Overview
Domain 2 covers the rules that decide whether traffic passes and as whom. Its four objectives are configuring firewall policies (match criteria, inspection modes and traffic logging), configuring SNAT and DNAT options (outgoing interface NAT, IP pools and virtual IPs), configuring firewall authentication with local users and remote LDAP or RADIUS servers in active or passive form, and deploying Fortinet Single Sign-On with DC agents or a collector agent.
FortiGate policies are evaluated from the top down, and the first match wins, with an implicit deny at the end. NAT and identity are attributes of the matched policy, so most questions come back to one skill: working out which policy a session hits and what that policy does to it. Expect scenarios built around policy lists, IP pool types, VIP behavior and users who are not being identified.
How it's tested
Items in this area often display a policy list, a VIP or IP pool configuration, or a user monitor screen. You decide which policy matches a flow, what address the traffic leaves with, or why a user is treated as unauthenticated. Read the interfaces, addresses and services column by column before answering.
-
Which policy matches
A policy table and a traffic flow are given, and you select the first policy whose interfaces, addresses, schedule and service all match.
-
Choose the NAT method
A requirement such as fixed source ports or one public IP per user is described, and you choose the IP pool type or VIP setup.
-
Why is the user not identified
Users fall through to a guest or deny rule, and you identify the FSSO, LDAP or group membership problem.
Policy 7 allows LAN to WAN for all sources, and policy 3, placed below it in the sequence, denies one host to the same destination. Traffic from that host still passes. FortiGate checks policies by their order in the list, not by policy ID, and stops at the first match. Moving the deny rule above the broad allow fixes the problem.
Objectives 4
Official objectives from the Fortinet outline, in outline order.
2.1 Configure firewall policiesPolicy match criteria, order, inspection modes and traffic logs.
- What it means
- A firewall policy defines which traffic may cross the FortiGate and how it is handled. Each policy specifies incoming and outgoing interfaces, source and destination addresses or users, schedule, service, action, NAT, inspection mode, security profiles and logging.
- What to understand
- Policies are evaluated top down by sequence, and the first match applies; unmatched traffic hits the implicit deny. Policy IDs are labels and do not determine order. Each policy chooses flow-based or proxy-based inspection, which affects which security profile features are available. Logging can record security events only or all sessions. Internet Service Database objects can be used as destinations to match cloud services by name.
- How it shows up
- Expect to pick the matching policy from a table or explain why traffic is denied.
- Common confusion
- Believing a lower policy ID is checked first; the position in the list sets the order.
2.2 Configure source network address translation (SNAT) and destination network address translation (DNAT) options in firewall policiesOutgoing interface NAT, IP pool types and virtual IPs for DNAT.
- What it means
- SNAT changes the source address of outbound traffic, either to the outgoing interface IP or to an address from an IP pool. DNAT changes the destination of inbound traffic using a virtual IP (VIP) object, mapping a public address and optionally a port to an internal server.
- What to understand
- IP pool types include overload (many users share addresses with port translation), one-to-one (each internal host gets its own public IP), fixed port range (internal ranges map to fixed external ranges) and port block allocation (each user receives a block of ports). A VIP is selected as the destination in a policy from the external interface. A static NAT VIP also translates outbound traffic from that server when NAT is enabled, while a port-forwarding VIP maps only specified ports.
- How it shows up
- You may be asked which pool type meets a logging or port requirement, or why a VIP is not reachable.
- Common confusion
- Thinking a VIP alone publishes a server; a firewall policy must still allow the traffic.
2.3 Configure different methods of firewall authenticationLocal users, remote LDAP and RADIUS, active and passive authentication, user monitoring.
- What it means
- Firewall authentication ties a session to a user or group so policies can be written by identity. Users can be local to the FortiGate or validated by remote LDAP or RADIUS servers, and identification can be active (the user is prompted) or passive (identity learned without prompting).
- What to understand
- For LDAP, the FortiGate needs the server address, the common name identifier, the distinguished name to search and a bind type; regular bind uses a service account. RADIUS servers need the FortiGate added as a client with a matching shared secret. Active authentication triggers a login prompt when traffic matches a policy with a user group, which requires DNS to resolve first. Authenticated users appear on the firewall user monitor, where an administrator can de-authenticate them.
- How it shows up
- Expect questions on LDAP server fields, RADIUS secrets and why the login prompt does not appear.
- Common confusion
- Assuming authentication works before DNS is allowed; the browser must resolve names before it can be redirected.
2.4 Explain how to deploy and configure Fortinet Single Sign-On (FSSO)DC agent mode, collector agent, polling and FSSO login issues.
- What it means
- FSSO identifies Windows domain users transparently, so they are never prompted by the FortiGate. Logon events are collected from domain controllers and passed to the FortiGate, which maps each IP address to a user and group for policy matching.
- What to understand
- In DC agent mode, a DC agent on each domain controller sends logon events to a collector agent, which forwards them to the FortiGate. Polling mode collects events without installing DC agents, either through the collector agent or directly from the FortiGate. The collector agent communicates with the FortiGate on TCP 8000 by default. Login issues usually come from users not in monitored groups, IP address changes, shared workstations or the collector not receiving events.
- How it shows up
- You may need to choose DC agent or polling mode, or explain why a user is not listed.
- Common confusion
- Thinking FSSO prompts the user; it is passive, and users who are not identified fall to other policies.
High-yield concepts
The terms, rules and formulas this domain turns into questions most often.
-
First-match policy order
Policies are checked top down and the first full match applies.
- Remember
- Sequence, not policy ID, sets the order.
- Tested as
- Policy table questions.
- Trap
- Assuming the most specific policy wins automatically.
-
Implicit deny
Traffic matching no policy is dropped by the final implicit rule.
- Remember
- It does not log by default.
- Tested as
- Missing traffic in logs.
- Trap
- Expecting denied sessions to appear without enabling logging.
-
Flow versus proxy policy inspection
Each policy selects flow-based or proxy-based inspection.
- Remember
- Proxy mode offers more profile options.
- Tested as
- Feature availability questions.
- Trap
- Thinking the mode is only set globally.
-
Overload IP pool
Many internal hosts share public IPs with port translation.
- Remember
- It is the default type.
- Tested as
- SNAT selection.
- Trap
- Choosing it when each host needs its own IP.
-
One-to-one IP pool
Each internal host is mapped to its own external address.
- Remember
- Pool size limits concurrent hosts.
- Tested as
- SNAT selection.
- Trap
- Confusing it with static NAT VIPs.
-
Port block allocation
Assigns each user a block of source ports from the pool.
- Remember
- Reduces NAT logging volume.
- Tested as
- Carrier-style NAT scenarios.
- Trap
- Confusing it with fixed port range.
-
Virtual IP (VIP)
A DNAT object mapping an external address and port to an internal server.
- Remember
- Used as the policy destination.
- Tested as
- Publishing servers.
- Trap
- Forgetting the policy that allows the traffic.
-
LDAP bind types
Simple, anonymous or regular bind with a service account.
- Remember
- Regular bind needs a username and password.
- Tested as
- LDAP configuration questions.
- Trap
- Using anonymous bind against a directory that blocks it.
-
Active authentication
The user is prompted when traffic matches an identity-based policy.
- Remember
- DNS must be allowed first.
- Tested as
- Login prompt issues.
- Trap
- Expecting a prompt for non-HTTP traffic first.
-
FSSO DC agent mode
Agents on domain controllers send logon events to a collector agent.
- Remember
- Most reliable event capture.
- Tested as
- Choosing FSSO modes.
- Trap
- Forgetting an agent on every DC.
-
FSSO polling mode
Logon events are collected without DC agents.
- Remember
- Can be agent-based or agentless.
- Tested as
- Deployment restrictions.
- Trap
- Assuming it is as immediate as DC agent mode.
-
Firewall user monitor
GUI view of authenticated users and their method.
- Remember
- Administrators can de-authenticate users here.
- Tested as
- Verification steps.
- Trap
- Looking for FSSO users only on the collector.
Side by side
Concepts candidates mix up, compared on the point that decides the answer.
IP pool types
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Overload | Hosts share pool addresses with port translation | Many to few | Choosing it for per-host public IPs |
| One-to-one | Each host gets a dedicated external IP | No port translation | Running out of addresses |
| Fixed port range | Internal ranges map to fixed external ranges | Deterministic mapping | Confusing it with port blocks |
| Port block allocation | Users receive port blocks | Fewer NAT log entries | Assuming fixed per-host mapping |
Active versus passive authentication
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Active | User enters credentials when prompted | Explicit login | Forgetting DNS before authentication |
| Passive (FSSO) | Identity learned from domain logons | No prompt | Expecting a prompt for unidentified users |
| Remote LDAP or RADIUS | External server validates credentials | Central account store | Mismatched bind settings or shared secret |
Static NAT VIP versus port forwarding VIP
| Concept | Meaning | Key difference | Common trap |
|---|---|---|---|
| Static NAT VIP | Maps all ports of an external IP to an internal IP | Also affects outbound source NAT | Not expecting outbound translation |
| Port forwarding VIP | Maps specified external ports to internal ports | Only listed ports are translated | Assuming other ports also forward |
Exam traps
Each trap is an answer that looks right. Learn the clue that should change your mind.
-
Lowest ID first
- What candidates pick
- Pick the policy with the lowest ID as the match.
- Why it looks right
- IDs look like line numbers.
- Why it's wrong
- FortiGate evaluates policies in their displayed sequence, which can differ from the ID order after moves.
Clue to watch for The table shows IDs out of numerical order.
-
VIP is enough
- What candidates pick
- Say the server is reachable once the VIP exists.
- Why it looks right
- The VIP holds the address mapping.
- Why it's wrong
- Inbound traffic still needs a policy allowing it, with the VIP as the destination.
Clue to watch for The VIP is configured but no matching policy is listed.
-
Overload for unique IPs
- What candidates pick
- Choose an overload pool to give each host its own public address.
- Why it looks right
- Overload is the default pool type.
- Why it's wrong
- Overload shares addresses with port translation; one-to-one assigns dedicated addresses.
Clue to watch for The requirement mentions one external IP per internal host.
-
Prompt without DNS
- What candidates pick
- Expect the authentication page to appear for an unidentified user.
- Why it looks right
- The identity policy looks correct.
- Why it's wrong
- Without a policy allowing DNS before authentication, the browser cannot resolve the site and is never redirected.
Clue to watch for Users see name resolution errors rather than a login page.
-
FSSO prompts users
- What candidates pick
- Expect unidentified FSSO users to be asked for credentials.
- Why it looks right
- Other methods do prompt.
- Why it's wrong
- FSSO is passive; unless active authentication is also configured, unidentified users match only non-identity policies or the implicit deny.
Clue to watch for The design relies only on FSSO.
-
One agent is enough
- What candidates pick
- Install one DC agent for a multi-controller domain.
- Why it looks right
- One agent seems to see the domain.
- Why it's wrong
- Each DC agent only reports logons processed by its own domain controller.
Clue to watch for Some users are identified and others are not.
Answer framework
Apply these steps when a Domain 2 scenario asks whether traffic passes, how it is translated, or which user it belongs to.
- Identify the flow: incoming interface, outgoing interface, source, destination, service and time, because every policy match depends on all of them.
- Walk the policy list in displayed sequence, stopping at the first policy that matches all criteria, and remember the implicit deny at the end.
- Check the matched policy's NAT: outgoing interface address or an IP pool for SNAT, or a VIP destination for inbound DNAT.
- If the policy uses users or groups, decide whether identity comes from active login, LDAP or RADIUS, or passive FSSO, and confirm DNS is allowed.
- For FSSO gaps, check the agent mode, monitored groups, collector connectivity on TCP 8000 and the firewall user monitor.
Practice question
Want more like this? The NSE 4 practice test has questions for every domain.
Checklist
0 of 12
Tick each one you can do without notes. Your ticks stay in this browser.
Study strategy
Begin with policy matching, because every other objective depends on it. In a lab, create overlapping policies, move them around and confirm with debug flow which one each test connection hits. Enable logging on the implicit deny so you can see blocked traffic.
Then work through NAT. Create each IP pool type, send traffic and compare the translated addresses and ports in the session list and logs. Publish a test web server with a static NAT VIP, then with a port-forwarding VIP, and note what changes for inbound and outbound traffic.
Finish with identity. Point the FortiGate at an LDAP directory, test the connection, and build a policy for one group with active authentication. If you can, install the FSSO collector agent on a Windows lab domain and compare DC agent and polling behavior, checking the firewall user monitor after each logon. Write down the ports and fields that each method needs.
FAQ
How much of the exam is Firewall Policies and Authentication?
Fortinet weights Firewall Policies and Authentication at 20-25% of the FortiOS 7.6 Administrator exam, about 11 to 13 questions on a 50-55 question form.
Does FortiGate pick the most specific policy?
No. It checks policies in their displayed sequence and applies the first one that fully matches, so a broad rule placed above a specific one will win.
What is the difference between an IP pool and a VIP?
An IP pool is used for source NAT on outbound traffic. A VIP is used for destination NAT, mapping a public address and port to an internal server.
Why does the authentication page not appear?
The most common causes are DNS not being allowed before authentication, no identity-based policy matching the traffic, or the traffic not being a protocol that triggers the prompt.
Which FSSO mode should I choose?
DC agent mode gives the most reliable logon capture but needs an agent on every domain controller. Polling mode avoids installing software on controllers, at the cost of slower or less complete detection.
Which port does the FSSO collector agent use?
By default the FortiGate connects to the collector agent on TCP 8000. DC agents report to the collector agent separately.
Are SSL VPN user policies part of this domain?
No. The current FortiOS 7.6 objectives cover firewall authentication and FSSO here, and the VPN objective covers IPsec only.
Other Cybersecurity certifications
Where the same subject shows up in other exams. Cards marked "Same subject" open the matching domain.
- CompTIA Cybersecurity Analyst+ Study guide
- Microsoft Security Operations Analyst Associate Study guide
- Certified Ethical Hacker Study guide
- Penetration Tester Study guide
- Systems Security Certified Practitioner Study guide
- Certified in Risk and Information Systems Control Study guide
- CompTIA PenTest+ Study guide
- CompTIA SecurityX (CASP+) Study guide
- Azure Security Engineer Associate Study guide
- CISM (Certified Information Security Manager) Study guide
- CISSP Study guide
- CompTIA Security+ Study guide
- Certified Information Systems Auditor Study guide
- Certified Cloud Security Professional Study guide
Test your Domain 2 knowledge
You have covered policy matching, SNAT and DNAT options, firewall authentication and FSSO. Test whether you can pick the matching policy and the right NAT method quickly.