FortiGate Masterclass: Fortinet Firewall Administration Course (Batch 01)

Day 0: Introduction to FortiGate and Network Security

How This Course Works: job-first labs, mapped to NSE 4
Network Security Foundations: threats, controls, packet flow
Quiz System: formats, timing, attempts, scoring, tips
Lab Guide: how labs work, what to submit, how to pass
VPN Access for Students: reach the lab safely
LAB - Install Sophos Connect and verify lab access (graded)
Certificates & NSE 4: what you earn and how they differ
Day 0 - Quiz 1: Knowledge Check
FREE FortiGate Firewall Intro Session Recording | 29th Sept
VPN Access and GNS3 Setup

Day 1: Initial Setup & Management Plane

FortiGate Introduction and Prerequisites
Factory Reset of FortiGate devices
Accessing the CLI (Console, SSH) and GUI (HTTPS)
Initial Configuration Wizard
Management Interface Configuration (IP address, administrative access: PING, SSH, HTTPS)
Default Route for Management Access
Feature Visibility for GUI Customization
Lab 1.1: FortiGate Factory Reset and Management Access
Day 1 – Quiz 1: Initial Setup & Management Plane
Day 1: Initial Setup & Management Plane | Class Recording 🔴🎥

Day 2: Data Plane Fundamentals & Zones

Data Plane Concepts: User traffic forwarding through the firewall
Configuring Physical and VLAN Interfaces
Zone-Based Security: Creating and assigning interfaces to zones (LAN, WAN, DMZ).
FortiGate as a DHCP Server: Configuration of DHCP services, IP ranges, default gateway, DNS servers, and options.
Monitoring DHCP clients and leases.
Lab 2.1: Configure Data Plane Interfaces, Zones, and DHCP Server
Day 2 Quiz 1: Data Plane and Zones
Day 2 Quiz 2: DHCP Services
Day 2: Data Plane Fundamentals & Zones | Class Recording 🔴🎥

Day 3: Network Address Translation (NAT)

NAT Fundamentals: Understanding Network Address Translation (NAT) and Port Address Translation (PAT)
Centralized Source NAT Policy: Using the outbound interface IP address (PAT).
Dynamic IP Pools: Configuring a range of public IP addresses for one-to-one mapping.
Virtual IPs (VIPs): Mapping external IP addresses/ports to internal servers
Port Forwarding: Translating specific ports to different internal ports (e.g., external 8080 to internal 80)
NAT with and without Zones.
Lab 3.1: Source NAT (SNAT) with PAT and Dynamic IP Pools, and Destination NAT (DNAT) with Virtual IPs (VIPs)
Day 3 Quiz 1: NAT Fundamentals
Day 3 Quiz 2: Advanced NAT Configuration
Day 3: Network Address Translation (NAT) | Class Recording 🔴🎥

Day 4: Firewall Policies Basics

Firewall Policy Fundamentals: Core component of FortiGate, controlling traffic flow.
Incoming and Outgoing Interfaces/Zones
Source and Destination Address Objects (IP addresses, subnets, FQDN, geographic-based ISDB)
Service Definitions (HTTP, HTTPS, ICMP, ALL)
Schedules for time-based policy enforcement
Policy Processing Order: Top-to-bottom evaluation, implicit deny
Action Types: Accept (Permit) vs. Deny (Drop)
Logging: Logging all sessions vs. security events.
Lab 4.1: Basic Firewall Policy Configuration & Logging
Day 4 Quiz 1: Firewall Policy Fundamentals
Day 4 Quiz 2: Advanced Firewall Policy Concepts
Day 4: Firewall Policies Basics | Class Recording 🔴🎥

Day 5: Static Routing, Failover, ECMP & Policy Routes

What is IP Routing? FortiGate as an IP router, forwarding packets, local-out traffic
Routing Table (RIB & FIB): Components (Network, Gateway IP, Interface, Distance, Metric, Priority)
Route Lookup Process
Static Routes: Configuring default routes (0.0.0.0/0), next-hop, and outgoing interface
Administrative Distance: Tie-breaker for different route sources, preference (lower is better)
Static Route Failover: Using administrative distance and priority to create primary and backup routes
Equal Cost Multi-Path (ECMP): Load balancing traffic across multiple equal-cost paths (same destination, distance, metric, priority).
ECMP Load Balancing Algorithms (Source IP, Source-Destination IP, Weighted)
Understanding and Configuring Policy Routes in FortiGate
Lab 5.1 — Static Floating Routes (Failover)
Lab 5.2 — Static ECMP + Source/Destination-influenced Steering
Lab 5.3 — Policy Routing (source-/service-aware path control)
Day 5 Quiz 1: Static Routing Fundamentals
Day 5 Quiz 2: Advanced Static Routing & Failover
Day 5: Static Routing, Failover, ECMP & Policy Routesr | Class Recording 🔴🎥 (Part I)
Day 5: Static Routing, Failover, ECMP & Policy Routes | Class Recording 🔴🎥 (Part II)

Day 6: Dynamic Routing Protocols (RIP, OSPF, BGP)

Introduction to Dynamic Routing: Automating routing table updates for large networks
Routing Information Protocol (RIP): Simple distance-vector protocol, configuration on FortiGate
Open Shortest Path First (OSPF): Link-state protocol, concept of areas (Area 0 Backbone), router ID, configuring interfaces in areas
Border Gateway Protocol (BGP): Inter-Autonomous System routing, local AS, neighbors, network advertisements
Administrative distance values for RIP (120), OSPF (110), BGP (200 for external, 20 for internal).
Lab 6.1 – Routing Information Protocol (RIP)
Lab 6.2 – Open Shortest Path First (OSPF)
Lab 6.3 – Border Gateway Protocol (BGP)
Day 6 Quiz 1: Dynamic Routing Protocols (RIP, OSPF, BGP)
Day 6 Quiz 2: Dynamic Routing Protocols (RIP, OSPF, BGP)
Day 6: Dynamic Routing Protocols (RIP, OSPF, BGP) | Class Recording 🔴🎥

Day 7: Digital Certificates & SSL/TLS Inspection Fundamentals

Digital Certificates: Public Key Infrastructure (PKI), Certificate Authorities (CAs), X.509 standard, Public/Private Key pairs, self-signed certificates
Encryption Basics: Symmetric vs. Asymmetric encryption, hashing, digital signatures
Certificate Management on FortiGate: Importing trusted CAs, generating CSRs, importing signed certificates, generating local certificates
SSL/TLS Inspection Fundamentals: Why inspect encrypted traffic, concepts of Full SSL Inspection (Deep Packet Inspection, Application Layer Visibility), Certificate Inspection
Role of certificates in SSL/TLS inspection (FortiGate acts as a transparent proxy).
Day 7 Quiz 01: Digital Certificates & SSL/TLS Inspection Fundamentals
Day 7 Quiz 02: Digital Certificates & SSL/TLS Inspection Fundamentals
Day 7: Digital Certificates & SSL/TLS Inspection Fundamentals | Class Recording 🔴🎥

Day 8: Outbound SSL/TLS Inspection Configuration

Outbound SSL Inspection Profile Creation: Deep Inspection profile, choosing a signing certificate (FortiGate's own CA or an imported one)
Attaching the SSL Inspection Profile to a Firewall Policy
Client Trust Requirements: Endpoints must trust the FortiGate's signing CA
SSL Exemptions: Exempting specific web categories (e.g., Finance, Health) or FQDNs from inspection
Troubleshooting outbound SSL inspection (missing security profiles, untrusted CA)
Lab 8.1: Outbound Deep SSL/TLS Inspection (LAN → Internet)
Day 8 Quiz 01: Outbound SSL Inspection Basics
Day 8 Quiz 02: SSL Inspection Configuration & Troubleshooting
Day 8: Outbound SSL/TLS Inspection Configuration | Class Recording 🔴🎥

Day 9: Inbound SSL/TLS Inspection Configuration

Inbound SSL Inspection Concept: Protecting internal servers from encrypted threats
Exporting Web Server Certificates with Private Keys: Process for IIS servers (PFX format)
Importing Certificate and Private Key to FortiGate
Configuring Inbound SSL Inspection Profile: Using the web server's certificate
Attaching to a firewall policy for traffic to the DMZ server
Troubleshooting inbound SSL inspection (file filtering issues, inspection not enabled)
Lab 9.1: Configure Inbound SSL Inspection for a DMZ Web Server
Day 9 Quiz 01: Inbound SSL/TLS Inspection Basics
Day 9 Quiz 02: Inbound SSL Inspection Configuration & Troubleshooting
Day 9: Inbound SSL/TLS Inspection Configuration | Live Class 🟢
Day 9: Inbound SSL/TLS Inspection Configuration | Class Recording 🔴🎥

Day 10: Antivirus Configuration

FortiGate Antivirus Capabilities: Stopping viruses and malware
Antivirus Components: Signature databases (FortiGuard AV service), AI scan, Grayware scan
Antivirus Scanning Modes: Flow-based inspection (optimizes performance)
Antivirus Scanning Modes: Proxy-based inspection (more features, thorough, requires >2GB RAM)
Advanced AV Features: Virus outbreak prevention (VOS), External Malware Blocklist, EMS Threat Feed, Content Disarm and Reconstruction (CDR)
Configuring Protocol Options for AV inspection.
Day 10 Quiz 01: Antivirus Protection & Components
Day 10 Quiz 02: Antivirus Features & Configuration
Day 10: Antivirus Configuration | Live Class 🟢
Day 10: Antivirus Configuration | Class Recording 🔴🎥

Day 11: Web Filtering Configuration

Web Filtering Overview: Controlling web traffic (URL filtering, web content filtering, FortiGuard Web Filtering service)
FortiGuard Categories: Websites categorized, actions (Allow, Block, Warn, Authenticate, Quotas)
Creating Web Filter Profiles: Flow-based vs. Proxy-based
URL Filtering: Blocking/exempting specific URLs (static URL filters, wildcards, regular expressions)
Safe Search enforcement
Troubleshooting web filtering (FortiGuard connection status, log analysis).
Day 11 Quiz 01: Web Filtering Basics & Components
Day 11 Quiz 02: Web Filtering Profiles & Troubleshooting
Day 11: Web Filtering Configuration | Live Class 🟢
Day 11: Web Filtering Configuration | Class Recording 🔴🎥

Day 12: DNS Filtering

DNS Filtering for Security: Protecting against malicious domains, botnet, and command & control (C2) servers
FortiGuard Category-Based DNS Filtering: Blocking domains based on FortiGuard categories
Static Domain Filters: Blocking or redirecting specific domain names (wildcards, regular expressions, exact strings)
External IP Blocklists: Importing lists of known malicious IP addresses for DNS filtering
Monitoring DNS filter logs and botnet activity widgets
Troubleshooting DNS filtering issues.
Day 12 Quiz 01: DNS Filtering Basics & Components
Day 12 Quiz 02: DNS Filtering Configuration & Troubleshooting
Day 12: DNS Filtering | Live Class 🟢
Day 12: DNS Filtering | Class Recording 🔴🎥

Day 13: Application Control Basics

Application Control Overview: Identifying and controlling applications beyond ports and protocols
Uses the IPS Engine: Flow-based scanning for application detection
Application Categories: FortiGuard-defined application categories
Application Signatures: Detection based on application-specific patterns
Vendor-based Control: Matching applications based on their vendor (e.g., Meta/Facebook)
Action Types: Monitor, Block, Allow, Quarantine
Day 13 Quiz 01: Application Control Basics & Categories
Day 13 Quiz 02: Application Control Features & Configuration
Day 13: Application Control Basics | Live Class 🟢
Day 13: Application Control Basics | Class Recording 🔴🎥

Day 14: Application Control Advanced Configuration

Application Control Profile Creation: Building custom profiles
Category-Based Blocking: Blocking entire application categories (e.g., Social Media)
Application Filter Overrides: Creating exceptions to category blocks (e.g., allow Meta apps within blocked social media)
Behavior-Based Blocking: Blocking applications with specific behaviors (e.g., Excessive Bandwidth)
High-Risk Application Blocking
Quarantine Action: Temporarily isolating a client due to application usage (e.g., YouTube Play timeout)
Monitoring application control events and troubleshooting
Day 14: Application Control Advanced Configuration | Live Class 🟢
Day 14: Application Control Advanced Configuration | Class Recording 🔴🎥

Day 15: Intrusion Prevention System (IPS)

IPS Overview: Detecting and preventing network attacks, protecting against exploits
IPS Components: IPS signature databases, protocol decoders, IPS engine
IPS Sensors: Collections of IPS signatures and filters, severity levels
Action Types: Block, Reset, Monitor, Quarantine for specific signatures
Blocking Malicious URLs/Command and Control (C2) traffic
Vulnerability Types: SQL Injection, Cross-Site Scripting (XSS), Buffer Overflows, Path Traversal, Code Injection
Monitoring IPS logs and security dashboard
Day 15 Quiz 01: IPS Overview & Components
Day 15 Quiz 02: IPS Action Types & Vulnerabilities
Day 15: Intrusion Prevention System (IPS) | Live Class 🟢
Day 15: Intrusion Prevention System (IPS) | Class Recording 🔴🎥
Day 15: Intrusion Prevention System (IPS) Part II (Practical) | Class Recording 🔴🎥

Day 16: DoS Prevention

Denial of Service (DoS) Prevention Overview: Protecting network resources from flood attacks
DoS Policy Configuration: Defining source/destination, service, and anomaly thresholds
ICMP Flood Protection: Detecting and blocking excessive ICMP packets to a destination
TCP SYN Flood Protection: Mitigating SYN flood attacks by setting thresholds for TCP SYN requests
ICMP Sweep Detection: Identifying attackers scanning multiple IPs with ICMP
TCP Port Scan Detection: Blocking clients attempting to scan ports on internal servers
Quarantine Action for Attackers (CLI): Blocking source IP for a period (e.g., 5 minutes)
Monitoring DoS anomaly logs
Lab 16 - DoS Policy Configuration & Anomaly Control
Day 16 Quiz 01: DoS Prevention Overview & Policy Configuration
Day 16 Quiz 02: DoS Protection Techniques & Troubleshooting
Day 16: DoS Prevention | Live Class 🟢
Day 16: DoS Prevention | Class Recording 🔴🎥

Day 17: Site-to-Site IPsec VPN

IPsec VPN Basics: Benefits (secure remote access), encapsulation (tunnel mode), negotiation, authentication
IKE Phase 1 & Phase 2: Understanding the two phases of tunnel establishment, proposals (encryption, hashing, DH groups), selectors (encryption domain)
IPsec Wizard: Simplifying configuration for site-to-site VPNs
Manual IPsec Configuration: Configuring Phase 1 (Network, Authentication, Proposals, XAUTH) and Phase 2 (Selectors, Proposals) settings
Route-Based IPsec VPNs: Using virtual tunnel interfaces
Firewall Policies for IPsec Traffic: Allowing traffic through the VPN tunnel
Troubleshooting IPsec VPNs (Phase 1/2 mismatches, routing, permissions)
Lab 17.1: Site-to-Site IPsec VPN (Wizard & Manual) with Failover
Day 17 Quiz 01: IPsec VPN Overview & Configuration
Day 17 Quiz 02: IPSec Configuration & Troubleshooting
Day 17: Site-to-Site IPsec VPN | Live Class 🟢
Day 17: Site-to-Site IPsec VPN | Class Recording 🔴🎥

Day 18: SSL VPN (Remote Access)

SSL VPN Overview: Providing remote users secure access to the internal network
SSL VPN Deployment Modes: Focusing on Tunnel Mode using FortiClient (virtual adapter)
SSL VPN Portals: Configuring portal settings, split tunneling (policy-based destination), enabling/disabling web mode
IP Pools: Defining IP address ranges for SSL VPN clients
SSL VPN Settings: Defining listeners (interface, port), authentication realms
Firewall Policies for SSL VPN: Allowing access from SSL VPN interface to internal resources
FortiClient Usage: Connecting to SSL VPN
Troubleshooting SSL VPN (routing, permissions, portal settings)
Lab 18.1 – SSL VPN (Tunnel Mode) for Remote Access
Day 18 Quiz 01: SSL VPN Overview & Configuration
Day 18 Quiz 02: SSL VPN Portal & Troubleshooting
Day 18: SSL VPN (Remote Access) | Live Class 🟢
Day 18: SSL VPN (Remote Access) | Class Recording 🔴🎥

Day 19: User Authentication & 2FA

Administrator Access Control: Securing management access to FortiGate
Local Accounts: Creating and managing local administrator accounts
Remote Server Accounts: Integrating with external authentication servers (LDAP, RADIUS) for user and administrator authentication
Authentication Policies: Enforcing authentication for traffic flows (Active/Passive)
Two-Factor Authentication (2FA): Enhancing security for admin and user access
FortiToken: Generating One-Time Passwords (OTPs), time-based, FortiToken Mobile, Push Notifications
NTP server importance for 2FA synchronization
Lab 19.1: Administrator Access Control and Two-Factor Authentication (2FA)
Day 19 Quiz 01: Administrator Access Control & Authentication
Day 19 Quiz 02: Two-Factor Authentication & FortiToken
Day 19: User Authentication & 2FA | Live Class 🟢
Day 19: User Authentication & 2FA - PART I | Class Recording 🔴🎥
Day 19: User Authentication & 2FA - PART II | Class Recording 🔴🎥

Day 20: High Availability (HA)

HA Overview: Enhanced reliability and increased performance using multiple FortiGate devices
HA Requirements: Same model, firmware, licensing, hard drive configuration, operating mode
HA Operation Modes: Active-Passive (Primary/Secondary tasks), Active-Active (session distribution)
HA Cluster Synchronization: Configuration, FIB entries, DHCP leases, ARP table, FortiGuard definitions, IPSec tunnel SAs
HA Failover Types: Detecting failures, virtual MAC addresses
Monitoring HA Status (GUI widget, CLI commands)
Lab 20.1: FortiGate High Availability (Active-Passive)
Day 20 Quiz 01: High Availability (HA) Overview & Configuration
Day 20 Quiz 02: HA Operation Modes & Troubleshooting
Day 20: High Availability (HA) | Live Class 🟢
Day 20: High Availability (HA) | Class Recording 🔴🎥

Day 21: SD-WAN Configuration

SD-WAN Overview: Software-defined approach to steer WAN traffic, use cases (DIA, site-to-site)
SD-WAN Components: Members (physical/logical interfaces), Zones (logical grouping of members)
SD-WAN Rules: Defining traffic steering policies based on criteria (source/destination, internet service, application)
Traffic Steering Strategies: Manual (interface preference), Best Quality (based on SLA measurements like latency, jitter, packet loss), Lowest Cost
Monitoring SD-WAN (traffic logs, link usage, quality status)
Day 21: SD-WAN Configuration | Live Class 🟢
Day 21: SD-WAN Configuration | Class Recording 🔴🎥 (PART I)
Day 21: SD-WAN Configuration | Class Recording 🔴🎥 (PART II)
Day 21 Quiz 01: SD-WAN Overview & Core Components
Day 21 Quiz 02 : SD-WAN Rules & Monitoring

Day 22: Fortinet Security Fabric

Fortinet Security Fabric Definition: Holistic network security solution, centralized management, automated defense
Participating Devices: FortiGate (root/downstream), FortiAnalyzer, FortiSandbox, FortiManager, FortiClient, etc
Benefits: Consistent objects, centralized logging (FortiAnalyzer/Cloud), automated actions, improved security posture
Deploying the Security Fabric: Adding FortiGates as downstream devices
Global Address Objects: Synchronizing address objects across fabric members
Automation Stitches: Triggers (e.g., virus logs), Actions (e.g., email notification, quarantine)
Security Rating: Identifying security gaps and prioritizing tasks
Day 22 Quiz 01: Security Fabric Overview & Components
Day 22 Quiz 02: Security Fabric Configuration & Monitoring
Day 22: Fortinet Security Fabric | Live Class 🟢
Day 22: Fortinet Security Fabric | Class Recording 🔴🎥

Day 23: Diagnostics & Troubleshooting

Troubleshooting Methodology: The RAP acronym (Routing, Address Translation, Permissions) as a guiding principle
General Diagnosis: Monitoring abnormal behavior, traffic spikes, physical/network layer issues
Packet Sniffer: Capturing traffic on interfaces, filtering options, saving as PCAP
Debug Flow: Real-time analysis of packet processing through FortiGate kernel
diagnose sys session list: Viewing active sessions, filtering by source/destination
execute ping, execute traceroute: Basic connectivity and path analysis
Log Analysis: Forward traffic logs, security event logs (AV, Web Filter, IPS, App Control)
CPU and Memory Diagnosis: diagnose sys top, process monitor, conserve mode, high CPU/memory troubleshooting
Day 23: Diagnostics & Troubleshooting | Class Recording 🔴🎥

Day 24: Course Review & Exam Preparation

Comprehensive Review: Revisit key concepts from all modules (Fundamentals, Policies, Security Profiles, VPNs, HA, SD-WAN, Security Fabric, Troubleshooting)
Key Configuration Steps: Summarize essential configurations for each feature
Common Troubleshooting Scenarios: Review previous troubleshooting assignments and discuss best practices
FortiGuard Services: Recap their role and importance across different security features
FortiGate Study Guide Navigation: How to use the official documentation for further study
Exam Tips and Strategies: Approach to different question types, time management
Day 24: Course Review & Exam Preparation | Live Class 🟢

text lesson

VPN Access for Students: reach the lab safely

Why a VPN?

To isolate the lab networks, enforce identity/MFA, and ship the right routes/DNS so management portals are reachable securely.

What you’ll receive from us

Sophos Connect installer (Windows .msi / macOS .pkg).

A prebuilt VPN profile file DTK-Cyber-Academy-training-vpn.ovpn.

Credentials + MFA instructions.

Lab URLs/IPs and test targets.

What success looks like

You connect, receive a VPN IP, can ping the lab gateway, and can open the FortiGate HTTPS management page and the lab portal.

Enrol to track your progress

No questions yet.