IPsec VPN Issues NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 1)

Questions 1–5

1. 1application · medium

   A site-to-site IPsec tunnel drops every 8 hours exactly. The administrator suspects a rekeying issue. What should they check first?

   • AReview the firewall policies for the tunnel traffic.
   • BVerify the NAT traversal settings on both sides.
   • CCheck the MTU settings on the tunnel interfaces.
   • DCompare the phase 1 and phase 2 key lifetimes on both FortiGates.
   Reveal Solution Discussion Select an answer first
2. 2foundation · easy

   During IPsec phase 1 negotiation, the FortiGate sends a proposal that includes encryption, authentication, and Diffie-Hellman group. The remote peer rejects the proposal. What is the most likely cause of this rejection?

   • AThe tunnel interface is administratively down, preventing the negotiation from starting.
   • BThe pre-shared key is correct, but the local and remote identifiers are swapped.
   • CThe phase 2 proposal does not match the remote peer's phase 2 proposal.
   • DThe encryption algorithm, authentication algorithm, or Diffie-Hellman group does not match the remote peer's configuration.
   Reveal Solution Discussion Select an answer first
4. 3foundation · easy

   An IPsec tunnel is established, but traffic from the local network is not reaching the remote network. The firewall policy is correct. Which of the following is the most likely cause?

   • AThe phase 2 selectors do not include the local and remote subnets.
   • BThe pre-shared key is incorrect.
   • CThe encryption algorithm is AES-256, which is too strong for the remote peer.
   • DThe dead peer detection interval is set too high.
   Reveal Solution Discussion Select an answer first
5. 4foundation · easy

   An IPsec tunnel drops every 8 hours and then re-establishes. What is the most likely cause?

   • AThe phase 2 lifetime is set to 28800 seconds (8 hours) and the remote peer has a different lifetime.
   • BThe pre-shared key expires every 8 hours.
   • CThe phase 1 lifetime is set to 28800 seconds (8 hours) and the remote peer has a shorter lifetime.
   • DThe tunnel is configured with DPD in on-demand mode, which tears down idle tunnels.
   Reveal Solution Discussion Select an answer first
6. 5application · medium

   A FortiGate administrator is troubleshooting an IPsec tunnel that intermittently drops. They need to see detailed IKE negotiation messages and phase 2 rekey attempts. Which command or tool should they use?

   • AReview the system event log for tunnel up/down events.
   • BUse 'get vpn ipsec tunnel summary' to view the current tunnel status.
   • CCheck the 'IPsec Monitor' in the GUI for phase 1 and phase 2 statistics.
   • DRun 'diagnose vpn ike log filter' and then 'diagnose vpn ike log' to capture real-time IKE events.
   Reveal Solution Discussion Select an answer first