I85PREP
⌘ K
NSE 8 study materials
NSE 8 study resources

NSE 8: Configuration for Complex Networks

NSE 8 · Work through your exam, one topic at a time.

All guide sections

Configuration for Complex Networks

Configuration for complex networks

The configuration domain tests whether you can implement a multi-site Fortinet design in FortiOS without breaking routing, inspection, or failover. Questions often present a partial CLI snippet or a requirement such as “branch subnets must be reachable over redundant WAN links” and ask for the correct object relationship, not just a command.

Core configuration rules

  • Confirm the VDOM before editing: config vdom, edit <name>, then enter the feature. A correct command in the wrong VDOM is a wrong answer.
  • Build interfaces and zones first: set role, MTU, and administrative access; group similar links into zones so policies and SD-WAN rules scale.
  • For route-based IPsec, create phase1-interface with IKEv2, remote-gw, and pre-shared key, then phase2-interface; routing and policies reference the tunnel interface. Use BGP or OSPF over the tunnel when remote subnets are dynamic.
  • ADVPN requires auto-discovery-sender on the hub and auto-discovery-receiver on spokes; BGP advertises spoke prefixes and enables shortcuts. Keep a distinct AS per spoke to avoid loops.
  • SD-WAN: define members, a zone, health checks with SLA targets, and service rules; reference the SD-WAN zone in firewall policy.
  • HA: config system ha with mode, group-name, password, heartbeat devices, priority, and session-pickup; monitor the interfaces that carry user traffic.
  • Policy: order matters. Place specific permits and denies before broad rules, apply NAT and security profiles deliberately, and enable logging on rules you will troubleshoot.

Worked example

A hub with two spokes. On the hub, create phase1-interface “ADVPN-HUB” with ike-version 2, auto-discovery-sender enable, and a phase2. Assign a tunnel IP and configure BGP AS 65000 with a neighbor range for 10.10.0.0/24. On each spoke, create a dial-up phase1 with auto-discovery-receiver enable, BGP AS 65001 or 65002, and advertise its LAN. Add both WAN links to an SD-WAN zone and a health check. Reasoning: BGP carries branch prefixes without static routes; ADVPN shortcuts bypass the hub for spoke-to-spoke traffic; SD-WAN steers around SLA violations.

Traps that cost marks

  • Enabling ADVPN on one side only.
  • Reusing the same BGP AS on hub and spokes.
  • Forgetting to advertise the LAN into BGP.
  • Putting the SD-WAN zone in a policy but not in the health check.
  • Placing the HA heartbeat on a user-facing interface.
  • Applying SSL inspection without sizing.