 and above.

Incident response order: identify, contain, eradicate, recover, and document lessons learned; preserve evidence before remediation.

FortiEDR/Endpoint detection uses behavioral analysis; it can block, isolate, or allow endpoints based on playbook and policy decisions.

Threat hunting queries should target anomalies in authentication logs, outbound traffic volume, and rare process execution rather than only known signatures.

FortiGate VM licensing options include BYOL, on-demand (PAYG), and FortiFlex; BYOL requires a license file tied to the VM serial and CPU count.

FortiGate Cloud-Native Firewall (CNF) deploys in AWS/Azure/GCP; it uses auto-scaling groups and cloud-native load balancers for elasticity.

Security Groups (AWS) and NSGs (Azure) are stateless/stateful cloud controls; FortiGate policies provide the stateful application-layer inspection.

Cloud connectors (AWS, Azure, GCP) in FortiGate/FortiManager discover workloads and dynamically populate address objects for policies.

FortiCASB and FortiCloud Sandbox integrate with cloud apps; CASB enforces DLP and access policies on SaaS traffic.

In AWS, a FortiGate HA pair uses an elastic IP for failover; the active device maps the EIP, and the standby takes over on failover.

Zero Trust Network Access (ZTNA) verifies identity and device posture per application, not per network segment.

Cloud WAF (FortiWeb) protects public web apps; deploy behind a load balancer and enable signature, bot, and API protection profiles.

SD-WAN selects paths by SLA targets (latency, jitter, packet loss); rules define preferred members and health checks use probes to measure them.

FortiSwitch managed via FortiLink uses CAPWAP-like control over the FortiLink interface; VLANs can be assigned per port or via FortiGate policies.

FortiAP registration: APs discover the controller via DHCP option 138, DNS, or broadcast; the FortiGate acts as the wireless controller.

BGP neighbor states: Idle, Connect, Active, OpenSent, OpenConfirm, Established; Established is required for route exchange.

OSPF: neighbors must match area, hello/dead timers, and authentication; DR/BDR election uses priority then router ID.

IPsec site-to-site: phase 1 negotiates IKE SA (pre-shared key, encryption, DH group); phase 2 negotiates IPsec SA (ESP, PFS).

VLAN tagging: access ports carry one untagged VLAN; trunk ports carry multiple tagged VLANs (802.1Q).

Routing decision: longest prefix match wins; among equal prefixes, lowest administrative distance, then lowest metric.

FortiExtender provides cellular WAN backup; it registers to the FortiGate and can be used as an SD-WAN member.