Domain 1 Deployment & system configuration
trapmemorisedefault valuenew in 7.6
§1.1 Initial configuration
Factory defaults
Most desktop models ship with the internal / LAN interface at 192.168.1.99/24, a DHCP server running on it, and an admin account with no password. Management access on that interface is HTTPS, HTTP, SSH and PING.
Administrative access
Admin profiles control what an admin can do. Trusted hosts control where they can connect from. The super_admin profile cannot be edited or deleted.
Interface allowaccess is a separate gate from the admin account. Both must permit the traffic or you get nothing.
Password policy, idle timeout admintimeout, and lockout admin-lockout-threshold live under config system global.
Traffic to the FortiGate itself — admin logins, IPsec, SSL VPN — is handled by local-in policies, not firewall policies. Firewall policies only ever control traffic passing through the device. If a question asks why an admin can still log in despite a deny policy, this is why.
An admin with no trusted hosts set is reachable from anywhere the interface allows. Setting a trusted host wrong locks you out. Both directions get tested.
FortiGuard licensing
FortiCare (support and registration) is separate from the security subscriptions. Know what breaks when each one expires:
Config backup and restore
Backups are plaintext or password-encrypted. An encrypted backup restores only to a device with the same password.
A plaintext backup carries the device serial in its header — restoring across a different model or major version is not supported.
A per-VDOM backup contains only that VDOM. Global config is separate.
Firmware upgrades
Follow the Upgrade Path Tool — you cannot skip major versions. FortiGate auto-backs-up the config before upgrading.
In an HA cluster, uninterruptible-upgrade is enabled. Subordinates upgrade first, then the cluster fails over, then the former primary upgrades.
§1.2 Fortinet Security Fabric
The Security Fabric / CSF connection between downstream and upstream FortiGates runs on TCP 8013.
Downstream devices must be authorised on the root before they join.
Full topology views need a FortiAnalyzer connected to the root.
Object sync: the root pushes objects downstream. fabric-object-unification on the root decides whether objects are unified (default) or left alone.
Automation stitches = trigger → action. Triggers include compromised host, config change, HA failover, license expiry. Actions include email, webhook, CLI script, IP ban, quarantine.
Address object created on the root but missing downstream? Check the downstream device for set configuration-sync local. local means "do not accept objects from upstream." The fix is on the downstream, not the root — the exhibit will tempt you to change the root.
§1.3 FGCP high availability
What must match for a cluster to form
Same model, same firmware, same hardware configuration, same license level, same HA group ID, same password, and at least one shared heartbeat interface.
Primary election — override DISABLED (the default):
Session synchronisation
session-pickup syncs TCP sessions only. UDP and ICMP need session-pickup-connectionless enable as well. Proxy-based inspection sessions and most SSL VPN sessions are never resumed after a failover.
HA management interface
ha-mgmt-interface gives each member its own reachable IP that is not taken over by the virtual MAC — used for out-of-band management and so each unit can reach FortiGuard directly.
A checksum mismatch between members means the config is out of sync. That is the answer to "why is the cluster flapping" and "why won't it synchronise" — not heartbeat, not licensing.
§1.4 Resource & connectivity troubleshooting
Conserve mode
In conserve mode the FortiGate stops accepting new proxy-based inspection sessions and applies av-failopen.
av-failopen defaults to pass — new AV sessions pass through unscanned. off blocks them instead, one-shot passes until you re-enable manually.
Packet sniffer
Timestamp a gives absolute UTC. Sniffing on any disables hardware offload, so you see everything.
Debug flow — the single most exhibited tool
Learn to read the output lines:
§1.5 Logging
Severity levels 0 to 7: Emergency, Alert, Critical, Error, Warning, Notification, Information, Debug. Setting a level logs that level and everything more severe.
Log types: Traffic (forward, local, sniffer) · Event (system, user, router, VPN, HA) · Security (AV, web filter, app control, IPS, DLP).
Storage: memory (volatile, small), local disk (not on every model), FortiAnalyzer, FortiGate Cloud, syslog.
Per-policy logtraffic: disable · utm (security events only) · all (every session).
Traffic logs are written when the session closes. Add set logtraffic-start enable to also log at session start.
§1.6 FortiGate CNF, cloud VMs & FortiSASE
These three topics were added to the deployment domain. Anyone studying from 7.2 or 7.4 material will not have seen them. They are conceptual — you cannot lab them, so read once and make flashcards.
FortiSASE user onboarding: FortiClient invitation code, SAML / SSO with an IdP, AD or Entra ID connector, or push via EMS / MDM. Know the difference between agent-based (FortiClient) and agentless (SWG proxy or PAC file) deployments.