Fortinet Certification Roadmap: FortiGate, FortiManager, and the New NSE 1-8 Paths Explained

 

How to use this roadmap

This article corrects the planned title because FCP and FCSS were retired on July 15, 2026. Readers need a current map that explains the new NSE levels while preserving the intended FortiGate/FortiManager career intent. A factual correction is required before any useful roadmap can be written: Fortinet retired the FCP and FCSS certification labels on July 15, 2026. The plan’s search intent—how FortiGate, FortiManager, and more advanced Fortinet skills connect—remains valid, but the visible guidance must use the current NSE 1–8 framework.

The research pack for this article was refreshed on September 20, 2026. Fortinet retired FCF, FCA, FCP, FCSS and FCX labels on July 15, 2026. The current framework expands NSE from five to eight levels. NSE 5, 6 and 7 use track-oriented progression across Secure Networking, Security Operations, SASE and Cloud Security. FortiManager administration sits in the Secure Networking progression in current transition materials. These are not cosmetic naming changes; they affect how a new candidate should read old study plans, job postings, and training references.

The safest way to navigate the transition is to separate earned history from current planning. If you earned an FCP or FCSS, list what you actually earned. If you are choosing a new exam now, translate the product and role behind the old label into Fortinet’s current NSE level and track using official transition material.

FortiGate and FortiManager remain central technical skills, so this article preserves the practical intent of the original topic while removing the stale implication that FCP and FCSS are current destinations.

For current Fortinet study navigation inside ExamSnap, use the Fortinet certification training overview. Because Fortinet changed its certification program in July 2026, confirm current NSE exam availability against Fortinet before booking.

The first thing to know: FCP and FCSS are now historical labels

A current roadmap has to begin with the July 15, 2026 program change so candidates do not plan against retired certification names. Because Fortinet changed certification names in July 2026, the first thing to know: fcp and fcss are now historical labels needs two labels in your notes: the enduring technical skill and the current NSE destination. Within The first thing to know: FCP and FCSS are now historical labels, that separation protects the study plan from stale terminology.

Fortinet retired the FCF, FCA, FCP, FCSS and FCX certification labels and re-expanded the NSE program into eight levels, making older diagrams potentially misleading for new candidates. Under the post-July-2026 NSE framework, the first thing to know: fcp and fcss are now historical labels should be mapped to a current level and track only after the product responsibility is clear. Within The first thing to know: FCP and FCSS are now historical labels, that avoids forcing old FCP or FCSS language onto a program Fortinet has already reorganized.

Existing knowledge did not become useless overnight: FortiGate, FortiManager, security operations, SASE and cloud skills still matter, but the way Fortinet groups and names certifications has changed. For the first thing to know: fcp and fcss are now historical labels, use Fortinet’s transition material as the naming authority and use a lab for the technical truth. Within The first thing to know: FCP and FCSS are now historical labels, trace what FortiGate or FortiManager actually does, collect the relevant logs or revision state, and verify the result before calling a change complete.

When an older job post asks for FCP or FCSS, interpret it as evidence of Fortinet platform depth and then verify which current NSE credential best represents that skill set. The transition lesson from the first thing to know: fcp and fcss are now historical labels is durability: product administration, secure networking, SecOps, SASE, and cloud skills outlive certification labels. Within The first thing to know: FCP and FCSS are now historical labels, build those skills deeply enough that a July 2026 naming change alters your exam plan but does not erase your operational competence.

Scenario: A candidate finds a 2025 roadmap recommending FCP Network Security; rather than following the old badge name, the candidate should map the underlying FortiGate and secure-networking skills into the current NSE structure. For the first thing to know: fcp and fcss are now historical labels, separate the product diagnosis from the certification label. Within The first thing to know: FCP and FCSS are now historical labels, use current NSE terminology for planning, but let FortiGate or FortiManager state—not an old FCP/FCSS diagram—decide the operational response.

Fortinet drill for The first thing to know: FCP and FCSS are now historical labels: note the old label you might encounter, map the responsibility to the current NSE framework, then prove the technical behavior in a FortiGate/FortiManager lab or a vendor-provided exercise. Within The first thing to know: FCP and FCSS are now historical labels, keep transition history and operational evidence in separate notes so neither is confused with the other.

NSE 1 through NSE 4 build foundations and FortiGate administration

The lower levels should be read as increasing operational depth, not as four interchangeable introductory badges. Because Fortinet changed certification names in July 2026, nse 1 through nse 4 build foundations and fortigate administration needs two labels in your notes: the enduring technical skill and the current NSE destination. Within NSE 1 through NSE 4 build foundations and FortiGate administration, that separation protects the study plan from stale terminology.

Early NSE levels establish security and Fortinet solution awareness before the roadmap reaches deeper product administration, so beginners can build vocabulary without pretending they already operate production firewalls. Under the post-July-2026 NSE framework, nse 1 through nse 4 build foundations and fortigate administration should be mapped to a current level and track only after the product responsibility is clear. Within NSE 1 through NSE 4 build foundations and FortiGate administration, that avoids forcing old FCP or FCSS language onto a program Fortinet has already reorganized.

NSE 4 is the point where FortiGate administration becomes central in the current transition framework, making it a practical target for people who configure and troubleshoot FortiOS in day-to-day work. For nse 1 through nse 4 build foundations and fortigate administration, use Fortinet’s transition material as the naming authority and use a lab for the technical truth. Within NSE 1 through NSE 4 build foundations and FortiGate administration, trace what FortiGate or FortiManager actually does, collect the relevant logs or revision state, and verify the result before calling a change complete.

FortiGate readiness should include interfaces, routing, policies, objects, NAT, VPN concepts, security profiles, logging, HA context and systematic traffic-flow troubleshooting rather than menu memorization. The transition lesson from nse 1 through nse 4 build foundations and fortigate administration is durability: product administration, secure networking, SecOps, SASE, and cloud skills outlive certification labels. Within NSE 1 through NSE 4 build foundations and FortiGate administration, build those skills deeply enough that a July 2026 naming change alters your exam plan but does not erase your operational competence.

Scenario: A support engineer who can explain threats but has never traced a FortiGate session should spend more time on controlled FortiOS administration before jumping toward higher track credentials. For nse 1 through nse 4 build foundations and fortigate administration, separate the product diagnosis from the certification label. Within NSE 1 through NSE 4 build foundations and FortiGate administration, use current NSE terminology for planning, but let FortiGate or FortiManager state—not an old FCP/FCSS diagram—decide the operational response.

Fortinet drill for NSE 1 through NSE 4 build foundations and FortiGate administration: note the old label you might encounter, map the responsibility to the current NSE framework, then prove the technical behavior in a FortiGate/FortiManager lab or a vendor-provided exercise. Within NSE 1 through NSE 4 build foundations and FortiGate administration, keep transition history and operational evidence in separate notes so neither is confused with the other.

NSE 5, 6 and 7 are organized around role tracks

The middle and upper program now makes it clearer that advanced work differs by security domain. Because Fortinet changed certification names in July 2026, nse 5, 6 and 7 are organized around role tracks needs two labels in your notes: the enduring technical skill and the current NSE destination. Within NSE 5, 6 and 7 are organized around role tracks, that separation protects the study plan from stale terminology.

Secure Networking, Security Operations, SASE and Cloud Security provide distinct tracks, so the relevant certification depends on whether the practitioner owns network controls, SOC tooling, edge access or cloud security outcomes. Under the post-July-2026 NSE framework, nse 5, 6 and 7 are organized around role tracks should be mapped to a current level and track only after the product responsibility is clear. Within NSE 5, 6 and 7 are organized around role tracks, that avoids forcing old FCP or FCSS language onto a program Fortinet has already reorganized.

Progression should follow the products and decisions in the job; a FortiAnalyzer-heavy analyst and a FortiManager-heavy network engineer need different practical evidence even if both work in a Fortinet environment. For nse 5, 6 and 7 are organized around role tracks, use Fortinet’s transition material as the naming authority and use a lab for the technical truth. Within NSE 5, 6 and 7 are organized around role tracks, trace what FortiGate or FortiManager actually does, collect the relevant logs or revision state, and verify the result before calling a change complete.

At higher levels, candidates should expect to integrate multiple capabilities and reason about design, operations and troubleshooting across a solution rather than one isolated configuration page. The transition lesson from nse 5, 6 and 7 are organized around role tracks is durability: product administration, secure networking, SecOps, SASE, and cloud skills outlive certification labels. Within NSE 5, 6 and 7 are organized around role tracks, build those skills deeply enough that a July 2026 naming change alters your exam plan but does not erase your operational competence.

Scenario: A managed-service provider has one team operating FortiGate/FortiManager and another triaging security telemetry; assigning both teams the same certification goal would ignore their different responsibilities. For nse 5, 6 and 7 are organized around role tracks, separate the product diagnosis from the certification label. Within NSE 5, 6 and 7 are organized around role tracks, use current NSE terminology for planning, but let FortiGate or FortiManager state—not an old FCP/FCSS diagram—decide the operational response.

Fortinet drill for NSE 5, 6 and 7 are organized around role tracks: note the old label you might encounter, map the responsibility to the current NSE framework, then prove the technical behavior in a FortiGate/FortiManager lab or a vendor-provided exercise. Within NSE 5, 6 and 7 are organized around role tracks, keep transition history and operational evidence in separate notes so neither is confused with the other.

FortiManager belongs in a centralized secure-networking story

FortiManager becomes valuable when policy and device administration must be controlled across many FortiGate systems. Because Fortinet changed certification names in July 2026, fortimanager belongs in a centralized secure-networking story needs two labels in your notes: the enduring technical skill and the current NSE destination. Within FortiManager belongs in a centralized secure-networking story, that separation protects the study plan from stale terminology.

Centralized management adds concerns such as administrative domains, object consistency, policy packages, staged changes, revision history, workflow, device state and controlled deployment at scale. Under the post-July-2026 NSE framework, fortimanager belongs in a centralized secure-networking story should be mapped to a current level and track only after the product responsibility is clear. Within FortiManager belongs in a centralized secure-networking story, that avoids forcing old FCP or FCSS language onto a program Fortinet has already reorganized.

The current transition mapping places FortiManager Administrator in the NSE 6 Secure Networking progression, which is a better current reference than older FCP/FCSS labels. For fortimanager belongs in a centralized secure-networking story, use Fortinet’s transition material as the naming authority and use a lab for the technical truth. Within FortiManager belongs in a centralized secure-networking story, trace what FortiGate or FortiManager actually does, collect the relevant logs or revision state, and verify the result before calling a change complete.

The practical skill is not simply knowing where the Install button is; it is understanding what will change on which devices, how to validate the delta, how to recover, and how to prevent shared objects from creating unintended blast radius. The transition lesson from fortimanager belongs in a centralized secure-networking story is durability: product administration, secure networking, SecOps, SASE, and cloud skills outlive certification labels. Within FortiManager belongs in a centralized secure-networking story, build those skills deeply enough that a July 2026 naming change alters your exam plan but does not erase your operational competence.

Scenario: A global policy update is correct for branch firewalls but dangerous for a data-center ADOM; the FortiManager operator must use scope, revision evidence and staged deployment rather than pushing globally by habit. For fortimanager belongs in a centralized secure-networking story, separate the product diagnosis from the certification label. Within FortiManager belongs in a centralized secure-networking story, use current NSE terminology for planning, but let FortiGate or FortiManager state—not an old FCP/FCSS diagram—decide the operational response.

Fortinet drill for FortiManager belongs in a centralized secure-networking story: note the old label you might encounter, map the responsibility to the current NSE framework, then prove the technical behavior in a FortiGate/FortiManager lab or a vendor-provided exercise. Within FortiManager belongs in a centralized secure-networking story, keep transition history and operational evidence in separate notes so neither is confused with the other.

For historical FortiGate skill context—while remembering that FCP naming is retired—see ExamSnap coverage of FortiGate expertise. The article can explain durable FortiGate concepts, but its FCP-era label must be interpreted as historical rather than current certification guidance.

FortiGate expertise still starts with traffic flow

Program names can change, but firewall troubleshooting remains anchored in understanding what the packet should do. Because Fortinet changed certification names in July 2026, fortigate expertise still starts with traffic flow needs two labels in your notes: the enduring technical skill and the current NSE destination. Within FortiGate expertise still starts with traffic flow, that separation protects the study plan from stale terminology.

A disciplined FortiGate workflow starts with source and destination, ingress and egress, route lookup, policy match, NAT, security profile behavior, session state and relevant logs. Under the post-July-2026 NSE framework, fortigate expertise still starts with traffic flow should be mapped to a current level and track only after the product responsibility is clear. Within FortiGate expertise still starts with traffic flow, that avoids forcing old FCP or FCSS language onto a program Fortinet has already reorganized.

Broad allow rules are poor diagnostic tools because they can hide routing, identity, translation or profile problems while introducing new exposure. For fortigate expertise still starts with traffic flow, use Fortinet’s transition material as the naming authority and use a lab for the technical truth. Within FortiGate expertise still starts with traffic flow, trace what FortiGate or FortiManager actually does, collect the relevant logs or revision state, and verify the result before calling a change complete.

High availability and change management also matter: a technically correct policy change is not production-ready unless synchronization, rollback, maintenance constraints and monitoring are understood. The transition lesson from fortigate expertise still starts with traffic flow is durability: product administration, secure networking, SecOps, SASE, and cloud skills outlive certification labels. Within FortiGate expertise still starts with traffic flow, build those skills deeply enough that a July 2026 naming change alters your exam plan but does not erase your operational competence.

Scenario: Users report that one SaaS application fails after a policy change; the engineer should trace the session and profile decision instead of disabling inspection across all outbound traffic. For fortigate expertise still starts with traffic flow, separate the product diagnosis from the certification label. Within FortiGate expertise still starts with traffic flow, use current NSE terminology for planning, but let FortiGate or FortiManager state—not an old FCP/FCSS diagram—decide the operational response.

Fortinet drill for FortiGate expertise still starts with traffic flow: note the old label you might encounter, map the responsibility to the current NSE framework, then prove the technical behavior in a FortiGate/FortiManager lab or a vendor-provided exercise. Within FortiGate expertise still starts with traffic flow, keep transition history and operational evidence in separate notes so neither is confused with the other.

Use the former FCP and FCSS names only to translate legacy references

Old certification names will remain in resumes, training libraries and job descriptions for years, so candidates need a translation method. Because Fortinet changed certification names in July 2026, use the former fcp and fcss names only to translate legacy references needs two labels in your notes: the enduring technical skill and the current NSE destination. Within Use the former FCP and FCSS names only to translate legacy references, that separation protects the study plan from stale terminology.

Treat FCP and FCSS as historical metadata: identify the products, role and depth the older credential represented, then compare that evidence with the current NSE level and track. Under the post-July-2026 NSE framework, use the former fcp and fcss names only to translate legacy references should be mapped to a current level and track only after the product responsibility is clear. Within Use the former FCP and FCSS names only to translate legacy references, that avoids forcing old FCP or FCSS language onto a program Fortinet has already reorganized.

Do not assume a one-for-one semantic match from every old title to one new badge; official transition guidance is the authority when a precise mapping matters. For use the former fcp and fcss names only to translate legacy references, use Fortinet’s transition material as the naming authority and use a lab for the technical truth. Within Use the former FCP and FCSS names only to translate legacy references, trace what FortiGate or FortiManager actually does, collect the relevant logs or revision state, and verify the result before calling a change complete.

On a resume, professionals can preserve the credential they actually earned while describing current product skills separately, avoiding the misleading claim that an old credential has been renamed on their certificate. The transition lesson from use the former fcp and fcss names only to translate legacy references is durability: product administration, secure networking, SecOps, SASE, and cloud skills outlive certification labels. Within Use the former FCP and FCSS names only to translate legacy references, build those skills deeply enough that a July 2026 naming change alters your exam plan but does not erase your operational competence.

Scenario: An engineer earned an FCP before July 2026; the honest presentation is to list that earned credential and separately show current FortiGate/FortiManager experience, not silently rewrite history. For use the former fcp and fcss names only to translate legacy references, separate the product diagnosis from the certification label. Within Use the former FCP and FCSS names only to translate legacy references, use current NSE terminology for planning, but let FortiGate or FortiManager state—not an old FCP/FCSS diagram—decide the operational response.

Fortinet drill for Use the former FCP and FCSS names only to translate legacy references: note the old label you might encounter, map the responsibility to the current NSE framework, then prove the technical behavior in a FortiGate/FortiManager lab or a vendor-provided exercise. Within Use the former FCP and FCSS names only to translate legacy references, keep transition history and operational evidence in separate notes so neither is confused with the other.

Build a lab around safe change, verification and recovery

Fortinet preparation should show operational judgment, especially once the path reaches centralized management and advanced tracks. Because Fortinet changed certification names in July 2026, build a lab around safe change, verification and recovery needs two labels in your notes: the enduring technical skill and the current NSE destination. Within Build a lab around safe change, verification and recovery, that separation protects the study plan from stale terminology.

Create a small FortiGate lab, define expected flows, implement least-privilege policy, generate logs, break routing or policy intentionally, and recover using observed evidence. Under the post-July-2026 NSE framework, build a lab around safe change, verification and recovery should be mapped to a current level and track only after the product responsibility is clear. Within Build a lab around safe change, verification and recovery, that avoids forcing old FCP or FCSS language onto a program Fortinet has already reorganized.

Add FortiManager practice where available by managing policy revisions, objects and deployment scope; document exactly what will change before installing a configuration. For build a lab around safe change, verification and recovery, use Fortinet’s transition material as the naming authority and use a lab for the technical truth. Within Build a lab around safe change, verification and recovery, trace what FortiGate or FortiManager actually does, collect the relevant logs or revision state, and verify the result before calling a change complete.

For SecOps, SASE or cloud tracks, add the telemetry and control plane used by that role instead of forcing every exercise to remain firewall-centric. The transition lesson from build a lab around safe change, verification and recovery is durability: product administration, secure networking, SecOps, SASE, and cloud skills outlive certification labels. Within Build a lab around safe change, verification and recovery, build those skills deeply enough that a July 2026 naming change alters your exam plan but does not erase your operational competence.

Scenario: A learner who can predict which rule will match, prove the session outcome and roll back a bad deployment demonstrates more professional readiness than someone who only remembers an exam objective. For build a lab around safe change, verification and recovery, separate the product diagnosis from the certification label. Within Build a lab around safe change, verification and recovery, use current NSE terminology for planning, but let FortiGate or FortiManager state—not an old FCP/FCSS diagram—decide the operational response.

Fortinet drill for Build a lab around safe change, verification and recovery: note the old label you might encounter, map the responsibility to the current NSE framework, then prove the technical behavior in a FortiGate/FortiManager lab or a vendor-provided exercise. Within Build a lab around safe change, verification and recovery, keep transition history and operational evidence in separate notes so neither is confused with the other.

Choose the current NSE target from your job responsibilities

The new framework is most useful when it routes candidates toward work they already do or are preparing to do. Because Fortinet changed certification names in July 2026, choose the current nse target from your job responsibilities needs two labels in your notes: the enduring technical skill and the current NSE destination. Within Choose the current NSE target from your job responsibilities, that separation protects the study plan from stale terminology.

FortiGate administration points toward the secure-networking progression; centralized FortiManager work adds management depth; SOC, SASE and cloud responsibilities should follow their corresponding tracks. Under the post-July-2026 NSE framework, choose the current nse target from your job responsibilities should be mapped to a current level and track only after the product responsibility is clear. Within Choose the current NSE target from your job responsibilities, that avoids forcing old FCP or FCSS language onto a program Fortinet has already reorganized.

Use the official Fortinet transition and exam-release pages before booking because the 2026 program is new and individual exam availability can change faster than third-party diagrams. For choose the current nse target from your job responsibilities, use Fortinet’s transition material as the naming authority and use a lab for the technical truth. Within Choose the current NSE target from your job responsibilities, trace what FortiGate or FortiManager actually does, collect the relevant logs or revision state, and verify the result before calling a change complete.

The goal is durable capability: configure safely, diagnose from evidence, explain risk, automate responsibly, and recover from failure. Certification is a structured way to validate that capability, not a substitute for it. The transition lesson from choose the current nse target from your job responsibilities is durability: product administration, secure networking, SecOps, SASE, and cloud skills outlive certification labels. Within Choose the current NSE target from your job responsibilities, build those skills deeply enough that a July 2026 naming change alters your exam plan but does not erase your operational competence.

Scenario: A candidate deciding between two NSE paths should compare weekly job tasks and the products they actually operate; the right choice is the one whose objectives map to real decisions, not the one with the larger number. For choose the current nse target from your job responsibilities, separate the product diagnosis from the certification label. Within Choose the current NSE target from your job responsibilities, use current NSE terminology for planning, but let FortiGate or FortiManager state—not an old FCP/FCSS diagram—decide the operational response.

Fortinet drill for Choose the current NSE target from your job responsibilities: note the old label you might encounter, map the responsibility to the current NSE framework, then prove the technical behavior in a FortiGate/FortiManager lab or a vendor-provided exercise. Within Choose the current NSE target from your job responsibilities, keep transition history and operational evidence in separate notes so neither is confused with the other.

Putting the roadmap into action

The most important Fortinet roadmap fact in late 2026 is the program transition itself: FCP and FCSS are retired labels, while the current structure is NSE 1 through NSE 8 with role tracks at the higher levels. New candidates should plan with that current framework.

FortiGate traffic flow and FortiManager change discipline remain durable skills. Learn them deeply, use official Fortinet transition pages for exact mapping, and let the current job responsibility—not an outdated chart—determine which NSE level and track comes next.

A 90-day applied development plan

Days 1–30: clean up the certification map before studying. Write a translation sheet with two columns: legacy terms you will still encounter, such as FCP or FCSS, and the current NSE 1–8 level or track that Fortinet’s transition guidance maps to the relevant responsibility. Then build a FortiGate lab focused on traffic flow—interfaces, routing, policies, NAT, profiles, sessions, and logs. The first month should end with one troubleshooting runbook that never depends on an old badge name to explain what the firewall is actually doing.

Days 31–60: add centralized-management discipline. Where FortiManager access is available, practice device registration or management context, policy packages, shared objects, revisions, scoped installation, and rollback thinking. Before each change, write which devices and objects are expected to change; after installation, verify the delta and business flow. If a full FortiManager lab is not available, run the exercise as a tabletop using screenshots or vendor documentation and emphasize change scope. This month connects FortiGate skill to the Secure Networking progression in the current framework.

Days 61–90: branch according to the current role. Secure Networking candidates can deepen high availability, VPN, centralized policy, and advanced troubleshooting; SecOps candidates should spend the month on telemetry, investigation, and response; SASE and Cloud Security candidates should practice those control planes instead of forcing every task back into firewall configuration. Recheck Fortinet’s current exam-release and transition pages before booking because the program is newly reorganized. By day ninety, your plan should use present NSE names while preserving an honest record of any legacy credential you actually earned.