I85PREP
⌘ K
Fortinet NSE 6 study materials
Fortinet NSE 6 study resources

Fortinet NSE 6: Network Security

Fortinet NSE 6 · Work through your exam, one topic at a time.

All guide sections

Network Security

NSE 6 Network Security examines FortiGate policy and packet flow on FortiOS: interface roles, firewall policies, NAT, routing, VDOMs and inline security profiles. Questions usually give a topology and ask which policy matches, how address translation occurs, or why traffic is dropped.

Core rules

  • Firewall policies are evaluated top-down; the first matching policy is applied. The implicit deny at the bottom drops unmatched traffic.
  • Inbound DNAT uses a virtual IP (VIP): the policy destination is the VIP object, not the real server address. The VIP maps an external IP/port to an internal IP/port.
  • Outbound SNAT can be configured in the policy (enable NAT and choose an IP pool) or in a central SNAT policy. Central SNAT is evaluated as its own rule set; when it matches, it controls translation.
  • Security profiles (AV, IPS, web filter, application control, SSL inspection) are attached to a policy and inspect only traffic accepted by that policy. SSL inspection profiles decide which certificates are inspected or exempted.
  • VDOMs split the FortiGate into independent virtual devices; inter-VDOM links carry traffic between them and still require policies.

Worked example

A FortiGate has WAN 203.0.113.2 and LAN 10.0.1.0/24. Users need internet access with NAT, and an internal web server 10.0.1.10:443 must be reachable at 203.0.113.10:443.

  1. Create VIP web-vip: external 203.0.113.10, mapped 10.0.1.10, port 443.
  2. Policy 1: LAN to WAN, source 10.0.1.0/24, destination all, service ALL, NAT enabled with an overload pool or outgoing interface address.
  3. Policy 2: WAN to LAN, destination web-vip, service HTTPS, no NAT, security profile attached. Reasoning: policy 1 must not sit above a more specific outbound policy if exceptions exist; policy 2 uses the VIP as destination so the FortiGate performs DNAT before forwarding. If the VIP does not answer, check that it is bound to the correct external interface and that ARP replies are enabled where needed.

Traps

A broad LAN-to-WAN any policy above a specific policy shadows it. Using service ALL when the VIP maps a single port causes a mismatch. Asymmetric routing across two ISPs breaks stateful inspection and NAT. Forgetting that SSL inspection exemptions bypass content inspection. Placing the real server address, not the VIP, in the inbound policy.