Fortinet NSE 4 / FCP FortiGate (FortiOS 7.4)
The vendor-neutral networking foundation NSE 4 assumes you already know, routing, NAT, VPN concepts, AAA, and threat / crypto fundamentals. Cover this layer here for free; the FortiGate-specific pieces (policy engine, security profiles, SD-WAN with SLA, FortiOS commands) live in the mentored 8-week program.
Each topic page: summary · mental model · topology · commands · verification · common mistakes · lab · cheat strip.
Mapped to the Fortinet NSE 4 / FCP FortiGate Administrator blueprint.
Fortinet's current admin cert (branded FCP FortiGate Administrator in the new framework, still commonly searched as "NSE 4") covers six functional areas. Every one starts from vendor-neutral networking concepts. That's the layer this free library covers.
| NSE 4 / FCP FortiGate domain | Prereq topics |
|---|---|
| 1.0 System & Interfaces | 11 |
| 2.0 Routing | 10 |
| 3.0 Firewall Policies & NAT | 7 |
| 4.0 Authentication | 4 |
| 5.0 VPN (IPsec + SSL) | 6 |
| 6.0 Security Profiles & Fabric | 7 |
Fortinet®, NSE®, and FCP are trademarks of Fortinet, Inc. PacketMentor is independent and not affiliated with Fortinet.
1.0System & Interfaces
FortiGate Architecture: FortiOS, VDOMs, and the Session Table
How a FortiGate is built end-to-end: FortiOS on ASIC-accelerated hardware, the packet flow, VDOMs, admin access, factory reset, and the stateful session table NSE 4 asks about.
FortiGate HA: FGCP Active-Passive and Active-Active
How FortiGate Clustering Protocol (FGCP) forms a redundant pair or cluster: heartbeat, session sync, election, active-passive vs active-active, override, split-brain avoidance.
OSI Model & TCP/IP
Two networking reference models compared side-by-side. The seven OSI layers, the four TCP/IP layers, and which one the real internet actually runs on (spoiler: not OSI).
IPv4 Addressing
32-bit addresses, dotted decimal, classful vs classless, private ranges, and the special addresses (loopback, broadcast, APIPA) you should never accidentally use for production hosts.
Subnetting
CCNA subnetting guide: the magic-number method, VLSM, wildcard masks, enterprise IP plans, 8 worked practice problems and a fast mental subnetting drill.
IPv6 Basics
128-bit addresses, hex notation, the :: shortcut, address types (global, link-local, multicast), SLAAC, and why IPv6 is finally happening 25 years after it was supposed to.
ARP: Address Resolution Protocol
How a host turns an IP address into the MAC address it needs to actually deliver a frame. Broadcast question, unicast answer, cached for hours. Also covers Gratuitous ARP, Proxy ARP, and the ARP spoofing attack.
DNS: Domain Name System
How www.example.com becomes an IP address. Covers the recursive query path (root → TLD → authoritative), record types (A, AAAA, CNAME, MX, PTR), TTL caching, and the most common DNS failure modes.
DHCP: Dynamic Host Configuration Protocol
CCNA DHCP guide: the DORA exchange, packet anatomy, DHCP options, T1/T2 lease renewal, Cisco IOS server and relay config, DHCP Snooping and 8 scenarios.
DHCP Relay & IP Helper
How the ip helper-address command forwards DHCP DISCOVER broadcasts across Layer 3 boundaries so one DHCP server can serve many VLANs. Includes Option 82, the GIADDR field, and the relay troubleshooting flow.
Cabling & Media Standards
What's inside the cables and fiber you plug in: Cat5e/6/6A/8, single-mode vs multi-mode fiber, SFP/SFP+/QSFP transceivers, distance and bandwidth limits.
2.0Routing
FortiGate SD-WAN with Performance SLA
How Fortinet SD-WAN routes traffic across multiple WAN links based on real-time SLA measurement (latency, jitter, packet loss). Performance SLA config, SD-WAN rules, and how failover actually works.
Static Routing
CCNA static routing guide: next-hop vs exit-interface routes, default, floating and summary routes, recursive lookup, IPv6 statics and 8 worked scenarios.
Default Routing
The catch-all route every edge router needs. Covers static defaults, dynamic defaults (originated by OSPF/EIGRP/BGP), gateway of last resort, and the difference between a default and a summary route.
Routing Decision Process
How a router picks a route: longest prefix match, then administrative distance, then metric. Why a more specific OSPF route beats a less specific static route.
OSPF Single-Area
CCNA OSPF guide: link-state model, seven neighbor states, LSA types, DR/BDR election, cost tuning, authentication, summarization and 8 worked scenarios.
OSPF Multi-Area
Why a single OSPF area stops working past ~50 routers, and how multi-area design fixes it. Covers ABRs, ASBRs, area 0 backbone rules, LSA types, and the area design decisions that scale OSPF to thousands of routers.
BGP Basics
CCNP BGP guide: eBGP vs iBGP, neighbor states, best-path selection, AS_PATH, LOCAL_PREF, MED, communities, route reflectors, RPKI and 8 worked scenarios.
BGP Best-Path Selection: The Full 13-Step Order
The complete BGP path-selection algorithm CCNP ENCOR expects you to recite. Every step in order, with the tie-breaker mnemonic and a worked example for the top three most-common decision points.
SD-WAN Concepts
SD-WAN explained: control plane vs data plane, overlay tunnels over any underlay (MPLS, internet, LTE), and centralized policy with vManage and vSmart.
Route Summarization
Why aggregating many specific routes into one shorter prefix shrinks route tables, speeds convergence, and limits the blast radius of a flapping link. Covers manual, OSPF, and EIGRP summarization.
3.0Firewall Policies & NAT
FortiGate Firewall Policies: Structure, Order, NAT Inline
How firewall policies work on FortiOS: the 6 core fields, top-down first-match evaluation, how NAT lives inside the policy, and the diagnostic that tells you which policy matched.
Access Control Lists (ACLs)
CCNA ACL guide: first-match-wins, implicit deny, wildcard masks, standard, extended and named ACLs, in vs out, time-based ACLs, 9 scenarios and debugging.
NAT & PAT
CCNA NAT guide: static NAT, dynamic NAT, PAT/overload, inside/outside terms, port forwarding, CGNAT, hairpin NAT, 8 worked scenarios and NAT debugging.
TCP vs UDP
Two flavors of Layer 4 transport. TCP gives reliability and order at the cost of latency; UDP gives speed with no safety net. Covers the 3-way handshake, ports, when to use each, and the protocols that pick the wrong one.
TCP 3-Way Handshake
The three packets that start every TCP connection: SYN, SYN-ACK and ACK. Sequence numbers, the half-open state, SYN floods and HTTPS on high-latency links.
TCP Connection States
What every TCP socket goes through from CLOSED to ESTABLISHED to TIME_WAIT. Covers each state, why TIME_WAIT exists (and frustrates web servers), and how netstat and ss show you what's really happening.
MTU & Fragmentation
Why packets get fragmented or dropped on links with smaller MTU than expected. Covers MTU vs MSS, the Don't-Fragment bit, ICMP 'Fragmentation Needed,' Path MTU Discovery, and why blocking ICMP breaks the internet.
4.0Authentication
FortiGate FSSO: Fortinet Single Sign-On
How FSSO gives FortiGate identity-aware policies without prompting users: collector agents on the AD DC, event-log monitoring, transparent login mapping, and RADIUS-SSO variants.
AAA · RADIUS & TACACS+
AAA (authentication, authorization and accounting) explained: RADIUS vs TACACS+, method lists, and why networks over 5 devices use centralized auth.
802.1X: Port-Based Network Access Control
Lock every switch port until the connected device proves identity. Covers the supplicant / authenticator / auth server roles, EAPOL on the wire, and how 802.1X plugs into RADIUS for enterprise Wi-Fi and wired auth.
Cisco ISE Basics
Cisco ISE (Identity Services Engine): the RADIUS/TACACS+, posture and profiling brain behind enterprise network access, where it sits and how it enables 802.1X.
5.0VPN (IPsec + SSL)
FortiGate IPsec VPN: Site-to-Site and Dial-Up
How IPsec VPNs work on FortiOS: Phase 1 IKE, Phase 2 SA, site-to-site, dial-up, route-based vs policy-based, and the diagnostics that solve 90% of tunnel-down tickets.
FortiGate SSL VPN: Web Mode and Tunnel Mode
How FortiOS SSL VPN works for remote users: web-mode portal, full-tunnel-mode client (FortiClient), authentication with LDAP/RADIUS/SAML, and the split-tunnel decision every design faces.
VPN Basics: IPsec & SSL
How two separated networks (or one user and a network) can talk privately over the public internet. Covers site-to-site IPsec, remote-access SSL/TLS VPNs, IKE phases, and what 'tunnel' actually means.
GRE Tunnels
How to make two distant routers feel directly connected by wrapping IP inside IP. Covers tunnel interface config, MTU caveats, why GRE itself isn't encrypted, and the standard 'GRE over IPsec' combination.
Cisco AnyConnect / Remote Access VPN
How a remote user's laptop gets put 'on the corporate LAN' over the internet. Covers AnyConnect client, SSL/TLS vs IKEv2, split tunneling, authentication options, and where it fits alongside ZTNA in 2026.
Encryption Fundamentals
Cryptography for network engineers: symmetric vs asymmetric, hashing, digital signatures and certificates, and where each is used in IPsec, TLS, SSH and 802.1X.
6.0Security Profiles & Fabric
FortiGate Security Profiles: AV, Web Filter, App Control, IPS
FortiGate security profiles applied inline to traffic: antivirus, web filter, app control, IPS, DNS filter, DLP and SSL/SSH inspection, and how to combine them.
Cybersecurity Threats & Mitigation
Threats every network engineer must recognize (phishing, ransomware, MITM, DDoS, supply-chain attacks, insider threats) and the mitigation controls that work.
Encryption Fundamentals
Cryptography for network engineers: symmetric vs asymmetric, hashing, digital signatures and certificates, and where each is used in IPsec, TLS, SSH and 802.1X.
DHCP Snooping
Switch security feature that blocks rogue DHCP servers. Trusts one port (where the real server lives) and drops DHCP server messages from any other port. Foundation for Dynamic ARP Inspection too.
Dynamic ARP Inspection (DAI)
The Layer-2 security feature that kills ARP spoofing. It checks every ARP packet against the DHCP Snooping binding table and drops bogus replies.
Port Security
Lock a switch port to a specific MAC address (or addresses). Covers static, dynamic, and sticky learning, violation modes (protect / restrict / shutdown), and the err-disable recovery dance.
IP Source Guard (IPSG)
IP Source Guard, the fourth Layer-2 security feature, checks every packet's source IP against the DHCP Snooping binding table to block IP spoofing.
The FortiGate-specific pieces live in the mentored program.
Firewall policy engine, session tables, security profiles (AV, web filter, app control, IPS, SSL/SSH inspection), SD-WAN with performance SLAs, FortiOS CLI: all taught 1:1 with hands-on FortiGate VM labs over 8 weeks.
See the NSE 4 program →Most FortiGate engineers also hold CCNA.
The routing, switching, and Layer-2 security concepts on the Cisco side are the same ones Fortinet expects you to know cold.
Open CCNA library →