FORTINET CERTIFICATION · STUDY GUIDE
Also sold as FCP — FortiGate 7.6 Administrator. Same exam, same badge, exam series FCP_FGT_AD-7.6. Colour tells you which of the five exam domains you are in, and what kind of fact you are looking at.
About 95 seconds per question. No partial credit on multi-select.
→ Drill it with flashcards · → Lab notes: deep dives on vocab & functions
Every coloured box also carries a word label, so you never have to rely on colour alone.
Pure recall. No logic will save you — learn it by heart.
A pattern Fortinet uses to build wrong answers. Read these twice.
The out-of-the-box value. When two answers look right, the default is usually the one.
Changed or added since 7.2 / 7.4. Old study material will get these wrong.
get system ha status # dark block = commands you typeContent inspection is the biggest single domain — bigger than routing and VPN put together. Study time should follow these bars, not your instincts.
Six task areas. The first four you touch at work. The last two — cloud and SASE — you cannot lab, and that is exactly why they cost people points.
Most desktop models ship with the internal / LAN interface at 192.168.1.99/24, a DHCP server running on it, and an admin account with no password. Management access on that interface is HTTPS, HTTP, SSH and PING.
super_admin profile cannot be edited or deleted.allowaccess is a separate gate from the admin account. Both must permit the traffic or you get nothing.admintimeout, and lockout admin-lockout-threshold live under config system global.Traffic to the FortiGate itself — admin logins, IPsec, SSL VPN — is handled by local-in policies, not firewall policies. Firewall policies only ever control traffic passing through the device. If a question asks why an admin can still log in despite a deny policy, this is why.
An admin with no trusted hosts set is reachable from anywhere the interface allows. Setting a trusted host wrong locks you out. Both directions get tested.
FortiCare (support and registration) is separate from the security subscriptions. Know what breaks when each one expires:
| License expires | What actually happens |
|---|---|
| AntiVirus | Engine keeps running, signature database stops updating |
| Web Filtering | FortiGuard category rating stops. Static URL filter still works |
| IPS | Engine keeps running, signatures go stale |
Follow the Upgrade Path Tool — you cannot skip major versions. FortiGate auto-backs-up the config before upgrading.
In an HA cluster, uninterruptible-upgrade is enabled. Subordinates upgrade first, then the cluster fails over, then the former primary upgrades.
execute backup config tftp <file> <server>
execute restore config tftp <file> <server>
get system status # firmware, serial, VDOM modeThe Security Fabric / CSF connection between downstream and upstream FortiGates runs on TCP 8013.
fabric-object-unification on the root decides whether objects are unified (default) or left alone.Address object created on the root but missing downstream? Check the downstream device for set configuration-sync local. local means "do not accept objects from upstream." The fix is on the downstream, not the root — the exhibit will tempt you to change the root.
Same model, same firmware, same hardware configuration, same license level, same HA group ID, same password, and at least one shared heartbeat interface.
Primary election — override DISABLED (the default):
Primary election — override ENABLED:
Turning override on makes priority beat uptime. That single swap is one of the most reliably tested facts on the whole exam.
session-pickup syncs TCP sessions only. UDP and ICMP need session-pickup-connectionless enable as well. Proxy-based inspection sessions and most SSL VPN sessions are never resumed after a failover.
ha-mgmt-interface gives each member its own reachable IP that is not taken over by the virtual MAC — used for out-of-band management and so each unit can reach FortiGuard directly.
get system ha status diagnose sys ha status diagnose sys ha checksum cluster # config sync check diagnose sys ha reset-uptime execute ha manage <index> <admin> # jump to subordinate CLI execute ha failover set <index>
A checksum mismatch between members means the config is out of sync. That is the answer to "why is the cluster flapping" and "why won't it synchronise" — not heartbeat, not licensing.
Memory thresholds:
In conserve mode the FortiGate stops accepting new proxy-based inspection sessions and applies av-failopen.
av-failopen defaults to pass — new AV sessions pass through unscanned. off blocks them instead, one-shot passes until you re-enable manually.
get system performance status # CPU, memory, sessions, uptime get system performance top # CPU per process diagnose sys top-mem # memory per process diagnose hardware sysinfo memory diagnose sys session stat
diagnose sniffer packet <intf> '<filter>' <verbosity> <count> <time> diagnose sniffer packet any 'host 10.1.1.5 and icmp' 4 0 a
| Verbosity | Shows |
|---|---|
| 1 | Header only |
| 2 | Header + IP data |
| 3 | Header + Ethernet data |
| 4 | Header + interface name |
| 5 | 2 + interface name |
| 6 | 3 + interface name |
Timestamp a gives absolute UTC. Sniffing on any disables hardware offload, so you see everything.
diagnose debug reset diagnose debug flow filter addr 10.1.1.5 diagnose debug flow filter port 443 diagnose debug flow show function-name enable diagnose debug flow trace start 100 diagnose debug enable
Learn to read the output lines:
| Line you see | What it means |
|---|---|
allowed by policy-<id> | Matched that policy |
denied by forward policy check (policy 0) | Implicit deny — nothing matched |
reverse path check fail, drop | RPF — a routing problem, not a policy problem |
no session matched | First packet of a new session |
Severity levels 0 to 7: Emergency, Alert, Critical, Error, Warning, Notification, Information, Debug. Setting a level logs that level and everything more severe.
logtraffic: disable · utm (security events only) · all (every session).Traffic logs are written when the session closes. Add set logtraffic-start enable to also log at session start.
These three topics were added to the deployment domain. Anyone studying from 7.2 or 7.4 material will not have seen them. They are conceptual — you cannot lab them, so read once and make flashcards.
| Product | Who manages it | Key fact |
|---|---|---|
| FortiGate-VM | You do | Licensing is BYOL or PAYG. vCPU count drives BYOL sizing, not RAM |
| FortiGate CNF | Fortinet does | SaaS NGFW for AWS / Azure. No instances to patch or size |
| FortiSASE | Fortinet does | Cloud SSE: SWG, ZTNA, CASB, FWaaS + private access back to a FortiGate hub |
FortiSASE user onboarding: FortiClient invitation code, SAML / SSO with an IdP, AD or Entra ID connector, or push via EMS / MDM. Know the difference between agent-based (FortiClient) and agentless (SWG proxy or PAC file) deployments.
Policy and NAT you already do daily. FSSO is the part that quietly costs managed-firewall engineers points, because you rarely build one from scratch.
Policies are matched top to bottom, first match wins, then the implicit deny at the bottom.
The implicit deny policy is policy ID 0. When debug flow says policy 0, nothing matched.
Match criteria: incoming interface, outgoing interface, source (address / user / device), destination (address, VIP, Internet Service), service, schedule, action.
Policy ID is not policy order. The GUI sequence number is order; IDs are permanent and non-sequential. An exhibit listing IDs 3, 1, 7 in that order means that is the evaluation order — do not re-sort them in your head.
Other things exhibits hide: a specific policy placed below a broader one never matches. A disabled policy still appears in the config extract — check the set status line. Internet Service objects can only be a source or a destination, never both.
"Traffic dropped right after I edited a policy" → firewall-session-dirty. Set to check-all, existing sessions are re-evaluated after any policy change. Set to check-new, only new sessions are affected.
| Pool type | Behaviour |
|---|---|
| Overload | Many-to-few with port translation. The default |
| One-to-one | Strict 1:1, no port translation. Pool exhausted → new sessions dropped |
| Fixed port range | Internal range maps to external range, no port translation |
| Port block allocation | Each internal host gets a block of ports — carrier style, easy log correlation |
Central SNAT lifts NAT out of the policy into its own table, evaluated top-down independently of policy order.
Order of operations: DNAT happens before the routing decision. The FortiGate therefore routes toward the mapped (internal) address, not the external one. This single fact answers a lot of VIP questions.
dstaddr must reference the VIP object, never the internal address.set nat-source-vip forces reverse SNAT for hairpin scenarios.The classic broken-port-forward exhibit is one of: no firewall policy at all, a policy whose srcaddr is too narrow, or the VIP's external interface not matching the ingress interface. A VIP by itself does nothing.
Active = the user is prompted (captive portal or a policy-triggered challenge). Passive = credentials learned elsewhere (FSSO, RSSO).
| Bind type | How it works |
|---|---|
| Simple | Bind directly as the user DN — needs a DN template |
| Regular | Bind with a service account, search for the user, then bind as them |
| Anonymous | No credentials to bind |
For Active Directory the Common Name Identifier is sAMAccountName, not cn. Exhibits show cn as a plausible wrong answer constantly.
auto.auto tries PAP → MS-CHAPv2 → CHAP. If the server only accepts MS-CHAPv2 and you hard-set PAP, authentication fails. That is a standard exhibit.
diagnose test authserver ldap <server> <user> <password> diagnose test authserver radius <server> <proto> <user> <password> diagnose firewall auth list diagnose firewall auth clear
| Mode | How it works | Trade-off |
|---|---|---|
| DC Agent mode | An agent DLL on every domain controller intercepts logon events and pushes them to a Collector Agent | Most scalable, near real-time |
| Agent-based polling | Collector Agent polls DC event logs — no DC agent installed | Middle ground |
| Agentless polling | The FortiGate itself polls the DCs directly | Simplest, least scalable, no collector features |
FSSO ports — learn these cold:
The four classic "FSSO users can't get through" causes:
diagnose debug authd fsso list # current logon database diagnose debug fsso-polling detail # polling mode
More questions than routing and VPN combined. If you only have time to over-prepare one domain, make it this one.
| Certificate inspection | Full (deep) inspection | |
|---|---|---|
| FortiGate sees | SNI / certificate CN only | The full decrypted payload |
| Man in the middle? | No | Yes — FortiGate re-signs |
| Client trust needed? | No | Yes — CA must be on the endpoint |
| Enables | Web filter by hostname | AV, IPS, DLP, app control over HTTPS, full URL filtering |
The default re-signing CA is Fortinet_CA_SSL. If the server's certificate is invalid, FortiGate re-signs with Fortinet_CA_Untrusted instead — deliberately, so the browser warning still reaches the user. That is not a bug and it is a question.
Certificate pinning and HSTS break deep inspection — banking apps, Windows Update, Apple and Microsoft services. The correct fix is an SSL exemption for those destinations, never "turn off inspection." Finance and Health categories are exempt by default.
Related settings: set untrusted-caname, set allow-invalid-server-cert, set expired-server-cert. Know the difference between the CA certificate with a private key used to re-sign, and a server certificate used for the admin GUI or SSL VPN.
| Flow-based | Proxy-based |
|---|---|
| IPS engine inspects the stream | WAD process terminates and re-originates |
| No buffering, faster, offloadable | Buffers content before releasing it |
| Limited block-page behaviour | Web profile overrides, quotas, safe search, CDR, DLP |
Web filter evaluation order:
Because the URL filter runs first, an allow entry for one site overrides a blocked category. An exempt entry goes further and skips the remaining inspection — AV and DLP included.
FortiGuard category actions: Allow · Monitor (allow and log) · Block · Warning (interstitial with a timer) · Authenticate (require credentials to continue).
diagnose webfilter fortiguard cache dump
diagnose webfilter fortiguard cache clear
diagnose debug rating # FortiGuard server listApplication control runs on the IPS engine, so it is always flow-based — even inside a proxy-based policy.
Match order — most specific first:
A single application entry always beats its own category.
unknown-application-action and unknown-application-log handle unclassified traffic.| Flow-based AV | Proxy-based AV |
|---|---|
| Scans as the stream passes | Buffers the whole file, scans, then releases |
| Client may receive part of the file before the reset | Client comforting avoids timeouts on big files |
| Faster | Supports CDR (content disarm) — proxy only |
Oversize files. Anything larger than oversize-limit is not scanned, and the default behaviour is to pass it through. Whether it passes or blocks is set in the protocol options profile — a separate object from the AV profile, and the answer to most "why isn't it scanning?" questions.
Detection layers: signature · grayware · AI / machine-learning detection · FortiGuard Outbreak Prevention (real-time hash lookup, needs a license and connectivity) · EMS threat feeds.
Databases: normal / extended / extreme. Quarantine to disk needs a model with storage.
diagnose antivirus database-info
An IPS sensor is one or more filters (severity, target, protocol, OS, application) plus optional individual signature entries. Signature entries are evaluated first.
default (use the signature's own recommended action).set packet-logging enable captures offending packets and costs memory.diagnose test application ipsmonitor 1 # display IPS engine info diagnose test application ipsmonitor 2 # toggle IPS engine on/off diagnose test application ipsmonitor 5 # toggle bypass status diagnose test application ipsmonitor 99 # restart all IPS engines
Under config ips global: fail-open decides whether traffic passes when the engine is overloaded. ips-reserve-cpu and engine-count are the tuning knobs.
Small domain. Your networking background carries most of it — but the FortiGate-specific meanings of distance, priority and metric are not what Cisco taught you.
The three-way distinction that is nearly guaranteed to appear:
Equal distance and equal priority = ECMP.
ECMP load-balance methods (set v4-ecmp-mode): source-ip-based (default) · source-dest-ip-based · weighted-load-balance · usage-based (spillover).
Blackhole routes drop traffic silently. Standard use: pair one with a route-based IPsec tunnel at a higher distance, so traffic doesn't leak out the default route when the tunnel drops.
Policy routes are evaluated before the routing table.
Reverse Path Forwarding. FortiGate source-checks the first packet of every session.
set strict-src-check enable.reverse path check fail, drop in debug flow is almost always a missing or wrong route back toward the source — not a policy problem. set asymroute enable disables the check and is the wrong answer unless the question explicitly wants asymmetric routing tolerated.
get router info routing-table all get router info routing-table database # includes inactive routes get router info kernel # the actual forwarding table diagnose firewall proute list # policy routes
Building blocks: zones → members (interfaces) → performance SLAs → rules.
A member is unusable without a static default route pointing at the sd-wan virtual interface. No route, no rule selection — regardless of how healthy the link is.
Health check probes: Ping, HTTP, HTTPS, DNS, TCP-echo, UDP-echo, TWAMP. Each SLA sets targets for latency, jitter and packet loss, optionally minimum bandwidth. Detection timing comes from interval, failtime and recoverytime.
The four rule strategies:
Evaluation order: policy routes → SD-WAN rules → routing table. Unmatched traffic hits the implicit rule at the bottom, which load-balances by source IP by default.
diagnose sys sdwan health-check
diagnose sys sdwan member
diagnose sys sdwan service # rule state, selected members
diagnose sys sdwan intf-sla-log <intf>An SLA showing state(alive) but a service showing no members means the link is up but is not meeting the SLA targets. Alive ≠ eligible.
The online 7.6 topic list covers IPsec only, while the downloadable exam description still mentions SSL VPN. FortiOS 7.6 removes SSL VPN tunnel and web mode from lower-memory entry models in favour of IPsec dial-up and ZTNA. Study IPsec as the priority and keep SSL VPN at concept level.
| Mode | Characteristics |
|---|---|
| IKEv1 Main | 6 messages, identity protected |
| IKEv1 Aggressive | 3 messages, identity sent in the clear — needed for dynamic-IP peers using peer IDs |
| IKEv2 | Fewer exchanges, built-in NAT-T, EAP support |
Must match on both ends: encryption and hash proposals, DH group, authentication method (pre-shared key or certificate), and for IKEv1 the mode.
Lifetime does NOT need to match — the lower of the two values is used. This is asked directly.
NAT-T wraps ESP inside UDP 4500 when a NAT device is detected. Detection happens during IKE on UDP 500.
Quick mode selectors must mirror on the two ends. A selector mismatch is the number one cause of "phase 1 is up but phase 2 is down." You have fixed this exact thing at work — it's on the exam too.
Also in phase 2: PFS with its own DH group, replay detection, keylife in seconds or KB, and auto-negotiate / keepalive to bring the tunnel up without interesting traffic.
Assume this is the only style. It creates a virtual tunnel interface and needs both of:
Policy-based VPN is legacy and largely gone from the GUI.
Dial-up IPsec: one phase 1 on the hub with type dynamic. Clients get addresses from mode-config; set add-route enable injects the client route on the hub. Peer ID or XAuth identifies the client.
SSL VPN (lighter): web / portal mode vs tunnel mode · portal assignment via authentication rules · the ssl.root interface still needs firewall policies · IP pool assignment · split tunnelling set in the portal.
get vpn ipsec tunnel summary diagnose vpn ike gateway list # phase 1 state diagnose vpn tunnel list # phase 2 SAs + counters diagnose vpn ike log filter dst-addr4 <peer> diagnose debug application ike -1 diagnose debug enable
Reading the errors:
NO_PROPOSAL_CHOSEN → proposal mismatch, phase 1 or phase 2INVALID_ID_INFORMATION → selector or peer-ID mismatchAdjust the calendar to your schedule. Keep the proportions.
| Week | Focus | Hours |
|---|---|---|
| 1 | Deployment, initial config, logging, Security Fabric | 6–8 |
| 2 | HA, then conserve mode, sniffer and debug flow | 6–8 |
| 3 | Firewall policies, SNAT / DNAT / VIPs, central NAT | 6–8 |
| 4 | Authentication and FSSO, then certificates and SSL inspection | 8 |
| 5 | Web filter, app control, antivirus, IPS — the biggest domain | 10 |
| 6 | Routing, SD-WAN, IPsec, then full review and practice questions | 8 |
IPsec phase 1 / phase 2 selector troubleshooting, VIPs and DNAT, conserve mode forensics, routing, FortiManager policy work. You can move fast through domains 4 and 5.
Each one maps to a real exam objective and is worth more than re-reading a chapter.
srcaddr, a missing policy, and a VIP interface mismatch. Identify each one from diagnose debug flow alone.oversize-limit low, pull a large test file, and watch pass vs block as you flip the protocol options setting.asymroute enable.diagnose sys sdwan service move the selection.diagnose sys ha checksum cluster, then flip override and change priorities to prove the election order to yourself.Third-party "dumps" sites carry real risk. Fortinet's exam policy prohibits them, and the content is frequently stale material from 7.0 or 7.2 that will teach you wrong defaults. Use the official sample questions first, then timed practice tests from a reputable training vendor.