Fortinet NSE 7 key terms

A virtual domain is a self-contained FortiGate instance inside one physical appliance, with its own interfaces, routing table, firewall policies, administrators, and VPN settings. VDOMs let a single device serve multiple departments or customers with fully isolated configurations.

A rule that overrides the destination-based routing table for matching traffic by sending it out a chosen interface and next hop. It is commonly used for source-based routing, SD-WAN steering, and forcing traffic through a specific gateway.

A manually configured entry that maps a destination network to a next-hop gateway or outgoing interface. Each static route carries an administrative distance and priority so the FortiGate can pick between competing candidates.

A trust ranking that tells the FortiGate which source to prefer when several routing protocols offer a path to the same destination. Lower values win, so connected routes beat static routes, which typically beat learned routes.

A FortiOS feature that bundles multiple WAN links and steers traffic across them using health measurements and rules. It delivers failover and load balancing for traffic matched by ordinary firewall policies.

A probe such as ICMP, HTTP, or DNS that SD-WAN and link monitoring use to measure latency, jitter, and packet loss on a member link. When thresholds are violated the link is marked down and traffic shifts elsewhere.

An anti-spoofing mechanism where the FortiGate confirms that a packet's source address is reachable through the interface where the packet arrived. Strict and loose modes exist; a failed check causes the packet to be dropped.

An exterior gateway protocol that exchanges routes between autonomous systems and between FortiGates acting as routers. FortiOS supports neighbors, prefix lists, and route maps for dynamic WAN and multi-path routing.

A destination NAT object that maps a public address and port to an internal server's private address and port. Firewall policies reference the VIP to permit inbound connections and apply the translation.

A defined range or block of addresses used for source NAT. When a policy references the pool, the FortiGate rewrites the client's source address to an address from that pool before forwarding the session.

A NAT mode in which source translation is defined once in a table of rules matched on source, destination, and service, rather than inside each firewall policy. It simplifies environments with many overlapping NAT requirements.

The core rule object that permits or denies traffic between interfaces or zones, matching source, destination, service, user, and schedule. It also binds security profiles, NAT behavior, and logging options to the flow.

The default outcome at the end of policy evaluation: any session that matches no explicit policy is dropped. Administrators must therefore add a permit for every flow they intend to allow.

Fortinet Single Sign-On gathers directory logon events through collector agents and maps active user names to IP addresses. Firewall policies can then match on user identity without prompting users for credentials again.

A web page that intercepts unauthenticated HTTP or HTTPS requests and requires the user to sign in or accept terms before access is granted. FortiOS uses it for firewall user and SSL VPN authentication.

An AAA protocol in which the FortiGate forwards user credentials to an external server and receives an accept or reject plus returned attributes. It is widely used for administrator login, firewall authentication, and VPN users.

A directory access protocol used to query users and groups held in services such as Active Directory. FortiOS binds to the server to validate credentials and to import group membership for use in policies.

Requiring two independent proofs of identity, such as a password combined with a one-time code from FortiToken or email. FortiOS can apply it to administrator logins, authenticated firewall users, and VPN users.

The IKE negotiation that authenticates the two peers and builds a protected channel for later negotiations. It agrees on encryption, hashing, Diffie-Hellman group, and pre-shared key or certificate authentication, and identifies the remote gateway.

The definition of the actual data tunnel, specifying local and remote subnets, protocol, perfect forward secrecy, and proposals. Each phase 2 produces a pair of IPsec security associations for the traffic it matches.

A site-to-site IPsec setup where the hub does not know the spokes' addresses in advance. Spokes initiate the tunnel and the hub identifies them by peer ID or certificate, which is the basis for ADVPN deployments.

Auto-Discovery VPN lets spokes learn other spokes' public addresses from the hub and then build direct shortcut tunnels between sites. The hub keeps the control tunnel while data flows peer to peer.

An IPsec tunnel configured as a virtual interface, with routing entries directing traffic into it instead of relying on tunnel selectors in the policy. It supports dynamic routing and multiple subnets over a single tunnel.

A keepalive mechanism that periodically probes the IPsec peer to confirm it is still reachable. When probes fail, FortiOS tears down the tunnel and can renegotiate or switch to another path.

Encapsulating IPsec ESP packets inside UDP port 4500 so they can cross NAT devices that would otherwise drop them. It also allows several clients behind one NAT address to share a gateway.

A client-based SSL VPN in which FortiClient creates a virtual adapter and routes traffic to protected subnets. It differs from agentless web mode, which only proxies bookmarked web applications.

A VPN setting that sends only traffic destined for specified private subnets through the tunnel while all other traffic goes directly to the internet. It reduces load on the VPN gateway and latency for users.

A security profile that scans files and supported protocols for malware using signatures and heuristic engines. Options control whether threats are blocked or only logged, and whether infected files are quarantined.

A profile that inspects traffic against signature and anomaly rules to detect and block exploits, with per-rule severity and action tuning. It can also apply rate-based detection and botnet connection blocking.

A profile that classifies websites using FortiGuard categories and applies allow, block, or monitor actions per category. It can also enforce URL patterns, safe search, and content-type restrictions.

A profile that identifies applications from their network behavior and signatures rather than by port, then permits, blocks, or shapes them by category or individual application.

An SSL and SSH inspection profile that decrypts encrypted traffic so other security profiles can scan its contents. The FortiGate re-signs traffic with its own certificate authority, and pinned or sensitive sites often need exemptions.

Data loss prevention inspects content, file types, and patterns such as credit card or identity numbers against rules, then blocks or logs the transfer. It applies to web, email, and file-sharing protocols.

Fortinet's subscription service that distributes signatures, URL categories, and reputation data to FortiGate devices. It feeds antivirus, IPS, web filtering, application control, and other inspection engines.

FortiGate Cluster Protocol is Fortinet's proprietary high availability protocol. It synchronizes configuration and sessions between members and elects the primary using priority, monitored interfaces, and uptime.

A cluster mode in which one FortiGate processes all traffic while the remaining members stand by ready to take over. Sessions are synchronized continuously so a failover preserves established connections.

A cluster mode in which all members process traffic, with sessions distributed across the cluster by load balancing. It can raise aggregate throughput but requires careful session synchronization and switch configuration.

The HA feature that copies session tables, and optionally NAT and routing state, between cluster members. Because state is shared, existing connections continue to work after a primary failure.