I85PREP
⌘ K
Fortinet NSE 6 study materials
Fortinet NSE 6 study resources

Fortinet NSE 6: Cloud Security

Fortinet NSE 6 · Work through your exam, one topic at a time.

All guide sections

Cloud Security

NSE 6 Cloud Security tests deploying and operating Fortinet solutions in public cloud: FortiGate-VM in AWS and Azure, licensing, SDN connectors, high availability and cloud-native networking constraints. The emphasis is on what changes when a FortiGate runs as a VM in a VPC or VNet.

Core rules

  • FortiGate-VM licensing is either BYOL, where a license is applied to the VM, or PAYG from the cloud marketplace, where entitlement follows the instance and billing model. Plan for re-licensing when replacing BYOL instances.
  • In AWS, an ENI used for routing or NAT must have source/destination check disabled; otherwise AWS drops packets not addressed to that ENI. Security groups must allow management, HA heartbeat and data traffic.
  • In Azure, enable IP forwarding on the FortiGate NICs and use user-defined routes so subnets send traffic to the FortiGate private IP. NSG rules must permit the same flows.
  • SDN connectors create dynamic address objects from AWS or Azure tags and metadata, which is useful for autoscaling and for policies that follow instances.
  • FGCP HA in public cloud depends on cloud API calls to move elastic IPs or update load balancer backends; the data path alone does not move the public address.

Worked example

In AWS, a FortiGate-VM sits in a public subnet with an elastic IP on port1. A private subnet route table sends 0.0.0.0/0 to the FortiGate port2 ENI. Outbound internet access requires NAT. Configure a policy from the private subnet to the internet with NAT enabled to the port1 address, and disable source/destination check on port2. Reasoning: the private subnet route points at the ENI, so packets arrive at port2 with a destination that is not the ENI address; AWS must allow that. Return traffic is translated by the FortiGate and exits port1 through the elastic IP.

Traps

Leaving source/destination check enabled on a NAT ENI. Security groups that block HA heartbeat traffic. Assuming an Azure public IP follows a failed-over VM without API integration. Using overlapping VPC or VNet address ranges that break routing. Treating an SDN dynamic object as a static address when tags change.