NSE 8 key terms

An integrated architecture in which firewalls, switches, access points, endpoints, and cloud services share telemetry and enforce coordinated policy, allowing one console to see and act on the whole estate.

A logical link between two fabric members that authorizes telemetry and policy exchange, configured with a name, an interface pair, and optional encryption so devices trust each other's identity.

A management and data protocol that lets a FortiGate act as the controller of compatible FortiSwitch and FortiAP devices, pushing VLANs, policies, and firmware from the firewall instead of per-device management.

A FortiSwitch authorized to a FortiGate over FortiLink, appearing as a controllable unit whose ports map to firewall VLAN interfaces and whose configuration is driven by the controller.

The control and provisioning protocol wireless access points use to discover a controller, exchange configuration, and tunnel client traffic, carried over UDP ports 5246 and 5247.

A partitioned, independent configuration and routing instance inside one physical firewall, giving separate administrators, policies, and interfaces to different tenants or functions on shared hardware.

A virtual point-to-point pair of interfaces connecting two VDOMs, allowing traffic to pass between them under firewall policy just as if two separate appliances were cabled together.

A named grouping of interfaces that share one policy and one set of inspection settings, simplifying rule sets when many ports or tunnels serve the same trust level.

An ordered rule matching source, destination, service, user, and schedule that decides whether traffic is denied or allowed and which inspection profiles and logging apply.

A rule evaluated before the routing table that forwards matching traffic out a chosen interface and next hop, commonly used for source-based routing, VDOM steering, or service chaining.

The forwarding database the device consults to choose an outgoing interface and gateway for a destination prefix, populated by connected, static, and dynamic routing protocols.

A routing behavior that installs several next hops for one destination and load-balances sessions across them, improving bandwidth and redundancy but requiring consistent inspection state.

A condition where the return path of a session differs from its forward path, which can break stateful inspection and cause drops unless the device synchronizes sessions or is placed to see both directions.

The in-memory record of active flows holding source and destination, sequence state, applied policy, and inspection results, used to forward packets and to diagnose connectivity problems.

Code that inspects a control channel and opens related dynamic data ports for protocols such as FTP or SIP, needed because those protocols negotiate ports the policy cannot predict.

Translation between IPv4 and IPv6 addresses at a firewall boundary, letting hosts of one address family reach services of the other while preserving stateful session tracking.

A NAT model where translation rules are defined once in a dedicated table and referenced by IP pools, rather than embedded in individual security policies, easing large rule-set maintenance.

A named range of addresses used as translation sources or destinations by NAT, with options for overloading, fixed port ranges, and address pairing behavior.

Translation that lets an internal client reach an internal server through the server's public address, requiring the firewall to translate and then re-route the flow back inside.

An encrypted tunnel negotiated in two phases, where phase 1 protects the management channel and phase 2 protects data, commonly used to connect sites or remote users over untrusted networks.

An IPsec design where the tunnel is bound to a virtual interface and routes direct traffic into it, enabling dynamic routing, multiple subnets, and simpler policy than policy-based tunnels.

A hub-and-spoke design where remote peers initiate tunnels to a central gateway, requiring the hub to authenticate many clients and manage overlapping client subnets.

A keepalive mechanism that probes an IPsec peer and tears down or renegotiates the tunnel when replies stop, preventing traffic from black-holing into a dead tunnel.

A policy layer that steers traffic across multiple WAN links based on measured latency, jitter, and loss, with per-application rules and health checks instead of static routing alone.

A probe that measures delay, jitter, and packet loss toward a target over a specific WAN link, feeding SD-WAN rules that decide when to prefer or abandon that link.

A cluster of firewalls sharing addresses, sessions, and configuration so that a failure of one member is transparent to traffic, configured as active-passive or active-active.

The dedicated link and protocol over which cluster members exchange hello, configuration, and state messages, whose loss triggers failover or split-brain handling.

The continuous copying of session and NAT state between HA members so that established flows survive a failover without requiring clients to reconnect.

A shared hardware address owned by the active HA member and moved on failover, allowing upstream devices to keep sending traffic to the same layer-2 destination.

An unsolicited address announcement sent after a failover or address move so that switches and routers relearn which port now owns the gateway address.

A scored audit that checks configuration against hardening best practices, such as weak admin settings, missing logging, or permissive policies, and reports prioritized remediation items.

A reusable set of permissions controlling which administrators may view or change which parts of the configuration, and from which trusted hosts and protocols they may log in.

A single rule that covers traffic formerly split across many overlapping rules, reducing rule count and lookup cost while preserving intended allow and deny behavior.

Inspection that identifies applications by signature regardless of port and enforces allow, block, or monitor actions, catching traffic that evades port-based rules.

Streaming of summarized connection records to an external collector, giving visibility into traffic volume and top talkers without storing full packet captures on the device.

Recording of raw packets on a chosen interface or matching a filter, used to prove whether traffic arrives, leaves, or is dropped by the device during troubleshooting.

A live diagnostic trace that prints the path a packet takes through routing, policy lookup, NAT, and inspection, showing exactly where it was dropped and why.

Two interfaces configured as a transparent bridge, forwarding layer-2 traffic between segments while still applying policy and inspection without changing IP addressing.

A pair of ports that pass all traffic between them without MAC learning or IP addressing, useful for inserting inspection inline between two network devices.

The public name of a wireless network, mapped on the controller to a VLAN and security policy that determine client addressing, authentication, and permitted traffic.