An IPsec tunnel is up, but traffic from a local host to a remote subnet is not being encrypted and sent through the tunnel. Which configuration is most likely missing?

A phase 1 proposal that includes the remote subnet in its selector.

A NAT policy that translates the source address to the tunnel interface IP.

A static route that points the remote subnet to the tunnel interface.

A firewall policy that matches the traffic and uses the tunnel as the destination interface.

An IPsec tunnel is up, but traffic from a specific subnet at the branch office is not reaching the head office. The firewall policy allows all traffic from the branch LAN to the head office subnet. The static route points the head office subnet to the tunnel. What should the administrator check?

Check the DPD settings on the tunnel.

Increase the phase 1 key lifetime to keep the tunnel up longer.

Verify that the phase 2 selector includes the specific branch subnet and the head office subnet.

Enable NAT traversal on the tunnel.

Which FortiOS CLI command is used to configure Dead Peer Detection (DPD) settings on an IPsec tunnel?

config vpn ipsec phase2-interface

config vpn ipsec phase1-interface

An IPsec tunnel drops every 24 hours. The phase 1 lifetime is set to 28800 seconds (8 hours) on the local FortiGate, and the remote gateway is a third-party device. The administrator suspects a rekey failure. What is the most likely cause?

The NAT traversal settings are misconfigured, causing the tunnel to fail after a certain time.

The DPD settings are too aggressive, causing the tunnel to be torn down.

The remote gateway has a phase 1 lifetime that is not synchronized with the local FortiGate, causing rekey attempts to fail.

The phase 2 lifetime is set to 3600 seconds, causing frequent rekeys.

Which FortiOS command provides real-time logging of IKE negotiation events, useful for troubleshooting IPsec tunnel establishment?

diagnose sniffer packet any 'host ' 4

diagnose debug application ike -1

FortinetNSE 4 - FortiOS 7.6 Administrator

Domain 5Objective 5

IPsec VPN Issues NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 2)

Part of the VPNs domain, which accounts for 10-15% of the NSE4-FORTIOS-ADMINISTRATOR exam. Fortinet does not publish an official question count, but from its 90-minute exam (~35–60 total, ~4–9 in this domain), expect 1–2 from this objective — we provide 30 practice questions to prepare you well beyond it. (estimate)

30questions here

6free pages

9concepts

10-15%of the exam

Questions 6–10

6foundation · easy
An IPsec tunnel is up, but traffic from a local host to a remote subnet is not being encrypted and sent through the tunnel. Which configuration is most likely missing?
Select an answer first
7expert · medium
An IPsec tunnel is up, but traffic from a specific subnet at the branch office is not reaching the head office. The firewall policy allows all traffic from the branch LAN to the head office subnet. The static route points the head office subnet to the tunnel. What should the administrator check?
Select an answer first
8foundation · easy
Which FortiOS CLI command is used to configure Dead Peer Detection (DPD) settings on an IPsec tunnel?
Select an answer first
9expert · medium
An IPsec tunnel drops every 24 hours. The phase 1 lifetime is set to 28800 seconds (8 hours) on the local FortiGate, and the remote gateway is a third-party device. The administrator suspects a rekey failure. What is the most likely cause?
Select an answer first
10foundation · easy
Which FortiOS command provides real-time logging of IKE negotiation events, useful for troubleshooting IPsec tunnel establishment?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE4-FORTIOS-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE4-FORTIOS-ADMINISTRATOR” is a trademark of its owner, used for identification only.