This advanced course prepares network and security professionals to design, deploy, administer, monitor, and troubleshoot Fortinet Secure Access Service Edge (SASE) solutions. It covers FortiClient EMS, endpoint security, Zero Trust Network Access (ZTNA), FortiSASE secure access services, and enterprise SD-WAN integration.

The course follows the FortiClient EMS Administrator pathway for NSE 6 SASE and the FortiSASE Architect pathway for NSE 7 SASE. These pathways address endpoint management and advanced FortiSASE and SD-WAN deployments, respectively. Fortinet NSE 6 exam scope, Fortinet NSE 7 exam scope.

Certification alignment: Under Fortinet’s current certification structure, NSE 6 SASE requires NSE 4 FortiOS certification and one qualifying NSE 6 SASE exam. NSE 7 SASE requires NSE 4 FortiOS certification, either NSE 5 SASE or NSE 6 SASE certification, and the NSE 7 SASE exam, subject to Fortinet’s certification timing requirements. Course completion alone does not award these certifications. NSE 6 SASE requirements, NSE 7 SASE requirements.

 

Duration 10 Days – 70 hrs.

 

Objectives

• Explain advanced SASE architecture and select suitable deployment models for distributed enterprises.
• Deploy and administer FortiClient EMS and provision managed endpoints.
• Configure endpoint profiles, security controls, compliance rules, and posture tags.
• Implement ZTNA and integrate endpoint security with the Fortinet Security Fabric.
• Configure FortiSASE onboarding, authentication, and secure access policies.
• Design secure internet, private application, and SaaS access.
• Design enterprise SD-WAN underlays, overlays, and resilient hub-and-spoke architectures.
• Configure performance SLAs, application steering, BGP routing, IPsec overlays, and ADVPN.
• Integrate FortiSASE with branch networks and enterprise SD-WAN.
• Use centralized management, logs, diagnostics, and packet captures to resolve operational issues.
• Apply the technical knowledge covered by the selected NSE 6 and NSE 7 SASE certification exam domains.

 

Target Audience 

• Network security engineers and administrators.
• SASE and SD-WAN engineers.
• Endpoint security and FortiClient EMS administrators.
• Security architects and solution specialists.
• Technical consultants and implementation engineers.
• Managed security service provider engineers.
• Experienced Fortinet professionals preparing for NSE 6 SASE and NSE 7 SASE certification.

 

Prerequisites 

• NSE 4 FortiOS-level knowledge and practical FortiGate administration experience.
• Working knowledge of TCP/IP, subnetting, DNS, NAT, routing, and firewall policies.
• Familiarity with IPsec VPNs, BGP, and basic SD-WAN configuration.
• Understanding of identity services, SAML authentication, digital certificates, and access control.
• Familiarity with endpoint operating systems and endpoint security administration.
• Basic operational experience with FortiClient, FortiSASE, FortiManager, and FortiAnalyzer.
• Experience reading security logs and performing basic connectivity troubleshooting.
• Active NSE 4 FortiOS certification for the intended certification pathway; NSE 6 SASE certification must also be achieved to use the selected NSE 6 route toward NSE 7 SASE.

  

Course Outline

 Day 1: Advanced SASE Foundations and Endpoint Architecture

Module 1: Enterprise SASE Architecture and Certification Scope

• SASE components and enterprise deployment use cases.
• Secure internet, private application, and SaaS access.
• Relationships among FortiClient EMS, FortiGate, FortiSASE, and SD-WAN.
• Selected NSE 6 and NSE 7 certification domains.
• Translating business and security requirements into deployment decisions.

 Module 2: FortiClient EMS Design and Deployment

• EMS architecture, components, and deployment modes.
• Installation requirements and initial configuration.
• Licensing, certificates, and administrative access.
• Endpoint connectivity and registration.
• Deployment planning and operational dependencies.

  

Day 2: FortiClient Provisioning and Endpoint Security

Module 3: FortiClient Deployment and Endpoint Profiles

• Installer creation and endpoint deployment.
• Endpoint onboarding and registration.
• Endpoint grouping and profile assignment.
• Profile configuration and policy synchronization.
• Endpoint upgrades and deployment troubleshooting.

 Module 4: Endpoint Protection and Compliance

• Endpoint security configuration.
• Compliance requirements and posture information.
• On-network and off-network behavior.
• Endpoint status monitoring.
• Diagnosing security profile and policy application issues.

  

Day 3: Zero Trust Integration and EMS Troubleshooting

Module 5: ZTNA and Security Fabric Integration

• Zero trust principles and endpoint trust.
• Posture tags and dynamic access decisions.
• FortiClient EMS integration with FortiGate.
• Certificate-based endpoint identification.
• ZTNA access configuration.
• Quarantine of compromised endpoints.

 Module 6: FortiClient EMS Operational Troubleshooting

• EMS and FortiClient diagnostic information.
• Endpoint registration and communication failures.
• Certificate and connectivity issues.
• Profile synchronization and deployment problems.
• ZTNA access and posture-tagging issues.
• Consolidation of NSE 6 FortiClient EMS exam topics.

  

Day 4: FortiSASE Architecture and Onboarding

Module 7: FortiSASE Enterprise Architecture

• Service components and points of presence.
• Provisioning and licensing considerations.
• Remote user, branch, and hybrid deployment models.
• Data residency and sovereignty considerations.
• MSSP deployment considerations.
• Dedicated public IP addresses and API capabilities.

 Module 8: Identity and Endpoint Onboarding

• Administrator and user authentication.
• SAML identity provider integration.
• Agent-based and agentless access.
• FortiClient onboarding and endpoint management.
• Endpoint profiles and advanced settings.
• Posture tags, steering bypass, and network lockdown.

 

Day 5: FortiSASE Secure Access Services

Module 9: Secure Internet and SaaS Access

• Secure Internet Access deployment models.
• Security policy enforcement.
• Web filtering, application control, and threat protection.
• TLS inspection and certificate considerations.
• Secure SaaS access use cases.
• Policy exceptions and application visibility.

 Module 10: Secure Private Access

• Private application access architecture.
• FortiGate connectivity and configuration.
• Secure Private Access through NGFW and SD-WAN.
• Agentless ZTNA and HTTPS access proxy concepts.
• Application monitoring and access troubleshooting.
• Single-hub and dual-hub private access designs.

  

Day 6: Enterprise SD-WAN Architecture and Deployment

Module 11: SD-WAN Design and Provisioning

• Underlay and overlay architecture.
• Direct internet access deployment.
• Members, zones, and topology selection.
• Single-hub, dual-hub, and multiregion designs.
• Zero-touch provisioning and device blueprints.
• MSSP and VRF-aware overlay considerations.

 Module 12: Performance SLAs and Link Health

• Latency, jitter, and packet-loss requirements.
• Active and passive health monitoring.
• SLA configuration and member status.
• Link failure detection and recovery.
• Advanced SLA behavior.
• Performance visibility through FortiManager and FortiAnalyzer.

 

Day 7: SD-WAN Traffic Control, Routing, and Overlays

Module 13: Application Steering and Routing

• SD-WAN rule matching and lookup.
• Traffic distribution strategies.
• Application steering and internet service matching.
• Implicit rules and local-out traffic.
• Route selection, policy routes, and session behavior.
• BGP routing and dual-hub routing decisions.

 Module 14: Advanced IPsec and ADVPN

• Scalable IPsec overlay design.
• BGP per-overlay and BGP-on-loopback approaches.
• Hub-and-spoke connectivity.
• ADVPN operation and shortcut behavior.
• Additional paths and overlay stickiness.
• Resilience and failover troubleshooting.

 

Day 8: FortiSASE and SD-WAN Integration

Module 15: Branch Connectivity and SASE On-Ramps

• Branch access requirements and design choices.
• SD-WAN on-ramp integration.
• FortiSASE as a spoke.
• FortiGate SD-WAN as a secure edge.
• FortiExtender, FortiBranch SASE, and FortiAP edge use cases.
• Private proxy and branch traffic steering.

 Module 16: Integrated Enterprise Deployment

• Secure Private Access through SD-WAN.
• Single-hub and dual-hub integration.
• Remote user and branch policy consistency.
• Routing and security policy dependencies.
• Availability and deployment expansion.
• Integration with the Fortinet Security Fabric.

 

Day 9: Centralized Operations and Advanced Troubleshooting

Module 17: Management, Visibility, and Analytics

• FortiManager management of SD-WAN deployments.
• FortiManager integration with FortiSASE.
• Log forwarding to FortiAnalyzer through private access.
• Traffic analytics and security reporting.
• Digital experience monitoring.
• Service availability and point-of-presence monitoring.

 Module 18: Troubleshooting Complex SASE Deployments

• FortiClient diagnostics and endpoint packet captures.
• FortiSASE connectivity and policy troubleshooting.
• Secure Private Access failures.
• SD-WAN rule and routing diagnostics.
• IPsec tunnel connectivity and performance issues.
• Correlating endpoint, access-service, and branch logs.

 

Day 10: Integrated Capstone and Certification Preparation

Module 19: Capstone — Distributed Enterprise SASE Solution

• Develop a solution for remote employees, multiple branches, and private applications.
• Define architecture, identity, endpoint posture, and access requirements.
• Configure managed endpoints and zero trust access controls.
• Integrate FortiSASE with a resilient SD-WAN topology.
• Apply application steering and link-performance policies.
• Resolve representative endpoint, authentication, routing, and tunnel faults.
• Produce architecture diagrams, configuration records, and an operational troubleshooting guide.

 Module 20: Certification Domain Consolidation

• Consolidate FortiClient EMS design, provisioning, security integration, and troubleshooting topics.
• Consolidate FortiSASE architecture, deployment, secure access, and operations topics.
• Revisit SD-WAN architecture, traffic control, routing, and IPsec dependencies.
• Interpret configuration examples, diagnostic outputs, and deployment scenarios.
• Align further study with the published objectives for the selected exam versions.