Fortinet NSE 6 - FortiAuthenticator

When authentication is scattered across firewalls, switches, wireless, and cloud apps, every gap becomes a risk: unverified devices on wired ports, untrusted certificates, and inconsistent admin access. This course trains your team to run FortiAuthenticator as the central clearinghouse for identity and certificates in a Fortinet environment.

Role fit: Built for IT Practitioners and Team Leads with 1 to 2 years of networking experience who manage FortiGate and related infrastructure. It is one of four exams toward the NSE 6 Network Security Specialist certification, which makes it a fit for teams building Fortinet certification depth.

Time investment: About 9.2 hours across 10 skills, each roughly 50–63 minutes. Teams can schedule one skill per week without pulling time from operations.

Risk and change-management notes: Topics include 802.1X, SSL inspection with an internal CA, HA, SSO, and SAML. These changes affect users directly, so the course plans each deployment before building it and troubleshoots failures in real time using logs and packet captures. That approach helps your team roll out network access control in stages with fewer surprises.

CBT Nuggets Playlists let Training Managers sequence these skills alongside related Fortinet courses, and Team Reporting shows who has completed each one ahead of exam scheduling.

IT teams use this training to turn FortiAuthenticator into a central clearinghouse for identity, so the network can verify that users and devices are who they claim to be. Instructor Keith Barker builds each scenario on a working lab network, then verifies results through the Fortinet interfaces, connectivity checks, certificate trust, and FortiGate traffic logs. Your team sees how real problems get diagnosed, not only how features get configured.

• Fewer authentication outages: Engineers practice integrating FortiAuthenticator with Active Directory over LDAP and with FortiGate over RADIUS. They also map AD groups to FortiGate remote admins and learn to check for exact group-name matches when access fails.
• Wired and wireless network access control: Teams implement 802.1X for wired and wireless clients, including EAP-TLS certificate trust in both directions.
• In-house PKI and SSL inspection: Practitioners stand up FortiAuthenticator as a root CA and distribute trust through Group Policy. They then use that CA with FortiGate for outbound SSL inspection, which reduces reliance on outside certificate work.
• Resilient, monitored identity services: Team Leads gain staff who can configure active/passive HA, SMTP integration, and SNMP monitoring. Engineers also deliver captive portal, SSO through domain controller log polling, and SAML so users get secure access with less friction.

The result is a team that can deploy, verify, and support Fortinet authentication end to end.

Knowledge

• How FortiAuthenticator works as a central clearinghouse for authentication, and how it can run on-prem as a physical appliance or VM, or in the cloud
• How FortiAuthenticator acts as a root CA, and why every device that relies on its certificates, including PCs, firewalls, and servers, must trust that CA
• How active/passive HA provides fault tolerance, and how SMTP and SNMP (including MIBs) support email integration and monitoring
• How centralized authentication fits together: self-service portal, LDAP to Active Directory, and RADIUS to FortiGate
• How 802.1X, EAP-TLS mutual certificate trust, and MAC Authentication Bypass (MAB) control wired and wireless access
• How captive portal, SSO with Windows event log polling, and SAML extend authentication across the network

Ability

• Deploy FortiAuthenticator and confirm CLI access through the hypervisor and other methods before an emergency requires it
• Configure FortiAuthenticator as a CA, distribute root CA trust (for example, through Group Policy), and use it for FortiGate outbound SSL inspection
• Set up user authentication that ties FortiGate remote admin access to Active Directory group membership through FortiAuthenticator
• Implement and troubleshoot wired 802.1X using log files and Wireshark EAPOL captures, and configure MAB for devices that lack a supplicant
• Build a FortiGate captive portal backed by FortiAuthenticator and troubleshoot the firewall policies that block clients from reaching it
• Configure SSO through domain controller polling and SAML authentication, starting from a verified, working baseline network