All learning paths

Fortinet FortiGate Operator

Learn FortiOS on a four-port routed firewall: manage interfaces, enforce policy, inspect sessions and source NAT, provide DHCP, and connect VLANs and routed networks.

Choose your first lab

FortiOS CLI, management and interfaces · Bring the branch firewall under management

0%
Start course
Labs ready
78
In progress
0
Objectives
0/354

78 labs ready

Course foundation

FortiOS 7.6.4 routed IPv4 profile

An abstract four-port FortiGate running a bounded FortiOS model, distinct from FortiSwitchOS and FortiLink-managed switching.

Software
FortiOS 7.6.4
Device
Abstract four-port routed firewall
Scope
IPv4, root VDOM, central NAT disabled
Access
Free

How to study with the official manuals

Work through the available chapters in order. Each ends with an independent checkpoint. Planned chapters do not count as completed learning.

FortiOS documentationFortinet documentation for native FortiOS behavior; each lesson uses only the declared simulator profile.

Curriculum

Open a stage to inspect its lessons and labs.

Stage 1

FortiOS CLI, management and interfaces

Identify the firewall, configure routed interfaces, restrict management ping and preserve a working configuration.

Stage 2

Objects and ordered firewall policies

Build address and service objects, enforce ordered policy and prove permitted and denied traffic.

Stage 3

Sessions and source NAT

Inspect actual sessions and source translation, recover policy faults and verify saved configuration after reboot.

Stage 4

Firewall-origin diagnostics and recovery

Use route-selected native ping without granting transit policy; repair carrier and hand over saved intent with fresh packet proof.

Stage 5

Custom services and transport boundaries

Build TCP/UDP service objects and flat groups, repair referenced membership and prove independent denied traffic.

Stage 6

VIPs and published services

Publish an address or TCP port, prove destination and reverse translation, and recover saved native intent.

Stage 7

Debug flow and physical packet capture

Observe actual permitted and denied traffic, correct filters, and inspect request and return frames.

Stage 8

Source NAT pools and capacity

Select named overload and one-to-one pools, recover address exhaustion and prove real return-path ownership.

Stage 9

Hairpin services and reverse NAT

Distinguish owned and alias VIPs, repair same-LAN return paths and prove actual ingress, egress and restored replies.

Stage 10

Local DHCP services

Allocate addresses from an interface-bound pool, inspect real leases and recover a failed client exchange.

Stage 11

VLAN interfaces and tagged uplinks

Carry separate client networks over a Cisco trunk into named FortiOS VLAN interfaces.

Stage 12

Static routes and return paths

Route through a neighboring router, inspect the installed table and repair forward and return paths.

Stage 13

OSPF neighbors and learned routes

Configure native OSPF, recover adjacency faults and prove learned routing with independent firewall controls.

Stage 14

Bounded eBGP and return routes

Configure reciprocal peers, repair AS and tagged attachment faults, and preserve independent firewall controls.

Stage 15

Site-to-site encrypted traffic

Prove real IKEv2 authentication, selectors, ESP and NAT-T delivery, repair failures and restore saved intent with fresh negotiation.

Stage 16

Explicit HA ownership and failover

Configure two units, run explicit modeled control rounds and prove physical failover, session ownership and saved recovery.

Stage 17

Local plain-HTTP URL filtering

Apply a local URL table to actual received HTTP bytes, prove allowed replies and blocked delivery, and restore fresh evidence.

Stage 18

Remote DHCP relay and recovery

Prove actual remote DORA and repair relay intent while keeping transit denied.

Stage 19

Address group policy boundaries

Repair group references and prove permitted and denied sources with saved recovery.

Stage 20

Custom HTTP application signatures

Match independently authored HTTP header markers and prove actual allowed and blocked traffic; no proprietary classifier.

Stage 21

TLS trust and inspected traffic

Operate the bounded TLS1.3 training endpoint, repair trust and prove authenticated inspection and fresh recovery.

Stage 22

Advanced NAT

Extend the bounded published-service profile with separately qualified NAT behavior.

Stage 23

Dynamic routing and relay services

Extend branch reachability and address services across routed boundaries.

Stage 24

Further VPN lifecycle

Protect traffic between sites and diagnose tunnel failures.

Stage 25

SD-WAN, HA and VDOMs

Operate resilient paths and separate administrative domains.

Stage 26

Security inspection

Reason about payload inspection, trust and supported detection boundaries.

Stage 27

Integrated FortiGate assessment

Combine the completed course domains in an independent branch recovery.

Course details and blueprint

What you will be able to do

  • Configure native FortiOS management and routed interfaces.
  • Prove ordered policy, source NAT and return traffic.
  • Operate local DHCP, tagged VLAN interfaces, static routes and basic OSPF.

Path notes

Designed for
Network learners practicing FortiGate firewall operations and mixed-vendor branch connectivity.
Availability
Free beta: 78 activities cover the initial routed IPv4 profile. Additional NAT pool types and hairpin combinations, advanced OSPF and BGP, further VPN lifecycle, SD-WAN, additional HA modes, VDOMs, broader inspection and the integrated assessment remain unfinished. This is not the complete FortiGate course or an exam-coverage claim.