FortiGate interview questions, answered for FortiOS 7.6

Questions interviewers ask about FortiGate firewalls, answered for FortiOS 7.6. Every answer starts with the short version, then shows the commands that prove it.

Independent training; not affiliated with Fortinet or Palo Alto Networks.

01What interviewers test on FortiOS 7.6

The course kit groups FortiGate interview questions into these areas. Interviewers like scenario questions, so practise the order of checks, not just the fix.

• Firewall policies and NAT: which policy matches, and the order of DNAT, routing, the policy lookup and SNAT.
• Routing and SD-WAN: route selection, policy routes, performance SLAs and SD-WAN rules.
• Authentication: local users, LDAP, RADIUS and FSSO.
• SSL/SSH inspection and security profiles: what the FortiGate sees in HTTPS, and how web filtering, application control, antivirus and IPS act on it.
• IPsec VPN: phase 1 and phase 2, route-based tunnels and redundant designs.
• High availability: the FGCP election, session pickup and cluster upgrades.
• Troubleshooting: the packet sniffer, debug flow and the session table.

Three FortiOS 7.6 changes worth knowing:

• From 7.6.3, IPsec VPN replaces SSL VPN tunnel mode, and IPsec can use TCP 443.
• In 7.6.0, the default of cert-probe-failure in SSL/SSH profiles changed to allow.
• From 7.6.7, the CLI prompt shows each cluster member’s HA role.

02Topic pages

Each page covers one topic, with fresher, experienced and scenario questions.

• FortiGate · FortiOS 7.6 FortiGate HA (FGCP) interview questions The FGCP election and override, heartbeat, session pickup, failover, cluster upgrades and HA in the cloud. 15 questions · Last updated 16 Oct 2026
• FortiGate · FortiOS 7.6 FortiGate SSL inspection interview questions Certificate and deep inspection, the re-signing CA, warnings, exemptions, inbound inspection and QUIC. 14 questions · Last updated 16 Oct 2026

03Top questions

Start with these. Each link opens the full answer, with the commands that prove it.

1. How is the FGCP primary elected?HA (FGCP) · Experienced
2. You raised FGT-HQ2’s priority to 250, but it stays secondary. Why?HA (FGCP) · Scenario
3. What does session pickup do, and what are its limits?HA (FGCP) · Experienced
4. Compare FGCP and FGSP.HA (FGCP) · Experienced
5. Compare certificate inspection and deep inspection.SSL inspection · Fresher
6. How does deep inspection work, and why must clients trust the FortiGate CA?SSL inspection · Experienced
7. After you enable deep inspection, users see certificate warnings and some apps stop working. What do you do?SSL inspection · Scenario
8. Why is QUIC a problem for SSL inspection, and how does FortiOS 7.6 handle it?SSL inspection · Experienced

04How to practise

Answer each question aloud first, then read the model answer, then run the commands on a FortiGate-VM.

• Free course: FortiGate NSE 4 Free Edition on www.pingmylab.in is a free recorded course of 13 lab lessons, made on an earlier FortiOS release. It includes lessons on an HA cluster and on SSL deep inspection.
• Live course: FortiGate NSE 4 on FortiOS 7.6 is Ping My Lab’s live course with Radhe. Lab 8 covers SSL/SSH inspection, and Lab 13 builds an FGCP cluster.
• Licences: the labs run on the free FortiGate-VM trial wherever Fortinet’s licensing allows it. Lab 13 needs two licensed VMs, and deep inspection in Lab 8 needs a licensed VM.
• Exam too: Fortinet NSE in 2026: what NSE 4 means now maps every exam task to the labs.

Sources

Sources for the FortiOS 7.6 changes above. Each topic page lists the sources for its answers.

1. SSL VPN tunnel mode replaced with IPsec VPN, FortiOS 7.6.6 Release Notes (Fortinet): migrate before 7.6.3; IPsec can use TCP 443.
2. FortiOS 7.6.0 Release Notes (PDF) (Fortinet): the cert-probe-failure default changed to allow.
3. FortiOS 7.6.7 Release Notes (PDF) (Fortinet): the HA role in the CLI prompt.