NSE 8 study plan
NSE 8 · Give each week a clear focus.
8 weeks · About 6 hours per week
Network security design for complex networks
Map the three exam domains onto your current job tasks and list which FortiGate features you already touch weekly
Sketch a three-tier enterprise topology (edge, distribution, internal segmentation) and annotate where routing, inspection, and policy enforcement happen
Write down the differences between policy routes, static routes, and SD-WAN rules in terms of when each is evaluated
Build a personal glossary of 20 design terms you cannot yet define precisely, with a one-line definition for each
Your checkpoint
A one-page annotated topology diagram plus a 20-term glossary file, both saved in your study notes
Network security design for complex networks
Design a segmentation scheme that separates guest, IoT, and corporate traffic using VLANs and distinct security profiles
Choose between NAT modes for a multi-ISP edge and justify the choice in writing
Explain how to place FortiGate in transparent mode versus NAT mode and name two scenarios favoring each
Draft failover behavior for WAN links, including how sessions and routing tables react when a link drops
Your checkpoint
A written design decision record covering segmentation, NAT mode, and WAN failover with justifications
Network security design for complex networks & Troubleshooting for complex networks
Identify the five most common causes of asymmetric routing in complex networks and the symptom each produces
Trace how a packet moves through policy, UTM inspection, and routing when multiple VDOMs are involved
Practice reading a FortiGate debug flow output and state which line confirms a policy match versus a route lookup failure
List the diagnostic commands you would run first when users report intermittent drops across an IPsec tunnel
Your checkpoint
A troubleshooting cheat sheet mapping five symptoms to first-check commands and likely root causes
Configuration for complex networks
Configure inter-VDOM routing on a lab FortiGate and verify traffic passes between two VDOMs
Build a policy set that uses internet service and application control objects instead of IP-based rules
Set up an IPsec site-to-site tunnel with redundant phase 2 selectors and confirm it rekeys cleanly
Configure SD-WAN with two members and a health check, then force a member failure to observe failover
Your checkpoint
A working lab configuration export showing inter-VDOM routing, an IPsec tunnel, and SD-WAN failover, with a short verification log
Configuration for complex networks
Configure authentication offload to a remote LDAP or RADIUS server and test a user-based policy match
Apply a UTM profile set (AV, IPS, web filter) to a policy and confirm which traffic is inspected versus bypassed
Configure HA active-passive between two devices and verify session pickup after a forced failover
Document every configuration step in a repeatable runbook with the verification command for each step
Your checkpoint
A runbook of at least ten configuration steps, each paired with the command or GUI check that proves it worked
Troubleshooting for complex networks
Reproduce three common failure modes in your lab: policy shadowing, missing return route, and MTU mismatch on a tunnel
Capture packet traces on both ends of a failing tunnel and identify where the handshake stops
Use log filtering to isolate denied traffic by policy ID and by source, then confirm the fix
Write a triage decision tree that starts from a user complaint and ends at a specific diagnostic action
Your checkpoint
Three documented failure reproductions with root cause, fix, and the evidence (trace or log excerpt) that proved it
Network security design for complex networks & Troubleshooting for complex networks
Review your week 1 topology against what you now know and revise at least three design choices with reasons
Design a migration path from a flat network to segmented VDOMs without downtime, listing the order of changes
Predict the failure symptoms of each design choice you made and note how you would confirm them
Time yourself answering scenario-style design questions and note where your reasoning stalls
Your checkpoint
A revised topology with a written migration sequence and a list of predicted failure symptoms per phase
Network security design for complex networks & Configuration for complex networks & Troubleshooting for complex networks
Re-run every lab from weeks 4 through 6 from scratch without notes and record where you hesitated
Complete a timed mixed-domain practice set and categorize every miss by domain and by cause
Re-read your glossary and cheat sheet and correct any entry you now know to be imprecise
Write a final one-page summary of your three weakest areas and the specific command or concept that fixes each
Your checkpoint
A scored practice-set review sheet plus a one-page weakness summary with corrective actions
Milestones
Week 2: Can you justify every major design choice in your week 1 topology in writing without consulting notes?
Week 4: Does traffic actually pass between two VDOMs in your lab, and does your SD-WAN setup fail over when a member is disabled?
Week 6: Have you reproduced and fixed three distinct failure modes, each backed by a packet trace or log excerpt?
Week 8: Can you rebuild the core lab (inter-VDOM routing, IPsec, SD-WAN, HA) from a blank device without referring to your runbook?