Enterprise Networking
NSE 6 Enterprise Networking covers FortiGate SD-WAN, ZTNA and FortiLink integration with FortiSwitch and FortiAP. The exam tests path selection, SLA probes, access proxy policy and wired or wireless onboarding rather than basic interface configuration.
Core rules
- SD-WAN zones group WAN interfaces. SD-WAN rules select a member by source, destination, application or performance SLA; rule order matters.
- A performance SLA defines probes such as ping or HTTP and thresholds for latency, jitter and packet loss. Members that fail the SLA are marked down for rules that reference it.
- If no SD-WAN rule matches, traffic falls back to the normal routing table, so a missing rule can look like a routing problem.
- ZTNA on FortiGate uses an access proxy policy that matches source, user or group, destination and device posture tags supplied by FortiClient EMS. Tags must synchronize before policy can match.
- FortiLink lets a FortiGate manage FortiSwitch VLANs, 802.1X port settings and FortiAP profiles from one policy domain.
Worked example
Two WAN links serve a business application that needs latency below 50 ms. Create an SD-WAN zone containing both links, then a performance SLA with a ping probe to a reliable target and a 50 ms latency threshold. Add an SD-WAN rule matching the application and selecting the member with the best quality while requiring the SLA. Reasoning: if the preferred link exceeds 50 ms, the rule moves the flow to the other member. If both fail, best-quality selection still chooses the least bad link, so monitor SLA logs rather than assuming traffic stops.
Traps
Forgetting to add a WAN interface to the SD-WAN zone, so the rule cannot select it. Pointing SLA probes at an unreachable target, which marks every member down. Expecting an SD-WAN rule to override an existing policy route. Creating a ZTNA policy before EMS tags synchronize. Building a FortiLink trunk that does not allow the VLAN used by the managed FortiSwitch ports.