IPsec VPN Issues NSE4-FORTIOS-ADMINISTRATOR Practice Questions (Page 6)

Questions 26–30

1. 26expert · medium

   An IPsec tunnel between two FortiGates has high throughput, but the CPU usage on one FortiGate is consistently high during traffic. The administrator suspects that hardware acceleration is not being used. What should they do to confirm?

   • AIncrease the phase 2 key lifetime to reduce rekey overhead.
   • BDisable NAT traversal to reduce encapsulation overhead.
   • CChange the encryption algorithm to a weaker one to reduce CPU load.
   • DUse the command 'diagnose npu np6 ipsec' or similar to check if the IPsec SA is offloaded to the NPU.
   Reveal Solution Discussion Select an answer first
2. 27application · medium

   Users report that large file transfers over an IPsec tunnel are slow and some connections time out, while small transfers work fine. The administrator suspects an MTU issue. What should they do?

   • AReduce the MTU on the tunnel interface to a value that accommodates IPsec overhead, such as 1400 bytes.
   • BEnable NAT traversal on the tunnel.
   • CDisable TCP window scaling on the clients.
   • DIncrease the MTU on the physical interface to 1500 bytes.
   Reveal Solution Discussion Select an answer first
4. 28application · medium

   A remote site's IPsec VPN tunnel to the head office fails to establish. The administrator checks the phase 1 logs and sees 'negotiation failure' with no specific error. Both sides use the same pre-shared key, IKE version, and encryption algorithms. What should the administrator check next?

   • AVerify that the remote gateway's peer ID matches the local peer ID configured on the FortiGate.
   • BIncrease the phase 1 key lifetime to a higher value to allow more time for negotiation.
   • CChange the phase 2 proposal to use a different encryption algorithm.
   • DDisable NAT traversal on both sides to simplify the negotiation process.
   Reveal Solution Discussion Select an answer first
5. 29expert · medium

   A site-to-site IPsec tunnel works when the remote site is directly connected, but fails when the remote site is behind a NAT device. The administrator has enabled NAT-T on both FortiGates, but the tunnel still fails. What should they check next?

   • ASet the phase 2 encapsulation to transport mode.
   • BDisable DPD to reduce keepalive traffic.
   • CChange the phase 1 encryption to AES-256 to improve security.
   • DVerify that the NAT device is not blocking UDP port 4500, which is used by NAT-T.
   Reveal Solution Discussion Select an answer first
6. 30application · medium

   An IPsec tunnel using certificate authentication fails to establish. The FortiGate logs show 'certificate verification failed'. Both certificates are issued by the same CA and are valid. What should the administrator check?

   • AEnsure that the phase 2 proposal matches on both sides.
   • BCheck that the pre-shared key is the same on both sides.
   • CVerify that the CA certificate is installed in the FortiGate's certificate store and that the peer certificate is not revoked.
   • DConfirm that the tunnel interface has a valid IP address.
   Reveal Solution Discussion Select an answer first