Fortinet FCSS After Retirement: Current NSE 6/7 Secure Networking Path

Fortinet Certified Solution Specialist (FCSS) is a historical certification name, not a badge that a new candidate should try to earn in October 2026. Fortinet replaced FCF, FCA, FCP, FCSS and FCX on July 15, 2026 with NSE levels 1–8 and track-specific credentials. The useful question for someone holding FCSS or studying an older FCSS course is which technical skills still apply, how their passed exams map to current NSE certifications and which new prerequisite might be missing.

There is no one-to-one replacement for every historical FCSS exam. Fortinet mapped active FCSS certifications to NSE 6 or NSE 7 tracks according to the exams passed. The Fortinet certification catalog is a useful overview, but an individual credential depends on the issuer’s official exam history and transition rules, not the name of a saved PDF or course.

What the July 2026 transition actually changed

The new program separates level from technical track. NSE 4 is built around FortiOS administration; NSE 5, 6 and 7 include Secure Networking, Security Operations, SASE and Cloud Security tracks. Passing one exam at a particular level does not imply capability in every track. Secure Networking focuses on traffic paths, SD-WAN, policy, IPsec and multiple FortiGate devices; Security Operations emphasizes monitoring and response; other tracks address different security architectures.

Existing active legacy credentials were not wiped from a holder’s history. Fortinet granted NSE certificates based on active FCP or FCSS certifications and mapped qualifying recent exam results under published rules. The candidate should verify the original exams, dates, track, active legacy status and current NSE awards in the Fortinet certification account. An old FCSS badge alone is not enough to infer whether a current NSE 6 Secure Networking or NSE 7 Secure Networking requirement has been satisfied.

For someone planning a career transition, treat former Enterprise Firewall, Network Security Support Engineer or SD-WAN courseware as technical source material, not as a current booking guide. Check whether an exam has been discontinued, which current exam assesses the durable skill, and how the particular passed exam contributes to the new track. Document the dates and issuer evidence so a stale search result cannot silently override the plan.

NSE 4 and track prerequisites determine the award

Fortinet’s current requirements say that NSE 6 Secure Networking certification requires an active NSE 4 certification and passing a qualifying NSE 6 Secure Networking exam. To earn NSE 7 Secure Networking, the candidate needs active NSE 4, either active NSE 5 Secure Networking or active NSE 6 Secure Networking, and a passing NSE 7 Secure Networking Architect result. The distinction is important: completing an advanced exam before the rest of the chain does not necessarily award the track certification immediately.

Build a two-column checklist: exams passed and certifications currently active. Record when the requirements were satisfied. Some people with valid FCSS history already received mapped awards in July; others may need a track-specific prerequisite or a new exam. Confirm the result directly instead of following a blanket claim that all FCSS holders should take exactly the same next examination.

NSE 6 FortiManager measures safe centralized administration

The current NSE 6 FortiManager 7.6 Administrator exam covers administrative domains, managed-device registration, policy packages, shared objects, device and management databases, installation and troubleshooting. Fortinet lists 70 minutes, 30–40 questions, and product versions FortiManager 7.6.1 and FortiOS 7.6. This is an operations-oriented assessment about configuring and proving central management across many firewalls.

Imagine a change to a common policy used by ten branches. One branch continues to deny an application although the new package appears correctly saved in FortiManager. The engineer should inspect the target ADOM, policy package assignment, revisions, installation status and device-side effective policy before assuming the route or security profile is wrong. A management-console success message does not prove the intended flow works on every FortiGate.

Build a small two-device lab: register devices, create a shared package, add a site-specific object, stage an install and compare the intended state with what the devices actually use. Then deliberately introduce an incorrect install target and capture the management evidence required to find it. The Fortinet NSE 6 FortiManager architecture guide develops these operational skills in greater depth.

NSE 7 Secure Networking is an integrated architect assessment

The current NSE 7 Secure Networking 7.6 Architect exam goes beyond administering FortiManager. It assesses designing, administering and supporting secure SD-WAN and enterprise security infrastructure across multiple FortiGate devices. Fortinet includes incident analysis, central management and logging, policy, dynamic routing, high availability, inspection and advanced IPsec. Its current published format is 75 minutes with 40–50 questions, referencing FortiGate, FortiManager and FortiAnalyzer 7.6.

An architect must predict how a branch application traverses routes, SD-WAN rules, an IPsec overlay, security policy and return paths. If a service fails after a WAN member degrades, the evidence might point to a route withdrawal, SLA eligibility, tunnel negotiation, a stale session or a policy change rather than one magic SD-WAN setting. The difference from an NSE 6 administration problem is that the architect is accountable for the combined behavior across systems and failure domains.

The current NSE 7 Secure Networking 7.6 Architect guide maps that integration to the latest exam areas. Fortinet publishes ranges of 20–30% for system configuration and SD-WAN, 15–25% central management, 5–15% security profiles, 25–35% rules and routing, and 25–35% advanced IPsec. These ranges indicate relative emphasis, not exact question counts.

Turn FCSS-era knowledge into a current lab

Choose one exercise with two branches, a hub, a backup WAN link, a dynamic route, FortiManager policy installation, and FortiAnalyzer logging. Prove ordinary application reachability, then inject a single fault. For one attempt, install a mismatched policy package. For another, degrade the primary path. For a third, leave the IPsec tunnel established but break the return route. Those failures should generate different diagnostic evidence.

Record intended design, source and destination, policy and route expectations, actual forwarding, relevant logs, the corrective action and rollback. A FortiManager specialist should explain package targeting and device-state divergence. An architect should connect that evidence to packet path, SD-WAN, IPsec, inspection and high-availability decisions. This method turns legacy material into current skill instead of treating an obsolete certification exam as an end in itself.

NSE 7 exams became comprehensive with the 2026 program change and may assess content from more than one recommended course. Compare a historical FCSS study plan against the current description before treating it as a complete blueprint. Version-specific configurations, administrative interfaces and retired scheduling instructions must be rechecked even when the underlying routing or security concept remains sound.

Verify scheduling separately from certification eligibility

Fortinet ended remote OnVUE delivery for NSE 7 exams on September 21, 2026. NSE 7 candidates now use authorized Pearson VUE testing centers, while NSE 4–6 have different delivery options. Also distinguish booking an exam from earning a track credential: completing the exam, satisfying the active prerequisites and receiving the certificate are separate checks.

Choose NSE 6 if the immediate responsibility is centrally managing FortiGate fleets with ADOMs, device registration, policy installation and troubleshooting. Choose NSE 7 when the role genuinely requires multi-site architecture across routing, SD-WAN, security, advanced IPsec, centralized administration and incident analysis—and confirm the track requirements first. FCSS can remain an honorable historical achievement, but current issuer facts and demonstrated operational skills should determine the next step.