How do you get multiple Fortinet security devices to stop acting like strangers in a crowded room and start working as a single, intelligent security team? For the NSE7 exam, you need to understand exactly how FortiGate, FortiManager, FortiAnalyzer, and other Fortinet components share information and automate responses to threats—this is the heart of the Security Fabric.
Jump to a section
A simple way to picture Security Fabric Integration
When you first move into a new apartment building, you deal with a single manager for your lease, a separate team for maintenance, and a different company for parcel deliveries. If your sink leaks, you call maintenance, but they might not know who handles the security fob for the basement. This causes delays, confusion, and missed problems. That is how a traditional, unintegrated network works.
Now imagine a building where one central management company oversees everything. They use a single software platform that connects the security guards, the maintenance crew, the parcel room, and the access control for all doors. When a security guard notices a suspicious person tailgating a resident through the front door, they can instantly alert the maintenance team to lock down the roof entrance and notify the parcel room to hold all deliveries until the situation is clear. This is Security Fabric Integration. All the different security systems—the guards (FortiGate firewalls), the door locks (FortiSwitch switches), the intercom (FortiAP wireless access points), and the security camera system (FortiNAC)—are linked through one central command centre (FortiManager) and one central data storage (FortiAnalyzer). The result is a single, coordinated response instead of separate, disconnected alerts. The cause of a security event triggers a coordinated effect across the entire building, instantly.
Security Fabric Integration is Fortinet's way of gluing all of your separate security tools together so they act as one organism. Think of a traditional IT network as a house with separate locks on every door. You might have a front door lock (a firewall), a window lock (an intrusion prevention system), and a motion sensor (an endpoint protection agent). They all work, but they do not talk to each other. If someone breaks the window, the motion sensor might beep, but the front door lock does not lock itself automatically. Security Fabric Integration solves this by creating a central nervous system for your entire security infrastructure.
Here are the key components you must know for the NSE7 exam. First, there is the FortiGate. This is your core firewall and the primary traffic cop. It inspects all the data entering and leaving your network. Second, you have FortiManager. This is the central command centre. Instead of logging into every single FortiGate separately to change a rule (which is a nightmare if you have 50 firewalls), you log into one FortiManager, make the change, and it pushes that change to every FortiGate in the Fabric. Third, there is FortiAnalyzer. This is the central logging and reporting brain. Every FortiGate, FortiSwitch, and FortiAP sends its logs (records of everything happening) to FortiAnalyzer. It stores these logs, runs reports on them (e.g., "which user is visiting which blocked websites?"), and can alert you to security trends.
How does integration actually happen? The magic is the Fortinet Security Fabric protocol. All supported Fortinet devices (and some third-party ones) use this secure, encrypted channel to talk to each other. The process starts when you 'join' a device to the Fabric. For example, you configure FortiGate A to be the 'root' of the Fabric. Then, you add FortiGate B by giving it the IP address of FortiGate A and a shared 'fabric key' (like a secret handshake password). Once connected, FortiGate A can share dynamic information with FortiGate B. A powerful feature is 'automatic threat sharing'. If FortiGate A detects a new, unknown malware variant making an outbound connection to a malicious command-and-control server (the attacker's control centre), it can automatically create a new block rule and share that rule with FortiGate B. FortiGate B now knows to block that threat immediately, even though it has not seen it yet itself. This is called 'automated response' and 'policy synchronisation'.
What about FortiSwitch and FortiAP? FortiSwitch is a network switch (the box that physically connects computers to the network with cables). FortiAP is a wireless access point (the device that gives out Wi-Fi). When these are part of the Security Fabric, FortiGate can 'see' which user is connected to which physical port on the switch or which Wi-Fi network. This gives you extreme visibility. If a user violates a security policy, FortiGate can tell the switch to 'quarantine' that specific port, cutting that user off from the network instantly. The old way of doing this required a security team to find the switch port number, manually call the networking team, and wait hours for them to block it. The Fabric does it in milliseconds.
The Fabric also includes 'Security Rating'. This is a built-in feature that scans your entire Fortinet environment and gives you a score out of 100. It checks if your firmware is up-to-date, if you are using best-practice policies, and if you have enabled the strongest encryption. It is like a security MOT test for your entire network, and it is all possible because the Fabric has complete visibility into every device.
Finally, the exam will test you on the concept of 'single pane of glass' management. Without the Fabric, you use multiple different consoles (one for firewall, one for switches, one for wireless, one for logging). With the Fabric, FortiManager becomes that single pane of glass. You can see the entire network topology, manage all policies from one place, and deploy new configurations in bulk. This reduces human error, saves time, and dramatically improves your security posture because you are not missing gaps between disparate systems.
Designate the Root FortiGate
Select one FortiGate to be the primary device that initiates the Fabric. This device will be responsible for sharing threat intelligence and acting as the first point of contact for other joining devices. Usually, this is your central headquarters firewall.
Configure the Fabric Key on the Root
On the root FortiGate, you create a shared secret string called the 'fabric key'. This is like a password that other devices must present to join the Fabric. This ensures only authorised devices can connect.
Join a New Device to the Fabric
On a new FortiGate (e.g., at a branch office), you enter the root FortiGate's IP address and the shared fabric key. The new device then initiates a secure handshake. If the serial number is authorised and the fabric key matches, it becomes a Fabric member.
Register Devices with FortiManager
From the FortiManager interface, you add the root FortiGate (and all joined devices) as managed devices. FortiManager now has the authority to view their configurations and push policy updates to them centrally.
Configure Log Shipping to FortiAnalyzer
On each FortiGate in the Fabric, you configure the log settings to send logs to the FortiAnalyzer. This centralises all event data so you can run reports and conduct forensic investigations from one place.
Create an Automation Stitch
In FortiManager, you create an automation stitch. You define a trigger (e.g., 'ransomware detected') and an action (e.g., 'block source IP on all FortiGates and send alert to admin'). This enforces an automatic, coordinated response across the entire Fabric.
An IT professional at a mid-sized retail company with 30 stores is responsible for the company's network security. Currently, each store has its own FortiGate firewall configured completely independently. When a security vulnerability is discovered in the firewall's operating system (the firmware), the professional has to manually log into each of the 30 firewalls, download the update, and install it. This takes two full days. Worse, a new point-of-sale malware signature was released yesterday. After patching the first five stores, a critical flaw is detected at store six. The professional has no automated way to block that new threat across all other stores instantly.
To fix this, the professional decides to deploy Security Fabric Integration. Here is the step-by-step process they follow:
First, they install a central FortiManager in the company's headquarters data centre. This becomes the single point of control.
Second, they install a central FortiAnalyzer to aggregate all logs from every store for compliance and forensic analysis.
Third, they 'register' every store's FortiGate with the central FortiManager using the Fabric join process. This involves entering each firewall's serial number and creating a one-time password for the secure handshake.
Fourth, they create a 'global policy' in FortiManager that blocks the new malware signature and schedule it to be pushed to all 30 firewalls at 2:00 AM. The push takes less than five minutes.
Fifth, they configure an automation stitch in FortiManager. An automation stitch is a predefined, automatic response to a security event. They create one that says: "If any FortiGate detects a ransomware beacon, immediately block the source IP on all other FortiGates, and send a report to FortiAnalyzer."
Now, when a store detects ransomware, everything happens automatically. The infected machine is isolated instantly across the entire company. The IT professional no longer spends days doing manual patching. Instead, they can now use that time to analyse the FortiAnalyzer reports for long-term security trends. The business impact is massive: reduced downtime, faster threat containment, and a demonstrably higher security rating that helps them pass insurance audits. The old process left the company vulnerable for up to 48 hours during patching. The new Fabric-based process reduces that window to minutes. That is the difference between losing customer data and protecting it.
NSE7 tests Security Fabric Integration heavily, and you can expect several questions that are designed to trap you if you only have a surface-level understanding. The exam loves to test the specific communication methods and limitations of the Fabric. Here is what you need to know:
Exam Topic: 'Fabric Joining and Authentication.' The exam will ask how devices authenticate to join the Fabric. The correct answer always involves a shared 'fabric key' (a password) and a serial number handshake. A common trap is suggesting a username/password or an IP-based trust. The exam expects you to know it is a pre-shared secret plus device identity. Memorise that.
Exam Topic: 'Role of FortiManager vs. FortiAnalyzer.' This is the most common confusion point. Traps will describe FortiAnalyzer as a management tool or FortiManager as a logging tool. FortiManager manages configurations and deploys policies. FortiAnalyzer collects logs and generates reports. FortiManager cannot function as a full log collector, and FortiAnalyzer cannot push policy changes. Mixing these two leads to wrong answers.
Exam Topic: 'Automation Stitches and Triggers.' The exam will present scenarios and ask which automation trigger is appropriate. Triggers include 'Event' (a specific log entry), 'Schedule' (run every hour), and 'Manual'. Traps will try to make you use a trigger that does not match the scenario (e.g., using a schedule trigger for an event that requires an immediate response). Know the difference.
Exam Topic: 'Security Rating.' The exam tests what Security Rating evaluates. It looks at firmware version (are you up to date?), best practices (are you using default settings poorly?), and encryption strength. A trap might claim it tests for user password strength—it does not. It is specifically about the configuration and health of Fortinet devices.
Exam Topic: 'Central Management vs. Central Logging.' The exam might ask where you deploy FortiManager. The correct answer is usually at a central hub (like HQ) and it manages 'spokes' (branches). A trap might suggest deploying FortiManager at every branch. The whole point of central management is to consolidate control. Do not decentralise it.
Exam Topic: 'Fabric Limitations.' The exam will test what happens if a device loses connection to the Fabric. The key fact is: the device continues to enforce its local policies using its last known configuration. It does not stop working. A trap question might say the device becomes completely non-functional. The correct pattern is 'graceful degradation'—it keeps working but cannot receive updates or share threats.
Key Definitions to Memorise: 'root FortiGate' (the first one that initiates the Fabric), 'fabric key' (the shared secret), 'automation stitch' (the automated response workflow), and 'log aggregation' (gathering logs from multiple sources to one FortiAnalyzer).
The root FortiGate initiates the Security Fabric and is the primary device for sharing dynamic threat intelligence with other fabric members.
FortiManager pushes policy configurations to devices; FortiAnalyzer collects logs and generates reports—never confuse their roles.
Automation stitches link a trigger (like a detected malware event) to an action (like blocking a source IP on all fabric devices).
Security Rating evaluates your fabric's firmware version, configuration best practices, and encryption strength, giving you a score out of 100.
When a Fabric member loses its connection to FortiManager or the root FortiGate, it continues to operate with its last cached configuration and policies—graceful degradation.
Joining a device to the Fabric requires a valid serial number and a matching pre-shared fabric key; this is not an optional step.
A single pane of glass means you manage all fabric devices from one FortiManager interface instead of logging into each device separately.
These come up on the exam all the time. Here's how to tell them apart.
FortiManager
Manages and deploys configuration policies to devices
Stores the 'running configuration' of Fabric members
Cannot collect or store logs from devices
FortiAnalyzer
Collects and stores logs from all Fabric devices
Generates compliance reports and security trend analysis
Cannot push or modify configuration policies on devices
Automation Stitch
Executes an action automatically when a trigger event occurs
Requires no human intervention once configured
Reacts in milliseconds to threats across the Fabric
Manual Policy Update
Requires an administrator to manually log in and change a rule
Can take hours or days depending on the admin's availability
Prone to human error and inconsistency across devices
Fabric Joining (Pre-shared Key)
Uses a shared fabric key and device serial number for authentication
Allows full bi-directional threat sharing and automated responses
Is specific to Fortinet's proprietary protocol
Simple Network Management Protocol (SNMP) Management
Uses community strings (passwords) sent in clear text or SNMP v3
Typically used only for read-only monitoring of device status
Does not support event-driven policy changes or threat sharing
Root FortiGate in Fabric
Initiates the Fabric and authorises new devices to join
Is the primary source for shared dynamic threat intelligence
Must be configured first before other devices can join
Non-root FortiGate in Fabric
Joins the Fabric by authenticating to the root FortiGate
Receives threat intelligence but can also share locally detected threats
Cannot authorise other devices to join; must rely on the root
Mistake
Security Fabric Integration is only useful for very large enterprises with hundreds of devices.
Correct
Security Fabric Integration is beneficial for any organisation with more than one FortiGate because it centralises management and automates threat sharing, reducing manual work and response times even with just two or three firewalls.
Beginners often think that integration tools are only for 'big companies' because the marketing material focuses on large-scale deployments, ignoring the immediate efficiency gains for smaller, multi-site businesses.
Mistake
Once devices are part of the Security Fabric, FortiManager automatically takes over all local configurations and you cannot make changes directly on the FortiGate again.
Correct
You can still make local changes on a managed FortiGate, but it is strongly discouraged because the next time FortiManager pushes a policy, it can overwrite those local changes. The correct practice is to always make changes through FortiManager to maintain consistency.
This confusion arises because people assume 'central management' means 'complete lockdown of local control', similar to how a cloud-based tool might disable local access entirely.
Mistake
FortiAnalyzer and FortiManager serve the same purpose—they both store configurations and logs.
Correct
FortiManager is exclusively for configuration management and policy deployment. FortiAnalyzer is exclusively for log collection, storage, and reporting. They are distinct tools that work together but cannot substitute for each other.
The similar-sounding names and the fact they are often deployed in the same organisation lead beginners to blur their roles, especially when studying quickly for the exam.
Mistake
If the link between a remote FortiGate and the central FortiManager goes down, the FortiGate stops passing traffic entirely until the connection is restored.
Correct
The FortiGate continues to pass traffic and enforce its existing policies. It simply cannot receive new policy updates or share threat intelligence during the outage. This is called 'graceful degradation'.
This misconception comes from assuming that central management is a mandatory, live dependency, similar to how a phone home server works for some subscription-based products. Firewalls are designed to be resilient.
Reveal each answer, then mark whether you got it right. Score 60%+ to unlock the next chapter.
No. Fortinet strongly recommends that all Fabric components run the same firmware version. Mismatched versions can cause compatibility issues and the Fabric may fail to synchronise properly.
Existing Fabric members will maintain their current connection, but any new devices trying to join will fail unless they also get the new key. It is best to change the key only during a planned maintenance window and re-join all devices.
The core Fabric integration (threat sharing, automated response) works only with Fortinet devices. Fortinet offers an 'open API' for some third-party integration via FortiSOAR, but the deep, automatic policy synchronisation is a Fortinet-only feature.
Yes. Both FortiManager and FortiAnalyzer require their own licenses (usually managed through FortiCare). The Fabric joining capability itself is included with FortiGate, but central management and central logging are separate licensed products.
Yes. A single FortiManager can manage multiple, completely independent Security Fabrics (e.g., one for each customer or department). Each Fabric remains isolated in terms of policy, but all are controlled from the same FortiManager console.
HA is about redundancy—if one firewall fails, another takes over with the same configuration. Security Fabric Integration is about coordination between different firewalls and other security devices (switches, APs) to share information and automate responses. They work together but solve different problems.
You've finished Security Fabric Integration. Continue through the NSE7 study guide to build a complete picture of the exam.
Done with this chapter?