NSE 8 cheat sheet

Design tiers by trust boundary, not by physical location: an internal segment that hosts internet-facing services belongs in the same zone as other exposed assets, enforced by firewall policy between zones.

Session-state capacity sizing rule: concurrent sessions per firewall ≈ (peak user count × average flows per user) + (server count × expected concurrent connections per server); add 30–50% headroom for failover, since a pair in active/passive must absorb the full load after a failure.

Asymmetric routing breaks stateful inspection: if forward and return paths traverse different firewalls, either make the path symmetric or disable stateful checks on that flow via policy-based asymmetric routing exceptions.

Redundancy decision rule: two firewalls in HA protect against device failure; two ISPs with separate firewalls protect against link failure; only diverse paths with independent policy enforcement protect against both.

For segmentation, prefer many small zones with explicit allow rules over a large zone with implicit deny: the blast radius of a compromise equals the number of hosts reachable from the compromised segment, not the number of rules.

Encrypted traffic inspection design: TLS forward proxy (outbound, decrypt with enterprise CA) versus inbound decryption (requires private key on the appliance, certificate pinning breaks it); size inspection throughput at 30–50% of raw throughput because decryption and re-encryption are CPU-bound.

VPN design rule: hub-and-spoke concentrates policy but adds one-hop latency and hub bandwidth as a bottleneck; full mesh scales with n(n−1)/2 tunnels; hub-and-spoke with dynamic routing (BGP/OSPF over tunnels) is the usual compromise for large sites.

Logging architecture rule: send logs to a collector on a management segment that has no inbound path from user zones; if the firewall itself is compromised, local logs are attacker-controlled evidence.

High-availability design check: verify that HA heartbeat traffic uses a dedicated link and that a split-brain scenario fails closed (both units deny or one goes passive), never open.

Policy order matters: firewalls evaluate top-down and stop at the first match; place specific deny rules above broad allow rules, and put the implicit deny at the bottom, never in the middle.

NAT ordering: destination NAT (VIP/port forwarding) is evaluated before routing and before source NAT; source NAT is applied after the route lookup determines the egress interface. A VIP and a policy must both exist for inbound access to work.

Route precedence on FortiGate-style devices: policy routes > static routes by administrative distance > dynamic routes; connected routes win over all. A policy route silently overrides a correct static route - check it first when traffic exits the wrong interface.

Interface-based versus policy-based IPsec: interface mode binds the tunnel to a virtual interface and uses ordinary firewall policies; policy mode binds the tunnel directly to a policy. Mixing both for one peer causes phase 2 selector mismatches.

IPsec parameters that must match exactly: IKE version, encryption and hash algorithms, DH group, pre-shared key, and phase 2 selectors (local/remote subnets). Mismatched selectors produce a phase 2 failure even when phase 1 is up.

Dynamic routing over tunnels: OSPF over IPsec requires the tunnel interface to be up and the MTU reduced (typically 1400 or lower) to avoid fragmentation of large LSAs and hello packets.

VDOM or context design: separate virtual domains per tenant or per function (management, production, DMZ) isolate routing tables and policies; inter-VDOM links need explicit firewall policies - traffic does not flow between VDOMs by default.

SD-WAN rule design: application steering uses SLA probes (latency, jitter, packet loss) to choose a member link; if no member meets the SLA, traffic follows the configured fallback, which must be defined explicitly or the rule drops traffic.

Config backup hygiene: version-control configuration exports and diff before and after changes; a changed checksum on a device that received no planned change is an integrity signal.

Layered isolation: confirm L1/L2 (interface up, ARP resolves), then L3 (route exists and is selected), then policy (a matching allow rule in the correct direction), then NAT/session (session exists and is in the expected state). Stop at the first failing layer.

Session lookup first: if no session exists, the packet never matched a policy or was dropped by a route lookup; if a session exists but shows no reply, the return path, NAT translation, or the remote host is the problem.

Policy-route and asymmetric-routing symptoms: TCP handshake completes but data stalls, or the firewall logs a session with only one direction - check for policy routes and multiple default routes.

IPsec phase 1 failure causes: mismatched pre-shared key, mismatched IKE version or proposal, wrong peer ID, or UDP 500/4500 blocked. Phase 2 failure with phase 1 up almost always means selector (subnet) mismatch.

NAT troubleshooting: verify the translated address in the session table, not just the policy; a VIP that points to a host with the wrong default gateway produces inbound success and outbound failure.

MTU and fragmentation: large packets failing while ping succeeds indicates an MTU issue along a tunnel; test with DF-set pings of decreasing size to find the path MTU, then clamp TCP MSS.

DNS and certificate failures masquerade as connectivity failures: verify the client resolves the correct address and that the certificate chain validates to a trusted root, including intermediate certificates.

Log correlation: compare firewall traffic logs, event logs, and the remote device's logs by timestamp and source port; a session accepted at the firewall but refused by the server appears as an allow plus a reset.

Change-related regression: if the failure started after a change, diff the running configuration against the last known-good backup before chasing packet-level causes; most complex-network outages are configuration regressions.

Zone count heuristic: one zone per distinct trust level and per regulatory scope; merge zones only when the same policy applies to every host in them.

Throughput planning: published firewall throughput is measured with large packets and no inspection; apply realistic figures of roughly 30–50% of that value for UTM/TLS-inspected traffic.

East-west traffic: internal segmentation firewalls must be sized for inter-server flows, which usually exceed north-south internet flows in data centers.

Out-of-band management: management interfaces belong on a dedicated segment reachable only from jump hosts, with authentication logged to an external collector.

Failover design: active/passive preserves session state on failover; active/active does not preserve state for all flows unless session synchronization is explicitly configured and verified.

Encrypted DNS and outbound filtering: if DNS is allowed to arbitrary resolvers, domain-based policy is bypassable; force internal resolvers via policy and block direct external DNS.

Firewall policy match keys: source interface, source address, destination interface, destination address, service, and schedule; all must match for the rule to apply.

Static route selection: longest prefix match wins; among equal prefixes, lowest administrative distance wins; among equal distance, lowest metric wins.

IPsec phase 1 (IKE) negotiates the management tunnel; phase 2 (IPsec SA) negotiates data selectors. Both must complete before traffic flows.

OSPF neighbor failure causes: mismatched area ID, mismatched hello/dead timers, mismatched authentication, or MTU mismatch (large DBD packets dropped).

SD-WAN SLA probes must target reachable destinations; a probe pointed at an unreachable address marks every member as failing and forces the fallback path.

VDOM/tenant isolation: inter-VDOM traffic requires a link plus a policy; without both, the traffic is dropped silently with no session created.

No session created: check policy match (interface, address, service), then route lookup; a missing return route commonly prevents session creation.

Session created, no reply: check NAT translation, return route on the server, and any intermediate firewall on the return path.

Phase 1 up, phase 2 down: selector mismatch or a duplicate phase 2 with overlapping subnets.

Intermittent large-packet failure: MTU/MSS issue on a tunneled path; clamp MSS and retest with DF-set pings.

Inbound works, outbound fails: server default gateway points at the wrong device or NAT is applied only in one direction.

Logs show allow but user reports failure: inspect server-side logs and certificate chain; the firewall is not the failing element.

After a change, behavior differs on one HA member only: configuration is out of sync between the pair; check HA synchronization status before deeper diagnosis.