CloudLabBox
Try the free demo

FortiGate practice labs

25 guided labs on FortiGate VMs that follow the NSE 4 – FortiOS 7.6 Administrator exam topics, from first boot to a high-availability cluster joined to a branch by SD-WAN and IPsec, with two troubleshooting labs on the way.

Start this courseTry it free for 30 minutes

Standard for a month, £75.00, runs every lab here, with nothing extra to pay for the guided labs. 23 of the 25 labs also run in the free demo.

Guided labs
25
Follows
Fortinet NSE 4 – FortiOS 7.6 Administrator
Runs every lab
Standard
Devices
EVE-NG GUI server, FortiGate, Alpine Linux and IOSvL2

Who these labs are for

For network and security engineers preparing for Fortinet’s NSE 4 – FortiOS 7.6 Administrator exam, and anyone who looks after FortiGate firewalls and wants real practice.

The labs run FortiOS 7.0 under its evaluation licence and point out where FortiOS 7.6 differs. The evaluation licence has no HTTPS web interface, IPsec is DES only and there’s no FortiGuard, so web filtering uses static URL and domain filters, and deep inspection is shown as the licensed result.

The 25 labs

Every lab in the folder, as the workspace lists them, with what each runs and the smallest plan that fits. Read on 2 November 2026.

FortiGate NSE 4 course 25 labs

Shared folderFortiGate NSE 4 guided labs

One FortiGate topic per lab, then two troubleshooting labs and a capstone with an HA cluster and a branch over SD-WAN and IPsec.

  1. 01First boot CLI and administrative access

    Take a factory-default FortiGate from its first console login to a working office firewall: addressed interfaces, safe administrative access, the GUI, DNS, a default route, a DHCP server and a first internet policy with source NAT.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  2. 02Administrators profiles backups and restore

    Give a helpdesk team safe, read-only access with its own profile and trusted hosts, enforce a password policy and lockout, then back up the configuration to a TFTP server in plain and encrypted form and plan a restore and a firmware upgrade.

    1× FortiGate, 3× EVE-NG GUI server

    4 vCPU, 6,144 MBFits LiteRuns in the free demo

  3. 03Interfaces VLANs zones and DHCP

    Split the office into Staff and Finance VLANs on one FortiGate port, serve each VLAN with DHCP (including a reservation), group the VLANs in a zone and control the traffic between them.

    2× Alpine Linux, 1× FortiGate, 1× IOSvL2, 2× EVE-NG GUI server

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  4. 04Logging and monitoring

    Follow a log from a policy to the screen and to a syslog server: choose what each policy logs, log the implicit deny, read and filter traffic and event logs in the CLI and GUI, and send everything to SRV1.

    1× FortiGate, 3× EVE-NG GUI server

    4 vCPU, 6,144 MBFits LiteRuns in the free demo

  5. 05Firewall policies and objects

    Replace an empty rule base with least-privilege policies built from address, FQDN, service and schedule objects, then fix a shadowed rule by moving it and prove which policy matches with the session table and the policy lookup.

    1× Alpine Linux, 1× FortiGate, 3× EVE-NG GUI server

    5 vCPU, 6,656 MBFits LiteRuns in the free demo

  6. 06Source NAT - IP pools and central SNAT

    Move from 'everyone hides behind the WAN address' to planned source NAT: an overload pool for staff, a one-to-one address for a partner-facing PC, a fixed-port-range pool you can trace without logs, and finally the same design in the central SNAT table.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  7. 07Destination NAT with virtual IPs

    Publish a DMZ web server to the internet with a static NAT VIP and a port-forwarding VIP, let staff reach it by its public address (hairpin), see the VIP's address used for the server's own outbound traffic, and block an attacker with a deny policy that matches VIP traffic.

    1× FortiGate, 3× EVE-NG GUI server

    4 vCPU, 6,144 MBFits LiteRuns in the free demo

  8. 08Static routing ECMP and link monitoring

    Add a second ISP, compare the routing table with the routing database, use distance and priority for backup and load sharing, detect an upstream failure with a link monitor, and stop private traffic leaking with blackhole routes.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  9. 09Policy routes and reverse-path checks

    Find out with debug flow why a monitoring service can't reach the firewall through the backup ISP, fix it the right way with route priority, then steer one workstation and all HTTPS traffic through ISP-B with policy routes.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  10. 10Local users and captive-portal authentication

    Turn anonymous internet access into identity-based access: local users and groups, DNS allowed before login, a captive portal that appears for web traffic, different rights for staff and guests, and the commands to see and clear who is logged in.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  11. 11LDAP and RADIUS authentication

    Connect FortiGate to the company directory over LDAP and to a RADIUS server, map directory groups to firewall groups, give Engineering and Finance different access, let IT admins log in with their directory accounts, and debug authentication from both ends.

    1× FortiGate, 3× EVE-NG GUI server

    4 vCPU, 6,144 MBFits LiteRuns in the free demo

  12. 12Passive authentication - RSSO and FSSO

    Identify users without a login prompt: let a network access server's RADIUS accounting tell FortiGate who is on which address (RSSO), build policies on those identities, then set up and troubleshoot the FSSO side of the same idea for Active Directory.

    1× Alpine Linux, 1× FortiGate, 3× EVE-NG GUI server

    5 vCPU, 6,656 MBFits LiteRuns in the free demo

  13. 13Certificates and SSL inspection

    See what FortiGate can and can't do with encrypted web traffic: block by name with certificate inspection, decrypt with deep inspection, make FortiGate trust a server's CA and clients trust FortiGate's CA, and exempt sites that must never be decrypted.

    1× FortiGate, 2× EVE-NG GUI server

    3 vCPU, 5,120 MBFits LiteRuns in the free demo

  14. 14Antivirus scanning

    Stop a test virus downloaded over the web: compare flow-based and proxy-based antivirus, handle archives and oversized files with protocol options, and read the antivirus logs, using the industry-standard EICAR test file.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  15. 15Web filtering and DNS filtering

    Build Harbourside's acceptable-use rules with static URL filters (simple, wildcard and regular expression, with allow, block, monitor and exempt), see how entry order and inspection mode change the result, add a DNS filter, and read what FortiGuard categories would add on a licensed unit.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  16. 16IPS and application control

    Block a known exploit (Shellshock) with an IPS sensor and your own signatures, protect the firewall from an ICMP flood with a DoS policy, and control applications by category, including a custom application signature, then monitor what the engines saw.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  17. 17Site-to-site IPsec VPN

    Join head office and the new branch with a route-based IKEv2 tunnel: phase 1 and phase 2, routes with a blackhole safety net, policies in both directions, then read the tunnel's state and find a pre-shared key mismatch with IKE debug.

    2× FortiGate, 1× Alpine Linux, 2× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  18. 18Redundant IPsec VPN over two ISPs

    Add a second tunnel over the second ISP, tune dead peer detection, use route distance so the backup takes over by itself, prove it by failing the primary ISP, and compare active-standby with active-active designs.

    2× FortiGate, 1× Alpine Linux, 2× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  19. 19Dial-up IPsec - hub and spoke

    Turn head office into a dial-up VPN hub that any branch can join without the hub knowing its address, let the hub add routes for each spoke automatically, carry spoke-to-spoke traffic through the hub, and relate it to remote-access VPN after SSL VPN's removal.

    3× Alpine Linux, 3× FortiGate, 1× EVE-NG GUI server

    7 vCPU, 8,704 MBFits Standard

  20. 20SD-WAN - members SLAs and rules

    Build SD-WAN from scratch over two ISPs: members in a zone, one route and one policy, a performance SLA that measures each link, and rules that pin the admin PC, send web traffic to the best link and keep DNS on the cheap link while it meets its SLA. Then degrade ISP-A and watch traffic move.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  21. 21High availability - FGCP active-passive

    Turn two FortiGates into an active-passive FGCP cluster: find why a colleague's half-built secondary won't join, form the cluster, check synchronisation, fail over on a monitored interface while traffic flows, and control which unit is primary with priority and override.

    2× FortiGate, 1× Alpine Linux, 2× EVE-NG GUI server

    5 vCPU, 7,680 MBFits LiteRuns in the free demo

  22. 22Diagnostics - sniffer debug flow and resources

    Work two real tickets with FortiGate's own tools: the packet sniffer to see what is on the wire, debug flow to see why the FortiGate dropped or routed a packet, the session table, and the CPU, memory and conserve-mode checks you run when the unit itself is in trouble.

    1× Alpine Linux, 1× FortiGate, 2× EVE-NG GUI server

    4 vCPU, 5,632 MBFits LiteRuns in the free demo

  23. 23Troubleshooting - policy NAT and routing faults

    A weekend change left Harbourside's office offline and its web site unreachable. Five realistic faults are layered on top of each other in DHCP, policy order, NAT, a virtual IP and a stale route; find each one with the right tool and fix it without breaking anything else.

    1× Alpine Linux, 1× FortiGate, 3× EVE-NG GUI server

    5 vCPU, 6,656 MBFits LiteRuns in the free demo

  24. 24Troubleshooting - VPN and authentication faults

    The branch tunnel is down and directory logins fail. Work through six stacked faults in phase 1, phase 2, policies, LDAP and RADIUS with the IKE debug, the tunnel lists, debug flow, fnbamd and the directory server's own log.

    2× Alpine Linux, 2× FortiGate, 2× EVE-NG GUI server

    6 vCPU, 7,168 MBFits LiteRuns in the free demo

  25. 25Capstone - HQ cluster and branch over SD-WAN and IPsec

    Build Harbourside's network from a requirements list: an HA cluster at head office with redundant internet, a published web server, directory admins, web filtering and syslog, and a branch that uses SD-WAN for the internet and two IPsec tunnels back to head office.

    3× FortiGate, 2× Alpine Linux, 2× EVE-NG GUI server

    7 vCPU, 9,216 MBFits Standard

Devices and images

The exact Add Node images the labs use, and the vCPU and RAM their nodes are set to. Your plan counts what each running node is set to.

Devices and images in the FortiGate practice labs, as read on 2 November 2026
DeviceImage in Add NodeSet toLabsNodes
EVE-NG GUI server (Docker)eve-gui-server:latest1 vCPU, 1,024 MB; 1 vCPU, 2,048 MB2556
Fortinet FortiGatefortinet-FGT-v7.0.17.M-build06821 vCPU, 2,048 MB2533
Alpine Linuxclbalpinebase-alpine-base-3-20-31 vCPU, 512 MB2025
Cisco IOSvL2viosl2-adventerprisek9-m.ssa.high_iron_202009291 vCPU, 1,024 MB11

Browse every image in the Add Node list

How to open the labs

  1. Sign in to your workspace at lab.cloudlabbox.com.

  2. In File Manager, open Shared, then the folder FortiGate NSE 4 guided labs.

  3. Open a lab and start its nodes, then open Lab Tasks for the steps.

The labs are read-only. You can start the nodes and configure the devices, but changes to the topology can’t be saved. To change a lab, rebuild it in your own folder.

The Shared folder in the EVE-NG File Manager, recorded on 2 November 2026 with a test account.
The EVE-NG File Manager open on the read-only Shared folder: one folder per guided course, including Arista EOS, BGP in depth, CCIE Enterprise Infrastructure, CCNA, CCNP ENARSI and ENCOR, Check Point, Cisco ASA, Cisco Nexus NX-OS, CompTIA Network Plus and FortiGate
A guided CCNA lab with its Lab Tasks pane, recorded on 1 November 2026 with a test account.
A guided CCNA lab open in EVE-NG with its nodes running: four routers and two PCs on the canvas, and the Lab Tasks pane beside them with the scenario, the addressing plan and the first task

Questions about the FortiGate labs

Are these FortiGate labs free?

They’re included with every lab plan, with nothing extra to pay, rather than free. Plans start at £3 a day or £0.50 an hour. To try one first, the free demo gives you 30 minutes with 6 vCPU and 8 GB, enough to run 23 of these labs.

Which plan do I need for these labs?

Standard, with 12 vCPU and 16 GB, runs every lab here. Lite runs 23 of the 25. EVE-NG admits a node by the vCPU and RAM configured on it, so a lab needs the total its running nodes are set to. The biggest here, “Capstone - HQ cluster and branch over SD-WAN and IPsec”, needs 7 vCPU and 9,216 MB. Each lab’s Lab Tasks pane names the plan it needs.

Can I change these labs?

You can start the nodes and configure the devices, but the labs are read-only: changes to the topology can’t be saved. To change one, rebuild it in your own folder.

Are these labs from Fortinet?

No. CloudLabBox wrote them to follow the topics of Fortinet’s NSE 4 – FortiOS 7.6 Administrator exam. They aren’t training material from Fortinet, and CloudLabBox is independent of Fortinet.

Do I need a Fortinet licence for these labs?

No. The FortiGates run FortiOS 7.0 under its evaluation licence, which starts when a node first boots and lasts 15 days; wiping the node starts a new one. CloudLabBox doesn’t provide Fortinet licences or subscriptions, so features that need FortiGuard are explained rather than run.

Try a lab before you choose

The free demo is a real workspace for 30 minutes, with 6 vCPU and 8 GB: enough to run 23 of these labs. No card and no email.

Try it free for 30 minutesStart this course

Plans from £3 a day or £0.50 an hour, each with every guided lab.

More practice labs

CloudLabBox is independent of Fortinet. The labs follow exam topics and aren’t vendor training material; vendor names identify the exams and the images in the workspace.