Domain 1: System Troubleshooting
- Use diagnose sniffer packet <interface> '<filter>' <verbosity> to capture traffic; verbosity 4 or 6 shows headers and interfaces, which reveals whether packets arrive and leave.
- Use diagnose debug flow to trace how the FortiGate processes a packet and see the drop reason - policy, route, reverse-path, or session lookup.
- Inspect sessions with diagnose sys session filter and diagnose sys session list to see state, NAT, and which policy handled the flow.
- Check load with get system performance status and get system performance top; watch for conserve mode when memory crosses its threshold.
- Understand hardware offload (NP/SP): offloaded sessions may not appear in a CPU-based sniffer, so disable offload when you need to see all packets.
- Build and troubleshoot the Security Fabric: a root FortiGate with authorized downstream devices, fabric connectors, and communication over the expected ports.
- Automation stitches pair a trigger (event log, webhook, scheduled) with an action (email, webhook, CLI script); a stitch that never fires is usually a trigger or minimum-interval issue.
- FGCP HA runs active-passive or active-active with heartbeat interfaces, device priority, and override; a checksum mismatch (diagnose sys ha checksum) means the cluster is out of sync.
- Read HA state with get system ha status and diagnose sys ha status, and know failover, session pickup, and monitored-interface behavior.
- For general connectivity, check interface and link state, the ARP table, MTU/MSS, and watch for asymmetric routing.
Domain 2: Authentication
- Firewall authentication can be active (the user is prompted) or passive (identity learned another way); a policy with a user group triggers the prompt.
- Configure remote servers - LDAP (bind and search for group membership) and RADIUS (PAP, CHAP, MSCHAPv2, and vendor attributes) - and test them with diagnose test authserver.
- Debug authentication with diagnose debug application fnbamd to see why a login against LDAP or RADIUS fails.
- Add two-factor authentication with FortiToken, email, or SMS, and use certificate-based or SAML authentication where required.
- Captive portal presents a login on an interface, with disclaimer and exempt options and configurable auth timeout.
- FSSO provides transparent single sign-on: agent-based mode uses DC Agents plus a Collector Agent, while agentless mode has the FortiGate poll the domain controller.
- In DC Agent mode, DC agents send logon events to the Collector Agent, which forwards the user-to-IP mapping to the FortiGate over TCP 8000.
- Troubleshoot FSSO with diagnose debug authd fsso list to see the FortiGate's user list, and check group filters, ignore lists, and timers when a user is missing or stale.
- Use FSSO groups in firewall policies, and filter out service accounts so they do not create incorrect mappings.
- When authentication fails, traffic that requires it is denied, so confirm server reachability, group matching, and the auth rule.
Domain 3: Security Profiles
- FortiGuard delivers web filter, IPS, antivirus, DNS, and application signatures; confirm connectivity and licensing with diagnose debug rating and the server list.
- Web filtering can run in flow-based or proxy-based inspection; FortiGuard category filtering, URL filters, and web rating overrides each play a role, and URL filters are evaluated before FortiGuard categories.
- Web filter actions include allow, block, warning, authenticate, and monitor, plus quotas; a certificate or deep-inspection profile is needed to filter HTTPS.
- IPS uses sensors built from signature filters (by severity, target, protocol, or application) with actions such as pass, block, reset, or quarantine.
- Tune IPS for false positives by disabling or exempting a specific signature, and use IPS packet logging to confirm what triggered.
- Antivirus runs flow-based or proxy-based, with database tiers and an oversized-file action; encrypted or oversized files may bypass scanning.
- Application control matches application signatures and categories; many applications require SSL deep inspection to be identified.
- Full inspection of encrypted traffic requires an SSL/TLS inspection profile (certificate inspection versus deep inspection).
- Multiple security profiles can apply to one firewall policy in a defined inspection order.
- Read the security logs to confirm which profile blocked a flow and why.
Domain 4: Routing
- FortiGate selects routes by longest prefix, then administrative distance, then priority; equal routes can load-balance with ECMP.
- Inspect routing with get router info routing-table all and get router info routing-table details <prefix>, and compare the RIB with the FIB.
- Static routes cover default, blackhole, and recursive routes, and use link monitoring or distance and priority to prefer one path.
- Policy routes (policy-based routing) are evaluated before the routing table, so a matching policy route overrides the normal lookup.
- Reverse-path forwarding (RPF) anti-spoofing (strict or loose) can drop a packet whose source is not reachable back out the incoming interface - a common cause of asymmetric-routing drops.
- OSPF adjacencies progress Down, Init, 2-Way, ExStart, Exchange, Loading, Full; mismatched hello/dead timers, area, or network type prevent Full.
- Know OSPF areas (backbone, stub, NSSA), DR/BDR election, LSA types, passive interfaces, and redistribution, and troubleshoot with get router info ospf neighbor.
- BGP peers move through Idle, Connect, Active, OpenSent, OpenConfirm, Established; a stuck session usually means TCP 179, wrong remote-as, or an update-source/multihop issue.
- BGP best-path selection weighs weight, local-preference, AS-path length, MED, and origin; route maps, prefix lists, and AS-path filters shape advertisements.
- Troubleshoot BGP with get router info bgp summary and get router info bgp neighbors, and clear a session with execute router clear bgp.
Domain 5: VPN
- IPsec negotiates IKE Phase 1 (encryption, hash, DH group, lifetime, authentication) and Phase 2 (the child SA and selectors); a proposal mismatch in either phase stops the tunnel.
- IKEv2 differs from IKEv1: fewer messages, built-in dead peer detection, EAP support, and different rekey behavior; IKEv1 uses main or aggressive mode.
- Authenticate peers with a pre-shared key or certificate; a PSK or peer-ID mismatch causes Phase 1 to fail.
- Prefer route-based (tunnel interface) VPNs, which need a route to the remote subnet and a firewall policy for traffic to pass, unlike policy-based VPNs.
- A tunnel that is up but passes no traffic usually has a missing route, a missing or wrong firewall policy, or a quick-mode selector mismatch.
- Troubleshoot with diagnose vpn ike gateway list, diagnose vpn tunnel list, and diagnose debug application ike -1 to see which phase failed and why.
- Dial-up IPsec serves many remote peers from one Phase 1 using peer IDs and mode-config to assign client addresses.
- ADVPN builds on-demand shortcut tunnels between spokes of a hub-and-spoke design, with a dynamic routing protocol over the overlay.
- SSL VPN offers web mode (portal and bookmarks) and tunnel mode (FortiClient with an IP pool and split tunneling); troubleshoot with diagnose debug application sslvpn -1 and get vpn ssl monitor.
- Tunnel-mode SSL VPN clients need routing to internal subnets and firewall policies from the ssl.root interface to reach resources.
Fortinet Secure Networking (FortiGate) exam tips
- This is a troubleshooting exam, so master the diagnostic toolkit first: diagnose sniffer packet, diagnose debug flow, diagnose sys session list, get router info routing-table, diagnose vpn ike gateway list, and diagnose debug application (fnbamd, ike, sslvpn). Expect to read output and identify the fix.
- For System Troubleshooting, be fluent with FGCP HA (checksum mismatch means out of sync, heartbeat and override drive failover), Security Fabric formation, and conserve mode. Remember that hardware-offloaded sessions may not show in a CPU sniffer.
- For Authentication, keep local/LDAP/RADIUS firewall auth separate from FSSO in your head. For FSSO, know agent-based (DC Agent plus Collector Agent, TCP 8000) versus agentless polling, and diagnose debug authd fsso list to see the user list.
- For Routing, memorize route selection (longest prefix, then administrative distance, then priority), the OSPF adjacency states and what breaks them, and the BGP session states and best-path attributes. RPF drops and policy-route precedence are common gotchas.
- For VPN, most failures are a Phase 1 or Phase 2 proposal, PSK, or selector mismatch, or - when the tunnel is up but traffic fails - a missing route or firewall policy. Practice reading ike debug output to tell which phase failed.
Study guide FAQ
What is the format of the Network Security Support Engineer exam?
It is 35 to 45 multiple-choice questions in 75 minutes, based on FortiOS 7.6, delivered through Pearson VUE. Like other Fortinet exams it is graded pass or fail and Fortinet does not publish a numeric passing score.
Is this an FCSS or an NSE exam?
It is part of the current FCSS Network Security certification track (Fortinet's Certified Solution Specialist tier, formerly the NSE 6 level). Fortinet has been transitioning its NSE program to the FCA/FCP/FCSS naming; this Support Engineer exam is one of the exams that count toward the FCSS in Network Security.
How much hands-on FortiGate experience do I need?
A lot. This is a support-engineer, troubleshooting exam aimed at people who administer and support an infrastructure of many FortiGate devices. You should be comfortable in the FortiOS CLI with the diagnostic commands, not just the GUI.
How is it different from the FortiGate Administrator (NSE 4) exam?
The FortiGate Administrator exam is about deploying and configuring a FortiGate. The Support Engineer exam is about diagnosing and troubleshooting an existing enterprise deployment - HA, Security Fabric, authentication and FSSO, security profiles, routing protocols, and IPsec VPN - so it goes deeper on debugging and reading output.
Is CertGrid's practice official Fortinet material?
No. CertGrid is an independent practice platform and is not affiliated with or endorsed by Fortinet. These questions are original and written to mirror the current exam's five objective areas and FortiOS 7.6 CLI style so you can rehearse the objectives. Always confirm the current exam description on the official Fortinet Training Institute page before your exam.
Official exam sources
This exam's current identity is unresolved, so the domains on this page have not been confirmed against any published blueprint. The note below says why, and each source records what it did confirm and when it was read.
- Fortinet - certification program (NSE levels)link and content verified 8 September 2026Fortinet's Secure Networking track, which is what this guide is named after, exists at three levels rather than one: "NSE 5: Secure Networking", "NSE 6: Secure Networking" and "NSE 7: Secure Networking", the last of which "validates your ability to design, administer, monitor, and troubleshoot Fortinet network security solutions" - the closest match to this bank's troubleshooting-led domains. Real prerequisites, and they are eligibility: NSE 7 requires "NSE 4 certification" plus "NSE 5 or NSE 6 certification in Secure Networking". Read through a rendered browser.
- Fortinet - exam policy: exam results and score reportlink and content verified 8 September 2026Why neither Fortinet guide shows a numeric pass mark. Fortinet reports a pass or fail result and no cut score: "Exam grades are based on overall exam performance, not on individual section performance", subscores appear "in a bar chart based on a 0-100% scale", and "Section-based exam results are shown for reference only." Its own FAQ article titled "What is my exam passing grade or score?" answers by pointing back at this policy rather than giving a figure. So the 700 in our exam metadata is the CertGrid mock threshold, the numeric fact is withheld, and the page now says so instead of leaving a gap.
This page and the current vendor source differ. This guide is titled "Fortinet Secure Networking (FortiGate)" without a level or an exam code, and its own exam-facts note already tells the reader to confirm the current code before booking - which is the right caution but not a resolution. Fortinet's Secure Networking track spans NSE 5, NSE 6 and NSE 7, and our domains (system troubleshooting, authentication, security profiles, routing, IPsec VPN) read closest to NSE 7, whose prerequisites are NSE 4 plus an NSE 5 or NSE 6 in the same track. Naming a level means checking the bank against that level's objectives, so it is recorded as an exam-identity task rather than assigned here. The 40 questions and 75 minutes on this guide are also unverified: Fortinet publishes neither on its certification pages.