Fortinet\u2019s certification structure changed materially on July 15, 2026. The older FCF, FCA, FCP, FCSS, and FCX certification labels were retired as current program levels and replaced by an expanded NSE 1\u20138 model with four primary technical tracks: Secure Networking, Security Operations, SASE, and Cloud Security. Older exam identifiers still appear in historical materials and search results, so candidates need to distinguish the legacy name from the certification level that applies now.<\/p>\n
Fortinet certifications<\/a> now use the NSE 1\u20138 structure introduced in 2026. Within Secure Networking, FortiGate\/FortiOS administration, FortiSwitch, FortiManager, and the transition from the former Enterprise Firewall path lead toward the current NSE 7 Secure Networking Architect exam.<\/p>\n Effective July 15, 2026, Fortinet expanded the program to eight NSE levels. The current structure begins with foundational NSE 1, NSE 2, and NSE 3 certifications, moves into a proctored NSE 4 FortiOS Administrator level, then branches into track-specific NSE 5, NSE 6, and NSE 7 certifications. NSE 8 remains the expert level with practical assessment requirements.<\/p>\n The change was not simply a rename. Fortinet also introduced track-specific requirements and new comprehensive NSE 7 exams. For Secure Networking, the progression now reflects increasing responsibility: FortiOS administration at NSE 4, product\/solution specialization at NSE 5 or NSE 6, architecture at NSE 7, and expert practical validation at NSE 8. That makes current labels easier to align with job depth than the former FCP\/FCSS\/FCX names, but older exam codes remain part of the installed search and content inventory.<\/p>\n The four-track structure matters because the same NSE number can represent different technical domains. \u201cNSE 6\u201d alone is incomplete context after the 2026 change: a candidate can hold NSE 6 in Secure Networking, Security Operations, SASE, or Cloud Security. The track should therefore be named whenever it changes what a candidate needs to study or which role the certification represents.<\/p>\n Currentness should not be inferred from a historical course name or an older exam identifier. Fortinet retained certification history, so older FCP, FCSS, and FCX terms remain useful for understanding previous credentials, but current program language must follow the present NSE mapping.<\/p>\n Fortinet\u2019s transition rules map active legacy certifications into the new NSE program. Active FCP certifications can result in NSE 4 plus relevant NSE 5 or NSE 6 certifications based on the exams behind the FCP. Active FCSS certifications can map into NSE 6 or NSE 7 certifications based on the historical exam\/track. Active FCX maps to NSE 8. Earlier FCF and FCA levels map to the new foundational levels.<\/p>\n Legacy identifiers are still useful when a candidate is interpreting older study material or certification history, but active preparation should use the certification level that can be earned now. An identifier containing That translation should happen near the first mention, not in a disclaimer at the bottom. A reader searching Historical accuracy still matters. The legacy labels were correct under the previous program and remain part of certification history. The practical goal is to translate old terminology into the current path quickly enough that a candidate knows both what an older identifier meant and what preparation target applies now.<\/p>\n The current Secure Networking technical path starts with NSE 4, which requires the proctored FortiOS Administrator exam. NSE4_FGT_AD-7.6<\/a> is the active FortiOS 7.6 administrator target. FortiGate system configuration<\/a> provides the device-level foundation: initial configuration, management, routing, policy, logging, high availability, security inspection, VPNs, and troubleshooting.<\/p>\n NSE 4 is important because higher Secure Networking certifications assume that the candidate understands FortiGate operation rather than learning it for the first time. Routing, policies, NAT, logs, interfaces, security profiles, authentication, VPNs, and system resources become the evidence base for later design decisions. Candidates who skip the operating foundation can often name an architecture pattern but struggle to explain how it behaves when traffic or a device fails.<\/p>\n A useful NSE 4 lab should prove both configuration and diagnosis. Build the path, then break it: wrong route, shadowed firewall policy, failed DNS, IPsec selector mismatch, FortiAnalyzer registration problem, or resource pressure. Record the evidence that distinguishes each failure. That operating discipline is what later allows an NSE 7 architect to make realistic design decisions.<\/p>\n NSE 4 also creates the common prerequisite base for track progression in the new program. That changes the mental model from the old FCP label. Instead of treating FortiGate Administrator as one half of a named FCP bundle, candidates can treat NSE 4 as the base certification and then select the NSE 5\/6 track specialization that matches their role.<\/p>\n Fortinet currently maps FortiSwitch Administrator into NSE 5 in Secure Networking. NSE5_FSW_AD-7.6<\/a> is the current FortiSwitch target. FortiSwitch knowledge expands the path from a firewall-centric view into access switching, FortiLink management, Layer 2\/Layer 3 behavior, supported topologies, MCLAG, redundancy, provisioning, and operational troubleshooting.<\/p>\n The architectural value is the connection between the switch fabric and FortiGate policy\/control. FortiLink creates a management relationship as well as a forwarding topology. MCLAG changes failure domains. VLAN and routing choices influence where security policy is enforced. A Secure Networking candidate should be able to draw the path from an endpoint through FortiSwitch and FortiGate and explain what happens when an access link, switch, FortiLink relationship, or upstream path fails.<\/p>\n NSE 5 is where the new program\u2019s track model becomes concrete. FortiSwitch Administrator is not simply \u201cone more exam after FortiGate\u201d; it is a Secure Networking specialization. A candidate working primarily in security analytics or SASE would choose a different NSE 5 exam in the relevant track. The number alone should not be treated as a universal sequence.<\/p>\n FortiSwitch preparation also benefits from separating generic switching concepts from Fortinet management behavior. VLANs, trunks, spanning tree, aggregation, routing, and convergence are durable networking concepts. FortiLink, FortiGate-managed provisioning, MCLAG implementation, and platform troubleshooting are vendor-specific. Strong candidates know which layer of the problem they are diagnosing.<\/p>\n Fortinet\u2019s July 2026 exam mapping places FortiManager Administrator at NSE 6 in Secure Networking. FortiManager 7.6<\/a> still carries the legacy FortiManager architecture<\/a> provides the conceptual bridge from individual-device operation toward centralized lifecycle management: device registration, ADOMs, policy\/package management, templates, revisions, workflow, scripts, changes, deployment, and governance. Those skills fit NSE 6 because the candidate is managing consistency across a larger estate rather than configuring one firewall.<\/p>\n Centralized management changes the failure model. A bad local change can affect one device; a bad template or policy package can affect many. That makes revision control, preview, workflow, scope, and rollback more important. The certification path therefore moves not only toward \u201cmore features\u201d but toward greater blast radius and greater responsibility.<\/p>\n The current level and track should remain explicit even when older exam identifiers are still encountered. \u201cFortiManager 7.6 Administrator \/ NSE 6 Secure Networking\u201d is clearer than treating the legacy FCP identifier as though the certification program had not changed.<\/p>\n The most important Secure Networking transition is NSE 7. The former Enterprise Firewall 7.6 Administrator exam had its last delivery date on July 15, 2026. NSE7_FSN_AR-7.6<\/a> is therefore historical\/retired context, while active preparation belongs with the current NSE 7 Secure Networking 7.6 Architect<\/a> exam.<\/p>\n The current NSE 7 exam is broader and architecture-oriented. Enterprise FortiGate architecture for NSE 7<\/a> and NSE 7 Secure Networking Architect<\/a> concepts reflects the current direction better than a legacy Enterprise Firewall Administrator study plan. Candidates are expected to reason across requirements, resilient design, routing, security policy, VPNs, centralized operations, and the way Fortinet components support a secure networking solution.<\/p>\n The July 15 cutoff creates a clear status boundary. Material written for the former Enterprise Firewall Administrator exam can remain useful when it teaches routing, FortiGate policy, VPN, HA, inspection, or FortiManager concepts, but it should not be used to imply that the retired exam is still schedulable or that its old blueprint is the current NSE 7 blueprint.<\/p>\n Architecture study should therefore move from \u201chow do I configure this feature?\u201d to \u201cwhat requirement does this design satisfy, what does it depend on, how does it fail, and how will operators observe and recover it?\u201d The operational skills are still necessary, but the responsibility has changed.<\/p>\n Legacy Enterprise Firewall material still has value because many underlying FortiGate skills carry forward. Candidates should treat the old exam as retired, retain the durable technical concepts, and use the current Architect exam when preparing for NSE 7 now.<\/p>\n Secure Networking depth is easier to build when routing and VPN concepts are treated as durable infrastructure skills rather than Fortinet-only vocabulary. BGP<\/a>, OSPF<\/a>, and VPN fundamentals<\/a> establish the neutral baseline; FortiGate then adds platform-specific policy interaction, logging, HA, SD-WAN, ADVPN, inspection, and centralized-management behavior.<\/p>\n This separation is useful for study. If a candidate does not understand BGP path selection, learning the FortiGate command or GUI location will not fix the conceptual gap. If the routing concept is already clear, the candidate can focus on how FortiGate expresses and troubleshoots it. The same is true for IKE\/IPsec and remote-access design. Strong NSE candidates can move between the protocol-level explanation and the Fortinet-specific evidence.<\/p>\n The same separation improves study efficiency. Use a neutral BGP or VPN reference when the conceptual gap is protocol-level, then return to Fortinet-specific implementation and evidence. Relearning every industry protocol as vendor-specific vocabulary makes troubleshooting harder, not easier.<\/p>\n At architecture level, protocol independence becomes even more important. An NSE 7 design must account for adjacent routers, partners, carriers, remote sites, cloud networks, and operational teams that may not be Fortinet-only. Understanding the neutral protocol first helps the architect reason across those boundaries.<\/p>\n The 2026 program retains four technical tracks: Secure Networking, Security Operations, SASE, and Cloud Security. NSE 5 and NSE 6 certifications are track-specific, and NSE 7 requires an active NSE 4 plus an active NSE 5 or NSE 6 certification in the same track before the relevant Architect exam completes that level. Candidates should therefore choose specialization based on the systems they operate, not simply take any higher-numbered exam.<\/p>\n This pathway is intentionally Secure Networking-focused. FortiSwitch and FortiManager fit that track, while other Fortinet products may map to Security Operations, SASE, or Cloud Security depending on the current exam. Candidates should preserve those track distinctions rather than treating every NSE 5 or NSE 6 credential as interchangeable.<\/p>\n Track choice should follow the systems a candidate is responsible for. A network-security engineer managing FortiGate, FortiSwitch, FortiManager, routing, and VPN is naturally aligned to Secure Networking. A SOC engineer working with analytics and response products should not be pushed into Secure Networking merely because its exam numbers are familiar. The new structure is designed to make that specialization visible.<\/p>\n Cross-track knowledge can still be valuable. A Secure Networking engineer may work with FortiAnalyzer, endpoint, SASE, or cloud-security teams. The certification path does not mean those topics are irrelevant; it means the certification requirement and primary exam should reflect the role\u2019s main responsibility.<\/p>\n NSE 8 builds on the current track path, not the old FCX model.<\/strong> Fortinet\u2019s current NSE 8 requirements use the new certification structure: an active NSE 4, an active NSE 5 or NSE 6, an active NSE 7 in the same track, and the required practical core\/elective assessment path. Legacy FCX remains part of certification history, but new expert candidates should plan through the NSE levels and track requirements rather than following an old FCX preparation diagram.<\/p>\n Expert preparation can become stale quickly when prerequisite models change. Current candidates should use NSE 1\u20138 language for forward-looking preparation and treat FCX, FCSS, and FCP as historical transition terminology.<\/p>\n NSE 8 also shows why candidates must verify current prerequisites rather than follow an old exam-link sequence. The path expresses track continuity, practical responsibility, and the relationship between current and legacy terminology; those relationships matter as much as the individual exam names.<\/p>\n Candidates responsible for day-to-day FortiGate administration should make NSE 4 the immediate target. Administrators expanding into the access layer can build toward NSE 5 Secure Networking through FortiSwitch. Engineers centralizing multi-device policy and lifecycle management can move toward NSE 6 through FortiManager or another current Secure Networking option. Architects responsible for enterprise network-security design should build the NSE 4 plus track-specialist foundation required for NSE 7 Secure Networking Architect.<\/p>\n A practical lab can mirror that progression. Start with one FortiGate and prove routing, policy, NAT, logging, HA, inspection, and VPN behavior. Add FortiSwitch and test access\/topology failure. Add FortiManager and move configuration from device-by-device changes to controlled centralized workflows. Then design an enterprise scenario with requirements, failure domains, routing policy, VPN, management, logging, and recovery. The path becomes coherent because each level adds a new scope of responsibility.<\/p>\n At each stage, add a failure that matches the new responsibility. At NSE 4, break a route or policy. At NSE 5, break a FortiLink or MCLAG dependency. At NSE 6, introduce a central-management scope or deployment mistake. At NSE 7, change a requirement or failure-domain assumption and redesign the solution. That progression is more meaningful than repeating unrelated labs for each exam.<\/p>\n Keep notes in two columns: durable networking\/security concept and Fortinet-specific implementation. \u201cBGP path policy\u201d belongs in the first; \u201cwhich FortiGate diagnostic or FortiManager workflow exposes it\u201d belongs in the second. This makes future exam-version updates easier because the durable concept survives even if platform screens or exam identifiers change.<\/p>\n Treat three things independently: the historical exam identifier, the current Fortinet certification label, and whether the exam is currently available. An older identifier can still point to useful historical material, while a retired exam can remain relevant for candidates interpreting previous study plans or certification records. Current status must therefore be stated explicitly rather than inferred from an old name.<\/p>\n At present, FortiOS\/FortiGate 7.6 administration is current at NSE 4; FortiSwitch 7.6 sits in NSE 5 Secure Networking; FortiManager 7.6 maps to NSE 6 Secure Networking despite the older FCP identifier; the former Enterprise Firewall 7.6 Administrator exam is retired; and current NSE 7 Secure Networking preparation belongs on the Architect path. Keeping those distinctions visible prevents historical terminology from being mistaken for the active program.<\/p>\n When future Fortinet releases replace 7.6 exams, the same distinction will still be useful. Preserve older names as historical context where needed, but verify the active exam and certification level before preparing. The two questions should remain separate: \u201cWhat did this older identifier mean?\u201d and \u201cWhat should I prepare for now?\u201d<\/p>\n","protected":false},"excerpt":{"rendered":" Fortinet\u2019s certification structure changed materially on July 15, 2026. The older FCF, FCA, FCP, FCSS, and FCX certification labels were retired as current program levels and replaced by an expanded NSE 1\u20138 model with four primary technical tracks: Secure Networking, Security Operations, SASE, and Cloud Security. Older exam identifiers still appear in historical materials and search results, so candidates need to distinguish the legacy name from the certification level that applies now. Fortinet certifications now use the NSE 1\u20138 structure introduced in 2026. Within Secure Networking, FortiGate\/FortiOS administration, FortiSwitch, FortiManager,…<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[679],"tags":[],"class_list":["post-24351","post","type-post","status-publish","format-standard","hentry","category-fortinet"],"aioseo_notices":[],"aioseo_head":"\n\t\t\n\t\n\t\n\t\n\t\n\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\t\n\t\tThe 2026 program replaced five certification labels with NSE 1\u20138<\/h2>\n
Translate legacy FCP, FCSS, and FCX credentials into current NSE levels<\/h2>\n
FCP<\/code>, for example, does not mean FCP is still the current certification name; it has to be interpreted through the July 2026 mapping.<\/p>\nFCP_FMG_AD-7.6<\/code> should immediately understand that the FortiManager 7.6 skill set now sits in NSE 6 Secure Networking. A reader searching the retired Enterprise Firewall identifier should immediately see that current NSE 7 preparation has moved to the comprehensive Secure Networking Architect exam.<\/p>\nNSE 4 is the FortiOS administration foundation<\/h2>\n
NSE 5 Secure Networking adds product-specialist depth<\/h2>\n
NSE 6 Secure Networking includes FortiManager administration<\/h2>\n
FCP_FMG_AD-7.6<\/code> identifier because it predates the program transition, but current candidates should understand it in its NSE 6 Secure Networking position.<\/p>\nNSE 7 Secure Networking is now an architecture certification<\/h2>\n
Routing and VPN knowledge connects the levels<\/h2>\n
The four tracks matter once candidates move above NSE 4<\/h2>\n
Choose a path by operational responsibility<\/h2>\n
Separate legacy identifiers from current exam status<\/h2>\n