Fortinet NSE 7 - SD-WAN

Once an organization runs more than a handful of FortiGates, managing SD-WAN one device at a time breaks down. Inconsistent configs, untested failover, and guesswork about which link carries business-critical SaaS traffic lead to outages and escalations. IT teams complete this training to centrally manage SD-WAN with FortiManager and to troubleshoot it methodically.

Role fit: This is expert-level content for network security architects and senior IT Practitioners with three to five years of Fortinet experience. Assign it to the engineers who own branch connectivity, hub-and-spoke VPNs, and FortiManager. It is not a starting point for new hires.

Time investment: Plan on about 11 hours of video per learner across 10 skills. Add lab time, because each skill moves from plan to implementation to verification.

Risk and change management: The troubleshooting skills stress that existing connectivity should not be broken without change control and scheduled downtime. That discipline matters for production SD-WAN rollouts.

Certification: The course prepares engineers for one of the concentration exams toward NSE 7.

How the course supports the outcome: The free first skill walks through building an SD-WAN lab, including an EVE-NG setup that injects delay, jitter, and packet loss. Team Leads can use it to stand up a shared practice environment before engineers touch production gear.

How this training helps your team succeed in the real world

IT teams running Fortinet SD-WAN across a data center and branch sites need more than a working config on one FortiGate. They need consistent rollouts, predictable application performance, and a repeatable way to fix things when a site goes dark. This course walks practitioners through a multi-site lab built around those exact scenarios, from a single-site direct internet access (DIA) design to hub-and-spoke overlays pushed centrally from FortiManager.

• Consistent, centrally managed deployments: Your team learns to bring FortiGates under FortiManager and push SD-WAN templates and policy packages, so every site carries the same verified configuration instead of drifting one device at a time.
• Faster, more structured troubleshooting: Engineers practice a step-by-step method that targets the usual root causes on next-generation firewalls: routing, address translation, and permissions. The method stresses change control so fixes don't break existing connectivity without scheduled downtime.
• Application traffic that stays usable when links degrade: Teams build SLAs that measure jitter, delay, and loss, then write application-based rules that steer traffic such as Salesforce or Twitter to the interfaces meeting those targets.
• Resilient internet access: Practitioners configure multiple ISP members in an SD-WAN zone for fault tolerance. They also set up fallback remote internet access (RIA) over the VPN to a hub when local providers fail, which reduces branch downtime.

Knowledge

• How Fortinet SD-WAN uses software-defined conditions, such as SLA targets for jitter, delay, and packet loss, to choose which path traffic takes across the underlay
• Why FortiManager is needed when the environment grows from one or two FortiGates to dozens or hundreds, and how templates and policy packages keep SD-WAN configuration consistent
• How the SD-WAN overlay template builds hub-and-spoke IPsec overlays, and what must be planned first: hub and spoke roles and the tunnel IP addressing
• The difference between direct internet access (DIA) and fallback remote internet access (RIA) through a hub, including the routing and NAT the hub needs
• The three core areas behind most next-generation firewall issues: routing, address translation, and policy permissions
• How FortiGate monitoring shows SD-WAN rules, bandwidth overview, and traffic growth across VPN tunnels and the underlay network

Ability

• Build a lab environment that can introduce delay, jitter, and loss in real time to test SD-WAN behavior
• Configure SD-WAN zones with multiple ISP members and a default route through the zone, so traffic can be steered across providers and fail over
• Create SLAs and application-based SD-WAN rules, for example for Salesforce or Twitter, then test that traffic follows them
• Use FortiManager to bring FortiGates under central management, push SD-WAN and IPsec configuration, and confirm that settings match across devices
• Set up fallback RIA so traffic can break out at a data center hub over VPN when local ISPs fail
• Troubleshoot SD-WAN DIA step by step without disrupting existing connectivity, following change-management practices