A company is deploying an IKEv2 VPN between a FortiGate and a third-party firewall. The third-party firewall supports only IKEv2 with pre-shared key authentication and requires the use of DH group 14. The FortiGate is configured with a pre-shared key and DH group 2. The tunnel fails to establish, and the debug log shows 'IKE_SA_INIT: no proposal chosen'. What is the most likely cause of this failure?

The pre-shared key is different on the two peers.

The DH group mismatch between the two peers.

The IKE SA lifetime is different on the two peers.

The Phase 2 proposal is not matching.

During IKEv2 negotiation, what is the purpose of the nonces exchanged in the IKE_SA_INIT exchange?

To determine the lifetime of the IKE SA

To generate fresh keying material and prevent replay attacks

To authenticate the identity of the remote peer

To select the encryption algorithm for the IPsec SA

In IKEv2 Phase 2 configuration on a FortiGate, what is the purpose of a traffic selector?

To determine the authentication method for the VPN peers

To define which source and destination IP addresses and ports are protected by the IPsec tunnel

To specify the Diffie-Hellman group for the IPsec SA

To select the encryption algorithm for the IKE SA

FortinetNSE 7 - Enterprise Firewall Administrator

Domain 5Objective 1

Implement IPsec VPN IKE Version 2 NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 2)

Part of the VPN domain, which makes up ~7% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~2–3 in this domain), expect 1–2 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

5concepts

Questions 6–10

6expert · hard
A company is deploying an IKEv2 VPN between a FortiGate and a third-party firewall. The third-party firewall supports only IKEv2 with pre-shared key authentication and requires the use of DH group 14. The FortiGate is configured with a pre-shared key and DH group 2. The tunnel fails to establish, and the debug log shows 'IKE_SA_INIT: no proposal chosen'. What is the most likely cause of this failure?
Select an answer first
7foundation · easy
During IKEv2 negotiation, what is the purpose of the nonces exchanged in the IKE_SA_INIT exchange?
Select an answer first
8foundation · easy
To troubleshoot an IKEv2 negotiation failure on a FortiGate, which command would you use to view real-time IKE debug messages?
Select an answer first
9foundation · easy
Which IKEv2 Phase 2 parameter controls how often the IPsec SA keys are renegotiated?
Select an answer first
10foundation · easy
In IKEv2 Phase 2 configuration on a FortiGate, what is the purpose of a traffic selector?
Select an answer first

Finished these 5 questions?

Review the revealed explanations, or continue through the curriculum.

Next 5 questions →Back to NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Implement IPsec VPN IKE Version 2 NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 2)

Questions 6–10

During IKEv2 negotiation, what is the purpose of the nonces exchanged in the IKE_SA_INIT exchange?

To troubleshoot an IKEv2 negotiation failure on a FortiGate, which command would you use to view real-time IKE debug messages?

Which IKEv2 Phase 2 parameter controls how often the IPsec SA keys are renegotiated?

In IKEv2 Phase 2 configuration on a FortiGate, what is the purpose of a traffic selector?

Keep studying — VPN