Fortinet NSE 6 study plan
Fortinet NSE 6 · Give each week a clear focus.
8 weeks · About 7 hours per week
Network Security
Diagram the FortiGate packet flow from ingress to egress, labeling each inspection stage (ACL, DoS policy, session helper, IPsec, firewall policy, UTM, routing).
Configure and verify firewall policies with NAT (SNAT and DNAT/VIP) in a lab, confirming behavior with packet captures and session tables.
Explain FortiOS session state and session table fields, then troubleshoot three deliberately broken policy scenarios using diagnose commands.
Compare stateful inspection, proxy-based inspection, and flow-based inspection modes and identify when each is appropriate.
Your checkpoint
A one-page packet-flow diagram plus a lab log documenting three policy/NAT troubleshooting cases with the exact diagnose commands and observed output.
Network Security
Configure and test security profiles (AV, IPS, web filter, application control, DNS filter) in flow and proxy modes, noting detection differences.
Build a custom IPS sensor and custom application control signature, then validate they trigger using safe test traffic.
Configure SSL/TLS deep inspection with a certificate, deploy the CA to a test client, and verify exemption handling for pinned applications.
Design and test a DoS policy and a local-in policy that protects the FortiGate management plane.
Your checkpoint
A security-profile test matrix showing each profile, its mode, a triggering sample, and the log entry proving detection.
Security Operations
Configure log forwarding from FortiGate to FortiAnalyzer, then build and run three event-handler detections.
Correlate a multi-stage simulated incident (recon, exploit attempt, lateral movement) across logs and produce a timeline.
Create an automation stitch that triggers on a specific log event and performs a response action such as quarantining an address.
Map Fortinet logging and detection capabilities to MITRE ATT&CK tactics and identify coverage gaps.
Your checkpoint
An incident report for the simulated attack containing the correlated timeline, the automation stitch configuration, and a coverage-gap list.
Security Operations
Configure FortiSIEM or FortiSOAR (or the available SOC tooling) to ingest FortiGate and endpoint telemetry and build a playbook.
Write detection rules for three distinct attack techniques and tune them to reduce false positives.
Practice threat hunting: form a hypothesis, query telemetry, and document findings with evidence.
Define incident severity, escalation, and containment procedures aligned to a chosen framework.
Your checkpoint
A tuned detection pack of three rules with before/after false-positive counts and a written threat-hunt report.
Cloud Security
Deploy a FortiGate VM in a public cloud (or simulated environment), configure it as a gateway, and validate east-west and north-south traffic flows.
Explain and configure cloud-native constructs relevant to Fortinet deployments: VPC/VNet, security groups, routing tables, and IAM roles.
Configure FortiManager or FortiCloud central management for the cloud instance and push a policy change.
Compare native cloud firewalls with FortiGate VM and articulate when each is appropriate.
Your checkpoint
A cloud deployment runbook documenting the architecture, IAM and network configuration, and verification test results.
Cloud Security & Enterprise Networking
Configure site-to-site IPsec VPN between two FortiGates and a remote-access VPN, then verify with tunnel and route diagnostics.
Implement SD-WAN with two WAN links, define SLA probes and rules, and test failover and load balancing.
Integrate cloud-delivered security (SASE/SWG or CASB) with on-premises policy and document the traffic path.
Compare hub-and-spoke, full-mesh, and ADVPN topologies and select one for a stated business requirement.
Your checkpoint
A network design document with the chosen VPN and SD-WAN topology, configuration excerpts, and failover test evidence.
Enterprise Networking
Configure and verify routing (static, OSPF, BGP) between FortiGate and a neighboring device, including redistribution and route filtering.
Deploy high availability (active-passive and active-active) and test failover, session synchronization, and split-brain prevention.
Configure VLANs, virtual domains (VDOMs), and inter-VDOM routing to segment a multi-tenant environment.
Troubleshoot three routing or HA failure scenarios using debug and diagnose commands.
Your checkpoint
An HA and routing lab report with failover timing measurements, routing tables, and troubleshooting notes.
Network Security & Security Operations & Cloud Security & Enterprise Networking
Take two full-length timed practice exams and score each domain separately to identify weak areas.
Review and remediate every missed objective from the practice exams with targeted lab or reading work.
Rebuild a condensed one-page reference for each domain from memory, then correct it against source material.
Run a final mixed lab that combines security profiles, logging, cloud connectivity, and HA in a single scenario.
Your checkpoint
A scored practice-exam report with per-domain results, a remediation log, and four corrected one-page domain references.
Milestones
Week 2: Can configure, verify, and troubleshoot firewall policy, NAT, and all major security profiles without reference notes, evidenced by the completed test matrix.
Week 4: Can detect, correlate, and respond to a simulated incident end-to-end and explain the detection logic and tuning decisions.
Week 6: Can deploy FortiGate in a cloud environment and establish secure connectivity between sites, with documented verification evidence.
Week 8: Scores at or above 80 percent in every domain on a timed practice exam and has closed all remediation items logged in week 8.