Skip to content
Fortinet exam NSE 4 · FortiOS 8.0

Fortinet NSE 4 FortiOS Bootcamp

A 12-lecture course for the Fortinet NSE 4 FortiOS 8.0 Administrator exam, covering its five domains: system configuration, firewall policies and authentication, content inspection, routing and VPNs. Each lecture pairs a live class with notes and a 10-question exam-style quiz, and you build its lab in your own EVE-NG on the free FortiGate-VM permanent trial, from a task sheet with a solution guide.

When this course was written, Fortinet listed the FortiOS 8.0 version of the NSE 4 exam as not yet released and the 7.6 version as available. Most topics are the same in both, and each lecture points out what is new in 8.0. Check Fortinet's exam page for the current version and fee.

Enroll in Fortinet NSE 4 FortiOS →See curriculum
Duration
6 weeks
Format
Live online + self-study
First class
Free, no obligation
Level
CCNA level knowledge
Schedule
Evenings, US time zones
Lectures
12 (notes · lab · quiz)
Exam
Fortinet NSE 4
Exam details
50 to 60 questions · 100 min · fee set by Fortinet
Tuition
$500 per student, batch of 3 to 5 · payment plans
Exam domains

What you'll master.

1.025 to 35% of exam

Deployment and System Configuration

  • Factory defaults, administrative access, DHCP, backups and firmware
  • Logging, FortiAnalyzer and telemetry
  • FGCP high availability and diagnostics
  • FortiGate-VM in the public cloud and FortiSASE
2.020 to 25% of exam

Firewall Policies and Authentication

  • Firewall policies, inspection modes and tags
  • Source NAT, IP pools and virtual IPs
  • LDAP, RADIUS, active authentication and FSSO
3.025 to 30% of exam

Content Inspection

  • Certificate inspection and full SSL inspection
  • Web filtering and DLP for GenAI chatbots
  • Application control, antivirus and IPS
4.010 to 15% of exam

Routing

  • Static routes, distance, priority and ECMP
  • SD-WAN members, zones, performance SLAs and rules
5.010 to 15% of exam

VPNs

  • Route-based IPsec tunnels and IKEv2
  • Redundant site-to-site VPN between two FortiGates
  • TLS 1.3-based negotiation and quantum-safe IPsec
Lecture by lecture

The complete 12-lecture path.

Every lecture includes a live class, self-study notes, a 10-question exam-style quiz and a lab you build in your own EVE-NG from a task sheet, with a solution guide to check your work.

01FortiGate Basics, the Exam and Initial Setup
  • FortiGate, FortiOS and the Security Fabric (Domain 1)
  • Factory defaults, interfaces and administrative access (Domain 1)
  • DHCP server, FortiGuard licenses, backup, restore and firmware (Domain 1)
  • The FortiOS CLI, and FortiAI and GenAI on the CLI (Domain 1)

LAB Build the EVE-NG base lab, activate the free trial and give FGT1 its first settings (EVE-NG, task sheet and solution guide)

02Firewall Policies, Inspection Modes and Tagging
  • Policy fields, top-down first match and the implicit deny (Domain 2)
  • Address, service and schedule objects and the ISDB (Domain 2)
  • Flow-based vs. proxy-based inspection, and policy traffic logs (Domain 2)
  • Tags, dynamic tag groups and finding the matching policy (Domain 2)

LAB Firewall policies, objects, logs and finding the matching policy (EVE-NG, task sheet and solution guide)

03NAT: SNAT, IP Pools and Virtual IPs
  • Source NAT with the outgoing interface address (Domain 2)
  • The four IP pool types (Domain 2)
  • Virtual IPs for destination NAT and port forwarding (Domain 2)
  • Hairpin NAT, central NAT and NAT in the session table (Domain 2)

LAB Source NAT, an IP pool, virtual IPs and port forwarding (EVE-NG, task sheet and solution guide)

04Firewall Authentication: LDAP, RADIUS and FSSO
  • Local users, LDAP and RADIUS servers, and user groups (Domain 2)
  • Active authentication in a policy (Domain 2)
  • Passive FSSO with DC agents, a collector agent or polling (Domain 2)
  • Monitoring users, FSSO login problems, and FSSO vs. ZTNA identity (Domain 2)

LAB Local users, a user group and an identity policy (EVE-NG, task sheet and solution guide)

05Logging, Telemetry and FortiAnalyzer
  • Log types, subtypes and severity levels (Domain 1)
  • Logging in policies and where logs are stored (Domain 1)
  • Sending logs to FortiAnalyzer, searching logs and FortiView (Domain 1)
  • Session helper statistics and telemetry (Domain 1)

LAB What gets logged, where it goes, and how to find it (EVE-NG, task sheet and solution guide)

06Certificates and SSL Inspection
  • TLS, certificates and the chain of trust (Domain 3)
  • TLS 1.3 key negotiation (Domain 3)
  • Certificate inspection vs. full SSL inspection (Domain 3)
  • Fortinet_CA_SSL or a private CA, exemptions and certificate problems (Domain 3)

LAB Certificates and SSL inspection (EVE-NG, task sheet and solution guide)

07Web Filtering and DLP for GenAI
  • Flow and proxy web filtering, and what HTTPS hides (Domain 3)
  • FortiGuard categories, actions and rating errors (Domain 3)
  • Static URL filters, the order of checks and overrides (Domain 3)
  • A DLP profile that stops sensitive text from reaching GenAI chatbots (Domain 3)

LAB Web filtering with a static URL filter, a local category and rating errors (EVE-NG, task sheet and solution guide)

08Application Control, Antivirus and IPS
  • Application control, and profile-based vs. policy-based NGFW mode (Domain 3)
  • Antivirus in flow and proxy mode, protocol options and EICAR tests (Domain 3)
  • IPS sensors and high CPU (Domain 3)
  • New in FortiOS 8.0: AI/ML DNS tunneling detection and the larger SaaS database (Domain 3)

LAB Antivirus, application control and IPS (EVE-NG, task sheet and solution guide)

09Static Routing and SD-WAN
  • The routing table, the FIB, distance and priority (Domain 4)
  • ECMP, floating routes, link monitors and policy routes (Domain 4)
  • SD-WAN zones, members, performance SLAs and rules (Domain 4)
  • New in FortiOS 8.0: steering by underlay bandwidth (Domain 4)

LAB Two Internet links: static routes, a link monitor and SD-WAN (EVE-NG, task sheet and solution guide)

10IPsec VPN: Redundant Site-to-Site
  • Route-based tunnels and IKEv2 (Domain 5)
  • The VPN wizard and the same tunnel in the CLI (Domain 5)
  • A redundant VPN between two FortiGates (Domain 5)
  • IPsec logs, the IKE debug, TLS 1.3 negotiation and quantum-safe IPsec (Domain 5)

LAB Redundant site-to-site IPsec VPN between two FortiGates (EVE-NG, task sheet and solution guide)

11High Availability (FGCP) and Diagnostics
  • FGCP clusters and how the primary is elected (Domain 1)
  • Session synchronization, the HA management interface and cluster upgrades (Domain 1)
  • The sniffer and debug flow (Domain 1)
  • High CPU, high memory and conserve mode (Domain 1)

LAB Sniffer, debug flow and resource checks, then an optional FGCP cluster (EVE-NG, task sheet and solution guide)

12FortiGate in the Cloud, FortiSASE, FortiAI and Exam Review
  • FortiGate-VM in AWS and Azure, and automation-ready configurations (Domain 1)
  • FortiSASE architecture and security features (Domain 1)
  • ZTNA, identity and tags; DLP for GenAI and FortiData labels (Domain 1)
  • A review of every NSE 4 FortiOS 8.0 objective

LAB REST API, an automation stitch, revisions and a final command review (EVE-NG, task sheet and solution guide)

Outcomes

By the end you will

  • Set up a FortiGate from factory defaults with safe administrative access
  • Write firewall policies with NAT, user authentication and security profiles
  • Inspect SSL traffic and apply web filtering, application control, antivirus and IPS
  • Build SD-WAN and redundant IPsec VPNs, and troubleshoot them from the CLI
Career paths

Roles this prepares you for

Firewall AdministratorNetwork Security EngineerNetwork Engineer (Jr.)NOC Technician

Includes resume review, LinkedIn optimization and mock interviews focused on the US job market.

Next cohort

Ready to start Fortinet NSE 4 FortiOS?

Book a free consultation. We will confirm the next start date in your time zone and walk you through tuition and payment plans.

Your first class is free. By sending this form you agree to our Privacy Policy. We never sell your information.