I85PREP
⌘ K
NSE 8 study materials
NSE 8 study resources

NSE 8: Network Security Design for Complex Networks

NSE 8 · Work through your exam, one topic at a time.

All guide sections

Network Security Design for Complex Networks

Network security design for complex networks

The NSE 8 design domain tests whether you can turn business and availability requirements into a Fortinet architecture that still forwards traffic correctly when a link, device, or site fails. Expect questions on segmentation, high availability, routing, VPN topology, Security Fabric integration, and capacity planning rather than single-feature syntax.

Design rules that drive marks

  • Begin with trust boundaries and flows: which users, OT devices, branches, and partners reach which applications, in which direction, and with what inspection. Map these to VDOMs, zones, VLANs, and policies before choosing hardware.
  • Use VDOMs for administrative separation and independent policy sets, not as a substitute for VLAN segmentation. Inter-VDOM links still need firewall policies and can hide asymmetric routing if a flow crosses VDOMs.
  • For HA, match model, firmware, licenses, and interface layout. FGCP active-passive preserves session state more simply; active-active can distribute flows but complicates asymmetric routing, so design return paths deliberately. Use redundant heartbeat links and switches, and verify split-brain prevention.
  • Route with a plan: summarize at area boundaries, avoid overlapping subnets, and keep forward and return paths through the same FortiGate cluster. Use BGP for multi-homing and ADVPN, OSPF inside domains, and route-based IPsec rather than policy-based IPsec when dynamic routing is required.
  • Size for inspected traffic, not raw firewall throughput. SSL inspection, IPS, and logging reduce performance; account for concurrent sessions, new sessions per second, and FortiAnalyzer/FortiManager scale.

Worked example

Two data centers and 60 branches. Place an FGCP active-passive pair in each DC, with BGP to both ISPs and a route-based ADVPN hub. Branches use two WAN links in an SD-WAN zone, ADVPN shortcuts for spoke-to-spoke traffic, and BGP to the hubs. Reasoning: active-passive avoids state loss on failover and keeps return paths symmetric; ADVPN reduces hub hairpinning; SD-WAN SLA probes steer voice over the better link. Put FortiAnalyzer in the DC and size log retention. If the customer insists on active-active, document the asymmetric routing risk and test failover with live sessions.

Traps that cost marks

  • Choosing active-active without a symmetric routing design.
  • Mismatched HA licenses or firmware.
  • Putting branches with overlapping subnets into one VDOM.
  • Sizing without SSL inspection or logging load.
  • Forgetting MTU/MSS for IPsec.
  • Assuming ADVPN shortcuts replace routing policy.