Segmented policy build
Build LAN, DMZ and inter-zone policy with source and destination NAT from a written requirement, then verify each rule matches as intended.
FortiGate Firewall Training
Fourteen modules on FortiGate, from packet flow and policy to SSL inspection, IPsec VPN, High Availability and central management with FortiManager and FortiAnalyzer.
Enroll Now
- Section
- Network Security
- Trained
- 3,000+
Course overview
FortiGate Firewall Training is a intermediate-level course from Tungabadra Networks. It covers 14 modules, is delivered classroom, online (live), corporate (on-site), and includes 3 applied projects. It prepares for Fortinet FortiGate Firewall Administration.
FortiGate Firewall Training covers the platform as it is actually run: how FortiGate processes a packet, how interfaces, zones, policy and NAT fit together, and how to prove a configuration works before it reaches production.
The course moves from firewall fundamentals through the features an enterprise estate depends on - Active Directory SSO, SSL inspection, web filtering, remote-access SSL VPN and site-to-site IPsec - and then to running more than one firewall: Active-Passive and Active-Active High Availability, FortiClient and ZTNA, and centralised policy and log management with FortiManager and FortiAnalyzer.
Troubleshooting is treated as a skill in its own right rather than a closing module. Packet flow, session table inspection, packet capture and the FortiOS diagnose commands are used throughout.
Who this course is for
- Network engineers adding a security specialisation
- Engineers supporting or inheriting a Fortinet estate
- CCNA holders moving toward security roles
- Firewall administrators moving from another vendor to FortiGate
What you will be able to do
By the end of FortiGate Firewall Training, you will be able to:
- Configure and administer FortiGate firewalls
- Implement firewall policies, NAT and network segmentation
- Deploy and troubleshoot site-to-site IPsec and remote-access VPNs
- Configure web filtering and SSL inspection
- Troubleshoot packet flow, routing and connectivity issues
- Implement FortiGate High Availability
- Manage firewalls centrally and analyse logs with FortiManager and FortiAnalyzer
Skills covered
- Firewall policy
- Source and destination NAT
- Packet flow analysis
- SSL inspection
- Web filtering
- SSL VPN
- IPsec VPN
- High Availability
- FortiOS CLI
- FortiManager
- FortiAnalyzer
- FortiClient and ZTNA
Curriculum
14 modules of instruction and lab work.
Firewall Fundamentals
5 topics
- Firewalls and their place in network security
- Traditional firewall vs next-generation firewall
- FortiGate models: 40F, 100F, 200F and 600F series
- Virtual Domains (VDOMs)
- Deployment modes: NAT/Route, Transparent and VDOM
Packet Flow and Processing
7 topics
- Packet processing inside FortiGate
- Packet ingress and interface processing
- Session lookup and the session table
- Routing lookup and firewall policy matching
- NAT processing and security profile inspection
- Session creation and management
- Forwarding and drop decisions
Basic FortiGate Lab Configuration
6 topics
- Interfaces and zones
- Interface configuration and IP addressing
- Creating and managing firewall policies
- Source NAT and destination NAT
- Inter-zone, LAN and DMZ configuration
- Connectivity testing and verification
Firewall Troubleshooting
7 topics
- Troubleshooting connectivity issues
- Firewall policy verification
- NAT and routing troubleshooting
- Session table inspection
- Packet capture and traffic analysis
- Log analysis and common firewall faults
- diagnose debug flow, diagnose sniffer packet, diagnose sys session list
Upgrade and Configuration Backup
6 topics
- Backing up a running configuration
- FortiOS firmware versions
- Pre-upgrade checks and compatibility
- Upgrade procedure and post-upgrade verification
- Restore and rollback
- Upgrade planning
Single Sign-On (SSO)
6 topics
- Single Sign-On and user identification
- The FortiGate SSO agent
- Active Directory integration
- User and group identification
- Policy for authenticated users
- Monitoring and troubleshooting SSO
SSL Inspection
6 topics
- SSL/TLS inspection and certificates
- Certificate-based vs deep inspection
- Inspection profiles and applying them to policy
- Certificate authority and client trust
- Antivirus, web filtering, IPS and application control
- SSL inspection troubleshooting
SSL VPN
6 topics
- Remote-access SSL VPN
- Portal configuration
- User and group authentication
- VPN access policy
- Client configuration and split tunneling
- Connectivity testing and troubleshooting
Web Filtering
6 topics
- URL filtering and website categories
- Web filter profiles: allow, block and monitor
- Overrides and exemptions
- Application control alongside web filtering
- Business access policy
- Web filtering logs and reporting
IPsec VPN
7 topics
- Site-to-site IPsec VPN
- Phase 1 and Phase 2
- IKE versions and negotiation settings
- Pre-shared key and certificate authentication
- Tunnel verification and routing over IPsec
- NAT and policy for VPN traffic
- Head office to branch connectivity and monitoring
High Availability
6 topics
- Active-Passive and Active-Active modes
- Cluster configuration and heartbeat interfaces
- Configuration and session synchronisation
- Failover and failback
- Primary and secondary unit management
- Troubleshooting HA
FortiClient
6 topics
- Features, installation and deployment
- Remote-access VPN configuration
- Endpoint security and monitoring
- Zero Trust Network Access (ZTNA) fundamentals
- Fabric Agent integration
- Troubleshooting the client
FortiManager
6 topics
- Centralised management and device onboarding
- Administrative domains (ADOMs) and policy packages
- Centralised firewall policy management
- Templates, provisioning and firmware management
- Configuration synchronisation
- Monitoring and troubleshooting
FortiAnalyzer
6 topics
- Centralised logging and device registration
- Log collection, filtering and investigation
- Reports, dashboards and FortiView
- Traffic and event log analysis
- FortiSwitch, FortiAP and FortiClient log integration
- Investigating an incident from logs
Projects you will complete
Branch tunnel under fault
Bring up a site-to-site IPsec tunnel to a misconfigured peer and diagnose each phase in turn using the diagnose commands.
HA pair and failover
Build an Active-Passive cluster, confirm configuration and session synchronisation, then force a failover and account for what the traffic did.
Prerequisites
- Working knowledge of TCP/IP, routing and NAT
- CCNA Advanced Training or equivalent experience
- Comfortable working at a CLI
Certification
Course completion certificate
Issued on completion. The certificate lists the modules completed and the skills applied. Tungabadra Networks is not an authorized training partner of this vendor and does not administer or issue the exam. Exams are booked and paid for directly with the vendor.
This course also covers the topic areas assessed by the following third-party exams:
- Fortinet FortiGate Firewall Administration
Career opportunities
Roles this course is designed to prepare you for in the US job market:
Network Security Engineer
Configures and manages FortiGate firewall deployments.
SOC / Security Analyst
Monitors, investigates and responds to firewall security events.
Firewall Administrator
Runs day-to-day policy, VPN and HA operations on FortiGate.
Implementation Engineer
Deploys and migrates firewall estates for clients.
Frequently asked questions
Is this hands-on or lecture based?
Hands-on. Configuration, troubleshooting and the HA and VPN modules are all done on lab firewalls, and the diagnose commands are used throughout rather than demonstrated once.
Do I need security experience?
No, but you do need solid TCP/IP, routing and NAT knowledge, because most FortiGate faults turn out to be routing or NAT faults. CCNA Advanced Training covers that ground.
I already administer another vendor's firewall. Is this still useful?
Yes. The concepts carry over, so the value is in FortiGate's specifics: how it matches policy, how its session table and packet flow behave, and how FortiManager and FortiAnalyzer change the way an estate is run.
Does this cover more than one firewall?
Yes. High Availability, FortiManager and FortiAnalyzer are part of the course, so it covers running an estate rather than configuring a single unit.
Related courses
Next-generation firewall training taught by a former Palo Alto TAC engineer: policy, App-ID, VPN, NAT and real troubleshooting.
$220
The step past CCNA: MPLS, BGP, advanced OSPF, VPNs and the security that enterprise and service provider networks actually run on.
$350
Junos from the ground up: the CLI and configuration model, routing policy, firewall filters and how Junos differs from IOS in practice.
$150
Questions about FortiGate Firewall Training?
Tell us your background and we will confirm whether this course is the right level, or point you to a better starting point.