Fortinet NSE 7 flashcards

32 cards. Read the term and the definition here. The deck at the top of this page is optional.

Longest prefix match

FortiGate selects the route with the most specific prefix matching the destination; only when prefixes tie do administrative distance and then priority decide the winner.

Default administrative distances

Connected 0, static 10, eBGP 20, OSPF 110, RIP 120, iBGP 200. A lower distance wins when identical prefixes are learned from different sources.

Policy route precedence

Policy routes are checked before the routing table; a matching policy route forwards the packet and bypasses the FIB lookup unless its configured gateway is unreachable.

Static route priority field

Priority is a tiebreaker used only among routes to the same destination with equal distance; a lower priority value is preferred during route selection and ECMP.

Strict source check

Enabled by default, FortiOS verifies the return path for a packet's source address; disabling it allows asymmetric routing but weakens anti-spoofing protection.

VLAN subinterface

Created on a physical or aggregate interface with a VLAN ID tag; the parent interface carries no IP address for that VLAN, and the subinterface holds the gateway IP.

Firewall policy evaluation order

Policies are matched top-down and the first match wins; the session inherits that policy's profiles, NAT, and logging settings, while unmatched traffic hits the implicit deny.

Local-in policy purpose

Controls traffic destined to the FortiGate itself, including admin, VPN, and routing protocol access; it does not apply to transit traffic, which forwarding policies handle.

Policy lookup diagnostic

The diagnose firewall iprope lookup command shows which policy a given interface, source, destination, and port tuple matches, exposing shadowed or missing policies.

Policy NAT toggle

NAT is enabled per policy; the session source is translated to the outgoing interface address by default, or to an address drawn from a referenced IP pool.

Implicit deny logging

If no policy matches, the implicit deny drops the packet and logs nothing unless a deny policy with logging enabled is placed above it in the sequence.

Central NAT versus policy NAT

Central NAT uses a central-snat-map object referenced by policies with richer matching; policy NAT instead configures source translation directly inside each individual firewall policy.

Virtual IP port forwarding

A VIP maps an external address and port to an internal host and port; it is used as the policy destination with NAT enabled to perform destination translation.

Hairpin NAT

Lets internal clients reach an internal server through its external VIP address; it requires policies covering the inbound and translated legs, usually with an IP pool.

FSSO polling mode

In polling mode the FortiGate periodically queries domain controllers for logon events without installing an agent, so user detection lags slightly behind agent-based methods.

Firewall authentication types

Local, LDAP, RADIUS, TACACS+, PKI certificate, FSSO, RSSO, and SAML are supported; the resulting user identity can be matched in policies and written to logs.

Passive versus active authentication

Passive authentication derives identity from detected logon events such as FSSO or RSSO; active authentication prompts the user, typically with a captive portal or browser challenge.

IPsec phase 1 proposals

Phase 1 proposals define the IKE encryption, hash, and Diffie-Hellman group used to build the ISAKMP SA; both peers must share at least one matching proposal.

IPsec phase 2 selectors

Phase 2 SAs are defined by local and remote subnet selectors plus PFS; in route-based VPNs the selectors are 0.0.0.0/0 and the routing table decides what is tunneled.

Route-based versus policy-based VPN

Route-based VPNs use a tunnel interface with routes directing traffic into it; policy-based VPNs select the tunnel as an action in a firewall policy with matching address pairs.

VPN ports and protocols

IKE uses UDP 500 and native ESP uses IP protocol 50; when NAT is detected, both are encapsulated in UDP 4500 so intervening NAT devices can translate the flow.

DPD modes

Dead peer detection may be disabled, on-idle (probe only while traffic is sent), or on-demand (probe whenever traffic is sent); a missed probe tears down the tunnel.

SSL VPN tunnel mode

Tunnel mode gives the client a network-layer tunnel with an address from a tunnel-ip-pool; split tunneling decides which destinations use the tunnel versus the local network.

Certificate versus deep inspection

Certificate inspection reads only the server certificate CN or SNI and is lightweight; deep inspection proxies the session with a Fortinet CA-signed certificate to scan encrypted content.

Flow-based versus proxy inspection

Flow-based inspection scans packets as they stream with lower latency; proxy-based inspection buffers the session, enabling DLP, content disarm, and full SSL decryption.

IPS sensor components

An IPS sensor binds signature entries, severity and category filters, protocol decoders, and rate-based anomalies, with per-signature actions of pass, block, or monitor.

Web filter rating override

A specific URL or domain can be assigned a local category or an overridden rating; that entry takes precedence over the FortiGuard rating for that object.

Application control signatures

Application control matches FortiGuard application signatures and ISDB entries by application, category, or technology, so traffic is identified regardless of the port used.

HA priority and override

The unit with the highest configured HA priority becomes primary; when override is enabled, a recovered unit reclaims the primary role instead of remaining secondary.

HA monitored interfaces

Interfaces listed in monitor-interface are health-checked; when one fails, the unit's effective priority drops and the cluster fails over to the other member.

HA session pickup

With session pickup enabled, the primary synchronizes session and NAT state to the backup, so established connections survive a failover without being reset.

HA virtual MAC addresses

FGCP assigns a virtual MAC address per physical interface so neighboring switches and peers keep a stable next hop when the primary unit changes.