Fortinet NSE 6 key terms

Fortinet's architecture that links firewalls, switches, access points, endpoints, and cloud workloads so they share telemetry, enforce consistent policy, and coordinate automated responses from a single management plane.

The Fortinet next-generation firewall appliance or virtual machine that inspects traffic, applies security profiles, terminates VPNs, and acts as the central enforcement point in most deployments.

A virtual domain that partitions a single FortiGate into independent logical firewalls, each with its own interfaces, routing table, policies, and administrators, commonly used for multi-tenant or separated internal zones.

A virtual point-to-point interface pair that connects two VDOMs on the same device so traffic can be routed and filtered between them using normal firewall policies.

An ordered rule that matches source, destination, service, and user criteria to decide whether traffic is allowed, denied, or inspected, and which security profiles and logging apply.

A bundle of inspection settings such as antivirus, IPS, web filtering, application control, and SSL inspection that is attached to a firewall policy to scan permitted traffic.

A unified threat management profile that groups multiple content-inspection engines under one name so identical protection settings can be reused across many firewall policies.

A configuration object that selects signature sets, severity thresholds, and anomaly rules used to detect and block exploit traffic, with per-signature actions and optional rate-based filters.

The process of decrypting TLS traffic at the firewall, inspecting it with security profiles, then re-encrypting it, using either a forward-proxy certificate or a trusted CA certificate on endpoints.

An SSL inspection mode where the firewall presents its own certificate to the client and re-establishes a separate session to the server, enabling full content scanning but requiring a trusted CA on clients.

A lighter SSL inspection mode that reads only the server certificate and TLS handshake metadata, such as the requested hostname, without decrypting payload, so it cannot detect threats inside encrypted content.

A signature-based feature that identifies applications regardless of port or protocol and lets policy allow, block, or shape them, including categories and per-application actions.

A FortiGate feature that blocks traffic to known command-and-control servers by consulting a dynamic threat database, preventing compromised internal hosts from receiving attacker instructions.

Fortinet's subscription threat-intelligence service that distributes signature, reputation, category, and vulnerability updates to licensed devices for antivirus, IPS, web filtering, and related engines.

A scored assessment that checks a device's configuration against hardening best practices, reporting failing checks in categories such as policy hygiene, logging, and authentication so administrators can remediate gaps.

The protocols and trusted source networks permitted to reach a FortiGate interface for management, such as HTTPS, SSH, and SNMP, which should be restricted to dedicated management networks.

An authentication requirement combining a password with a second factor such as a one-time token, used both for administrator logins and for end-user identity in firewall policies.

A method where the firewall validates user credentials against a directory server such as Active Directory, enabling policy decisions and logging based on user or group identity.

Fortinet Single Sign-On, which collects Windows domain logon events from agents or domain controllers and maps IP addresses to user identities so firewall policies can match users transparently.

A centralized logging and reporting platform that receives logs from Fortinet devices, stores them for retention, correlates events, and generates compliance and security reports.

A centralized management platform used to configure, deploy, and monitor many Fortinet devices through policy packages and device-level provisioning, with role-based administrative domains.

In FortiManager, a logical container that scopes which devices, policy packages, and administrators are visible to a given user, supporting delegated management across teams or customers.

A FortiManager container holding firewall policies and objects that are installed to one or more managed devices, optionally with per-device mappings and installation targets.

A FortiAnalyzer automation rule that triggers when log events match defined filters, then performs actions such as alerting, running a script, or quarantining a host.

A FortiSOAR workflow that sequences automated investigation and response steps, such as enriching indicators, querying endpoints, and opening tickets, to handle incidents consistently.

Indicator of compromise, an observable artifact such as a malicious hash, domain, or IP address that suggests an intrusion and can be used to hunt, block, or trigger automated response.

A structured stream of indicators and context from internal or external sources that is ingested by security tools to enrich alerts and block known-bad infrastructure automatically.

The configured period during which stored logs and alerts remain available for search and reporting, often driven by compliance requirements and disk capacity planning.

A standard protocol for forwarding log messages from network devices to a remote collector, commonly used to send FortiGate event and traffic logs to third-party SIEM platforms.

A protocol for polling device health metrics and receiving traps, used to monitor Fortinet devices from network management systems with read-only communities or v3 credentials.

A virtualized FortiGate instance running on a hypervisor or in a public cloud, providing the same firewall and inspection features with licensing tied to vCPU count.

Bring your own license, a cloud purchasing model where the customer supplies a license entitlement, such as a FortiFlex token, to activate a deployed virtual appliance.

A consumption-based licensing program that uses point-based tokens to activate Fortinet virtual appliances and services on demand, allowing licenses to be moved between deployments.

A configuration that authorizes a Fortinet product to join the Security Fabric, enabling it to share logs, device information, and policy coordination with the root FortiGate.

A feature that steers traffic across multiple WAN links using health checks and rules, selecting the best path per application and failing over when latency or loss exceeds thresholds.

A probe that measures latency, jitter, and packet loss toward a target for a given WAN interface, feeding SD-WAN decisions about whether a link meets the required service level.

A routing rule evaluated before the main routing table that forwards matching traffic out a specified interface or gateway, often used for SD-WAN steering or source-based routing.

The use of shared and per-IP bandwidth limits, priority queues, and application-based quotas to control how much bandwidth each class of traffic may consume.

A site-to-site or remote-access tunnel using IKE to negotiate security associations and ESP to encrypt and authenticate traffic between peers over untrusted networks.

The IKE negotiation stage that authenticates peers, agrees on encryption and hashing algorithms, and establishes the ISAKMP security association used to protect later negotiations.

The IKE stage that defines the IPsec security association parameters, including the encryption and authentication algorithms, perfect forward secrecy settings, and the source and destination subnets to protect.

A remote-access service that lets users connect through a browser-based portal or a tunnel client over TLS, supporting bookmarks, split tunneling, and per-user policy enforcement.

A Fortinet Ethernet switch that can be managed directly from a FortiGate, letting the firewall push VLAN and port configuration and apply security policy to wired clients.

A Fortinet wireless access point that is typically controlled by a FortiGate wireless controller, which manages SSIDs, VLAN assignment, and client authentication centrally.

Network address translation that rewrites source or destination addresses and ports as packets traverse the firewall, enabling private addressing and inbound service publishing.

A destination NAT object that maps an external address and port to an internal server address and port, used to publish internal services without exposing real host addresses.