A network engineer is configuring a site-to-site IPsec VPN between two FortiGates using IKEv2. The remote FortiGate is behind a NAT device that does not support IPsec NAT-T. During testing, the IKE_SA_INIT exchange fails. The engineer checks the IKE debug logs and sees that the responder is not sending any response to the initiator's initial packet. Which action should the engineer take to resolve this issue?

Configure the remote gateway IP address to the public IP of the NAT device and enable 'set nat-traversal enable' on the interface.

Enable NAT traversal on both FortiGates and set the local ID to the public IP address.

Configure a static NAT rule on the NAT device to forward UDP port 500 and 4500 to the remote FortiGate, and ensure the remote FortiGate is configured to accept IKE on those ports.

Use IKEv1 instead of IKEv2, as IKEv1 has better NAT traversal support.

An administrator is troubleshooting an IKEv2 VPN that fails to establish. The administrator runs 'diagnose vpn ike log' and sees the following message: 'IKE_AUTH: authentication failed'. The Phase 1 configuration uses pre-shared keys. What is the most likely cause of this failure?

The pre-shared key is different on the two FortiGates.

The Phase 2 proposal is not matching.

The IKE SA encryption algorithm is not supported by the remote peer.

The remote FortiGate is not configured with the correct local ID.

FortinetNSE 7 - Enterprise Firewall Administrator

Domain 5Objective 1

Implement IPsec VPN IKE Version 2 NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 3)

Part of the VPN domain, which makes up ~7% of our current practice bank. Fortinet does not publish an official question count, but from its 70-minute exam (~30–45 total, ~2–3 in this domain), expect 1–2 from this objective — we provide 13 practice questions to prepare you well beyond it. (estimate)

13questions here

3free pages

5concepts

Questions 11–13

11foundation · easy
In an IKEv2 negotiation, which role does the device that sends the first IKE_SA_INIT message assume?
Select an answer first
12application · medium
A network engineer is configuring a site-to-site IPsec VPN between two FortiGates using IKEv2. The remote FortiGate is behind a NAT device that does not support IPsec NAT-T. During testing, the IKE_SA_INIT exchange fails. The engineer checks the IKE debug logs and sees that the responder is not sending any response to the initiator's initial packet. Which action should the engineer take to resolve this issue?
Select an answer first
13application · medium
An administrator is troubleshooting an IKEv2 VPN that fails to establish. The administrator runs 'diagnose vpn ike log' and sees the following message: 'IKE_AUTH: authentication failed'. The Phase 1 configuration uses pre-shared keys. What is the most likely cause of this failure?
Select an answer first

Finished these 3 questions?

Review the revealed explanations, or continue through the curriculum.

No more pagesBack to NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR

Free Basic Practice is a study aid with revealable answers — not a scored exam. Examers.io is independent and not affiliated with or endorsed by Fortinet. “NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR” is a trademark of its owner, used for identification only.

Implement IPsec VPN IKE Version 2 NSE7-ENTERPRISE-FIREWALL-ADMINISTRATOR Practice Questions (Page 3)

Questions 11–13

In an IKEv2 negotiation, which role does the device that sends the first IKE_SA_INIT message assume?

An administrator is troubleshooting an IKEv2 VPN that fails to establish. The administrator runs 'diagnose vpn ike log' and sees the following message: 'IKE_AUTH: authentication failed'. The Phase 1 configuration uses pre-shared keys. What is the most likely cause of this failure?

Keep studying — VPN