Fortinet NSE 7 cheat sheet

Route selection order: longest prefix match, then lowest administrative distance, then lowest priority, then lowest gateway metric.

Default administrative distances: connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200; set distance overrides the default per route.

Static route priority (default 0) only breaks ties between routes to the same destination with equal distance, and determines ECMP member eligibility.

Policy routes are evaluated before the FIB; a matching policy route overrides the routing-table lookup for that traffic as long as its gateway is reachable.

strict-src-check is enabled by default and validates the return path of a packet's source; disabling it permits asymmetric routing at the cost of anti-spoofing.

Interface types: physical, VLAN subinterface, aggregate/LACP, software switch, zone, loopback, IPsec tunnel, and VXLAN.

Supported dynamic routing protocols: BGP, OSPFv2/v3, RIP, IS-IS, and PIM for multicast; multi-VRF is available on recent FortiOS builds.

Verification commands: get router info routing-table all for the active FIB and get system arp for the ARP table.

Policies are evaluated top-down and the first match wins; the policy ID/sequence number defines that order.

Match criteria are ingress interface, egress interface, source address, destination address, schedule, service, and user or user group.

The implicit deny drops unmatched traffic and does not log it unless a logging-enabled deny policy is placed above it.

NAT is a per-policy attribute (set nat enable) that translates to the outgoing interface address or to a referenced IP pool.

Security profiles are attached per policy: antivirus, IPS, web filter, application control, DNS filter, DLP, email filter, and SSL/SSH inspection.

Policy action is accept, deny, or ipsec; the ipsec action turns the policy into a policy-based VPN.

Local-in policies govern traffic destined to the FortiGate itself (admin, VPN, routing protocols) and are independent of forwarding policies.

diagnose firewall iprope lookup traces which policy a packet tuple matches, and show firewall policy lists policies in evaluation order.

Policy NAT: enable set nat on the firewall policy; the source is translated to the outgoing interface address or to a pool.

Central NAT: enable set central-nat in system settings, define config firewall central-snat-map, and reference the map from policies.

Destination NAT uses a VIP (config firewall vip) as the policy destination with NAT enabled; VIP types include static NAT and port forwarding.

set arp-reply enable on a VIP makes the FortiGate answer ARP requests for the external VIP address.

IP pool types: overload (PAT), one-to-one, fixed port range, and port block allocation; set preserve-source-port keeps the original source port.

Hairpin NAT requires policies for both the client-to-VIP leg and the translated internal leg; using an IP pool avoids rewriting the source to the VIP address.

Supported authentication servers: local, LDAP, RADIUS, TACACS+, PKI certificate, FSSO, RSSO, and SAML.

FSSO methods: DC agent, collector agent (with or without DC agent), polling of domain controllers, and syslog-based collectors.

Authentication can be active (captive portal or browser challenge) or passive (identity derived from FSSO or RSSO logon events).

Phase 1 defines IKE version, mode, PSK or certificate, Diffie-Hellman group, and proposals; both peers must share at least one proposal.

Phase 2 defines the traffic selectors, PFS, replay protection, and autokey keepalive; route-based VPNs use 0.0.0.0/0 selectors.

Ports and protocols: IKE on UDP 500, NAT-T on UDP 4500, ESP as IP protocol 50, AH as protocol 51.

Route-based VPN requires a tunnel interface (set type tunnel), a route pointing into it, and a policy whose egress interface is the tunnel.

DPD modes are disabled, on-idle (probe only while traffic is sent), and on-demand (probe whenever traffic is sent); retry counters determine teardown timing.

SSL VPN requires a source interface, a portal, authentication, and either web mode or tunnel mode with tunnel-ip-pools.

Split tunneling uses routing-address objects to define which destinations are sent through the SSL VPN tunnel.

ADVPN builds on IPsec with shortcut tunnels for spoke-to-spoke traffic, negotiated via IKE and directed by BGP or OSPF.

Verification commands: diagnose vpn ike gateway list for phase 1 state and diagnose vpn tunnel list for phase 2 state.

Inspection modes: flow-based streams packets with low latency; proxy-based buffers the session and enables DLP, content disarm, and full SSL decryption.

SSL inspection modes: certificate inspection reads only the CN/SNI, while deep inspection performs full MITM using a Fortinet CA certificate installed on clients.

IPS sensors combine signature entries, severity and category filters, protocol decoders, and rate-based anomalies; per-signature actions are pass, block, or monitor.

Web filter actions are allow, monitor, block, warning, and authenticate; local categories and per-URL overrides take precedence over FortiGuard ratings.

Application control uses FortiGuard signatures and ISDB entries to identify applications by behavior, independent of TCP/UDP port.

Protocol options profiles define which ports for HTTP, HTTPS, FTP, SMTP, IMAP, POP3, and CIFS are scanned by content profiles.

Antivirus scan modes are proxy, flow, and sandbox (FortiSandbox) for suspicious or unknown files.

A profile only takes effect when attached to an accepting firewall policy; traffic matched to a policy without profiles is not scanned.

FGCP HA modes are active-passive and active-active; the primary is elected by highest priority, then longest uptime, then lowest serial number.

Heartbeat devices are set with set hbdev "port1" 50 "port2" 50; interfaces in monitor-interface cause failover when they go down.

Session pickup synchronizes session and NAT tables to the backup unit, allowing established connections to survive a failover without being reset.

Most configuration is synchronized to the backup, but per-unit settings such as hostname, HA priority, and dedicated management IP are not.

set override lets a unit that recovers reclaim the primary role instead of staying secondary.

FGCP assigns virtual MAC addresses per physical interface; set virtual-mac disable reverts to physical MACs if the upstream switch objects.

Out-of-band HA management uses ha-mgmt-status and ha-mgmt-interfaces to give each unit a separate management IP.

Config management: execute backup config and execute restore config, plus revision history and scheduled config system auto-script.

Logging and monitoring options: syslog, FortiAnalyzer, SNMP; admin access is restricted by admin profiles and trusted hosts.