Fortinet NSE 7 study plan
Fortinet NSE 7 · Give each week a clear focus.
8 weeks · About 7 hours per week
Routing and FortiOS networking
Diagram FortiOS packet flow from ingress interface through policy lookup to egress
Configure and verify static routes, policy routes, and ECMP paths in a lab
Compare transparent, NAT, and route-mode deployments and select the correct mode for a scenario
Diagnose asymmetric routing and reverse-path forwarding behavior using debug and sniffer output
Your checkpoint
A one-page packet-flow diagram plus a routing lab log showing five test paths with expected and observed next-hop decisions, scoring at least 8/10 on a self-written routing quiz
Routing and FortiOS networking & Firewall policy, NAT, and authentication
Configure interface-based and zone-based policies with correct service and schedule objects
Build firewall policy ordering exercises that resolve shadowed and overlapping rules
Implement central NAT and per-policy NAT with VIPs and IP pools
Verify session tables and policy hit counters after each change
Your checkpoint
A 12-policy lab configuration with a rule-order audit table identifying every shadowed rule and a packet capture proving NAT translation for three flows
Firewall policy, NAT, and authentication
Configure local, LDAP, and RADIUS authentication for firewall and administrative access
Design multi-factor authentication flows using FortiToken and certificate-based admin login
Apply authentication timeout, captive portal, and disclaimer settings to a guest policy
Troubleshoot failed user authentication using event logs and debug commands
Your checkpoint
An authentication lab report documenting successful and failed logins for local, LDAP, RADIUS, and token methods, with log excerpts and a corrected misconfiguration
VPN (IPsec and SSL)
Configure route-based and policy-based IPsec tunnels with matching phase 1 and phase 2 settings
Select encryption, hashing, and DH groups that satisfy a stated security baseline
Bring up an IPsec tunnel, verify SAs, and capture successful phase 1 and phase 2 negotiation
Diagnose a tunnel that fails due to mismatched proposals or proxy IDs
Your checkpoint
Two working IPsec tunnels between lab devices with a troubleshooting matrix covering five deliberate failure modes and their log signatures
VPN (IPsec and SSL)
Deploy SSL VPN in tunnel and web modes with realm and portal assignments
Configure split tunneling, split DNS, and route overlap handling for SSL VPN clients
Apply host-check and authentication policy to SSL VPN access
Test failover between IPsec and SSL VPN paths for a remote-access scenario
Your checkpoint
An SSL VPN lab with two portals, one host-check policy, and a test matrix showing successful and denied client connections with supporting logs
Security profiles and content inspection
Configure antivirus, IPS, web filtering, and application control profiles and attach them to policies
Tune IPS signatures to reduce false positives while preserving detection coverage
Configure SSL inspection with certificate exceptions and verify decrypted traffic inspection
Validate content inspection using benign test files and controlled signature triggers
Your checkpoint
A security-profile lab report showing profile inspection results for five traffic types, including before-and-after IPS tuning metrics and an SSL inspection exception list
High availability and system management
Configure FGCP active-passive high availability with heartbeat and session synchronization
Test failover by disconnecting monitored interfaces and verify session preservation
Configure backup, restore, and configuration revision practices for system management
Set up SNMP, syslog, and alert email for operational monitoring
Your checkpoint
An HA failover test log recording failover time, synchronized session counts, and post-failover connectivity results, plus a verified configuration backup and restore
Routing and FortiOS networking & Firewall policy, NAT, and authentication & VPN (IPsec and SSL) & Security profiles and content inspection & High availability and system management
Integrate routing, NAT, VPN, security profiles, and HA into a single end-to-end lab topology
Trace a remote SSL VPN user and an IPsec site-to-site flow through all inspection stages
Resolve at least ten mixed-domain troubleshooting scenarios under time pressure
Review weak areas using lab logs and rebuild the three most-missed configurations
Your checkpoint
A complete integrated lab with documented end-to-end flows, a 20-question mixed-domain self-test scored at 85% or higher, and a written remediation list for missed items
Milestones
Week 2: Can explain and demonstrate FortiOS packet flow, static and policy routing, and correct NAT selection without notes in a live lab
Week 4: Brings up an IPsec tunnel from scratch and diagnoses proposal mismatch and proxy-ID failures using logs alone
Week 6: Passes a self-authored 25-question quiz covering routing, policy, NAT, authentication, VPN, and content inspection at 80% or higher
Week 8: Completes the integrated lab and 20-question mixed-domain self-test at 85% or higher, with every missed item mapped to a rebuilt lab configuration