NSE7_SDW Security Profiles Routing And IPsec — 25 Questions

Question 1

An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Local Preference. Local Preference is the best BGP attribute to manipulate via a route-map applied to the BGP neighbor in FortiOS to ensure consistent primary path selection. Local Preference is used within an autonomous system to indicate the preferred exit point for outbound traffic. By setting a higher local preference on routes learned from the primary SD-WAN member, BGP will prefer that path. This attribute is propagated only within the local AS, making it ideal for influencing outbound path selection without affecting external peers.

Answer

AS-PATH prepend

Answer

Cluster ID

Answer

Origin code

Question 2

A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?

Accepted Answer

Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly. The most likely root cause is that Path MTU Discovery (PMTD) is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not correctly adjusting the encapsulated IPsec packet size. When traffic is steered to a backup IPsec tunnel with a smaller MTU, large UDP packets may exceed the tunnel MTU and be dropped if PMTUD cannot signal the need for fragmentation. The mitigation is to ensure ICMP unreachable messages are allowed and to configure TCP MSS clamping appropriately, though for UDP, adjusting the MTU or enabling fragmentation before encryption may be necessary.

Answer

SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth

Answer

The Antivirus proxy buffer is overflowing due to UDP streaming packets

Answer

The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops

Question 3

An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?

Accepted Answer

Disable next-hop-self on the hub's BGP neighbor configuration or adjust OSPF interface settings so the advertising router is not forced as the next hop. For ADVPN shortcuts to form, the spoke must be able to resolve the next-hop of the remote spoke's subnet to the remote spoke's public IP rather than to the hub. If the hub advertises routes with next-hop-self (BGP) or forces itself as the OSPF advertising router, spokes will always route through the hub and never trigger a shortcut. Disabling next-hop-self or adjusting OSPF so the original advertising router is preserved allows the spoke to see the true next hop and initiate an IKE shortcut.

Answer

Enable split-horizon globally within the OSPF routing process

Answer

Enable exchange-interface in the hub's OSPF interface configuration

Answer

Configure a static blackhole route for all spoke subnets on the hub

Question 4

An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?

Accepted Answer

Create a custom application signature override in the Application Control profile to correctly identify the traffic by port, IP, or pattern. Creating a custom application signature override in the Application Control profile lets the administrator correct the misclassification by defining the traffic via port, IP, or pattern, so SD-WAN can reliably steer it using the corrected application signature. This preserves security inspection while eliminating false positives, which is the recommended Fortinet procedure for custom business apps.

Answer

Disable all security profiles on the SD-WAN interface zone

Answer

Configure static routes for the application servers and bypass SD-WAN rules completely

Answer

Switch the inspection mode from flow-based to proxy-based for all firewall policies

Question 5

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Accepted Answer

The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links. When 'Lowest Cost (SLA)' strategy is selected, FortiOS uses the configured priority and weight, or the specific metric defined in the SLA parameters (such as lowest latency, jitter, or packet loss among those meeting the threshold). If multiple links meet the SLA thresholds, it selects based on priority and weight, or lowest cost based on the metric specified. Wait, Lowest Cost uses the cost assigned to the SD-WAN members or interface weights. Let's look at the options.

Answer

The round-robin algorithm applied sequentially across all active links

Answer

The lowest physical port number on the FortiGate hardware

Answer

The highest interface bandwidth capacity defined in the static route table

Question 6

An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?

Accepted Answer

set net-device enable. To support ADVPN 2.0 shortcuts, the Phase 1 configuration must have 'set net-device enable' and 'set advpn enable' (or equivalent shortcut settings depending on FortiOS version, such as 'set tunnel-search' or 'set shortcut-forwarding'). In modern FortiOS, 'set net-device enable' is required so each dynamic shortcut creates a virtual network interface.

Answer

set mode aggressive

Answer

set dhcp-interception enable

Answer

set pfs-group modp1024

Question 7

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Accepted Answer

Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown. During shortcut teardown, routing loops or blackholes can occur if the hub and spoke have conflicting routes with the same or better administrative distance. Adjusting administrative distance or using route redistribution filters with appropriate metrics ensures that hub routes and shortcut routes do not conflict during the transition, allowing OSPF to converge cleanly.

Answer

Disable OSPF on the spoke units and rely entirely on static default routes

Answer

Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out

Answer

Configure asymmetric routing bypass on all firewall policies

Question 8

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

Accepted Answer

The firewall policy permitting traffic from the Guest Wi-Fi interface to the internal VPN interface lacks proper security profile enforcement or is missing a deny rule blocking inter-zone access. The issue is that the firewall policy allowing traffic from the Guest Wi-Fi interface to the internal VPN interface is either missing a deny rule to block inter-zone access or lacks proper security profile enforcement. This allows guest users to access internal subnets despite the SD-WAN rule routing internet traffic out of the secondary connection.

Answer

The SD-WAN health check probe is not monitoring the corporate subnet gateway

Answer

The IPsec Phase 2 security association selectors include the guest subnet range

Answer

The SD-WAN rule priority for the internal VPN interface is set higher than the broadband interface

Question 9

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. BGP Route Reflection is the standard solution for iBGP full-mesh scalability. In an ADVPN, spokes establish iBGP sessions with the hub, and without route reflection, the hub would not re-advertise routes learned from one spoke to another because of iBGP split-horizon rules. Configuring the hub as a route reflector with spokes as clients allows the hub to reflect routes between spokes, enabling them to learn each other's subnets via BGP. This ensures that before an ADVPN shortcut is established, spokes have the necessary routes to initiate shortcut negotiation, and after the shortcut is up, BGP can still be used to exchange routes directly or via the hub as needed.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 10

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

Accepted Answer

Check 'diagnose vpn tunnel list' to verify if dynamic shortcut child security associations are being created. Option A is correct because 'diagnose vpn tunnel list' shows the IPsec tunnel and child SA state on the FortiGate, allowing the administrator to confirm whether the dynamic shortcut child security associations between spokes are actually being negotiated and created. Option C is correct because enabling IKE real-time debugging with 'diagnose vpn ike log-filter' lets the administrator inspect the IKE negotiation messages (proposals, nonces, traffic selectors, and any error notifications) exchanged between the hub and spokes, which is essential to pinpoint where shortcut establishment fails. Option E is correct because 'get router info routing-table database' reveals whether the dynamic shortcut routes are being injected into the routing table when traffic matches the ADVPN phase 1 interface, confirming that route propagation for the shortcut is working. Option B is not appropriate because SD-WAN rule hit counts are unrelated to ADVPN shortcut tunnel negotiation and would not isolate an IKE or routing failure. Option D is not appropriate because formatting the internal flash is a destructive action that would erase configuration and logs, and it is not a valid troubleshooting step for ADVPN certificate or shortcut issues.

Answer

Check the firewall policy statistics to ensure SD-WAN rules have zero hit counts globally

Answer

Execute 'execute format disk' to reset the internal flash storage and clear corrupted ADVPN certificates

Question 11

An enterprise deploys ADVPN 2.0 with BGP and security profiles applied to traffic traversing the VPN overlay. Which THREE statements are correct regarding how security profiles and ADVPN 2.0 interact in FortiOS? (Choose three)

Accepted Answer

SSL inspection (DPI) applied on spoke firewall policies inspects decrypted traffic traversing the ADVPN shortcut tunnel. Option C is correct because in an ADVPN 2.0 topology, once a shortcut tunnel is negotiated between spokes, data traffic flows directly spoke-to-spoke and no longer traverses the hub, so the spoke firewalls must apply the security profiles (Antivirus, IPS, etc.) on the policies governing that overlay traffic. Option A is correct because SSL inspection (deep packet inspection) configured on the spoke's firewall policy decrypts and inspects the traffic inside the ADVPN shortcut tunnel, since the spoke is the enforcement point for that direct path. Option B is correct because FortiManager security profile templates (and policy packages) allow centralized creation and push of security profiles to managed spoke FortiGates, which is a standard way to keep consistent UTM enforcement across many spokes. Option D is wrong because ADVPN 2.0 does not automatically disable inspection profiles on shortcut interfaces; profile enforcement is determined by the firewall policy, not by the shortcut itself. Option E is wrong because after the shortcut is established, inter-spoke data packets bypass the hub entirely, so the hub cannot inspect them.

Answer

ADVPN 2.0 automatically disables all firewall inspection profiles on shortcut interfaces to maximize throughput

Answer

The hub FortiGate inspects all data packets exchanged between spokes even after a direct shortcut tunnel is established

Question 12

An administrator is configuring SD-WAN rules with performance SLAs. Which TWO strategies are available in FortiOS when configuring an SD-WAN rule based on SLA metrics? (Choose two)

Accepted Answer

Lowest Cost (SLA). Option A, Lowest Cost (SLA), is correct because FortiOS SD-WAN rules support a strategy that selects the member with the lowest cost among those that meet the configured SLA targets (latency, jitter, packet loss), allowing cost-based preference while still honoring performance thresholds. Option B, Priority, is correct because the SD-WAN rule strategy can be set to Priority, where members are ordered by priority and the highest-priority member that satisfies the SLA is chosen, falling back to lower-priority members when SLA is violated. The other options are not SD-WAN rule SLA-based strategies: Round-Robin DNS Load Balancing is a DNS-based distribution method, Dynamic BGP AS-Prepending is a routing policy technique for influencing path selection, and Static Flow-Hashing is a load-balancing/hashing method, none of which are FortiOS SD-WAN rule strategies based on SLA metrics.

Answer

Round-Robin DNS Load Balancing

Answer

Dynamic BGP AS-Prepending

Answer

Static Flow-Hashing

Question 13

An administrator is deploying ADVPN 2.0 with IPsec tunnels between a hub and multiple spokes. The administrator wants to enable shortcut tunnels between spokes automatically when traffic between them exceeds a threshold. Which SD-WAN configuration element is required to trigger the creation of these on-demand shortcut tunnels?

Accepted Answer

The 'set auto-discovery-sender' and 'set auto-discovery-shortcut' commands on the hub.. In ADVPN 2.0, the hub must be configured with 'auto-discovery-sender' to send shortcut offers and 'auto-discovery-shortcut' to allow the hub to initiate shortcut tunnels. When the hub receives traffic from one spoke destined to another, it sends a shortcut offer to both spokes, which then establish a direct tunnel. This offloads traffic from the hub and reduces latency.

Answer

A BGP route-map that matches the spoke-to-spoke prefixes and sets the next-hop to the hub.

Answer

The 'set auto-discovery-receiver' command under the IPsec phase1-interface.

Answer

An SD-WAN rule with the 'SLA' strategy and a health check monitoring the overlay.

Question 14

An administrator is configuring an SD-WAN rule to steer traffic based on application control. The rule must prioritize Microsoft Teams traffic over other business applications. Which two configuration elements are required in the SD-WAN rule to achieve this? (Choose two.)

Accepted Answer

Enable 'application-control' and select the Microsoft Teams application.. To prioritize Microsoft Teams traffic using an SD-WAN rule, the rule must identify the application via application control and be placed with a higher priority than other rules. The application control setting enables the FortiGate to recognize Teams traffic, and the priority order ensures that this rule is evaluated first, so Teams traffic is steered according to the rule's path selection criteria.

Answer

Set the 'input-device' to the internal interface.

Answer

Set the 'tos' field to match the DSCP value of Microsoft Teams traffic.

Answer

Configure an SLA health check and set the strategy to 'lowest-cost (SLA)'.

Question 15

A FortiGate is configured with an SD-WAN zone named "virtual-wan-link" containing two IPsec tunnels to remote branches. The administrator needs to ensure that if both tunnels fail health checks, the FortiGate automatically disables the SD-WAN zone in the routing table so that a backup static route via a different interface can take over. Which configuration step accomplishes this?

Accepted Answer

Enable "update-static-route" under the SD-WAN zone settings.. Enabling update-static-route on the SD-WAN zone allows FortiOS to dynamically remove the zone from the routing table when all members fail health checks. This makes a backup static route active, ensuring continuous connectivity. The other options either affect only individual members or lack dynamic health-based triggering.

Answer

Configure a link health monitor for each tunnel and set the action to "disable" on failure.

Answer

Create a policy route that redirects traffic to the backup interface when the SD-WAN zone is down.

Answer

Set the SD-WAN zone's administrative distance to a higher value than the backup route.

Question 16

An administrator is deploying an IPsec VPN tunnel between two FortiGates that will be members of an SD-WAN zone. The administrator wants the tunnel interface to be automatically assigned to the correct SD-WAN zone based on the tunnel's configuration, without manually adding it to the zone. Which configuration step is required to achieve this?

Accepted Answer

In the IPsec tunnel configuration, set the 'zone' parameter to the desired SD-WAN zone name.. In FortiOS, the IPsec tunnel configuration includes an optional 'zone' parameter that directly assigns the tunnel interface to an SD-WAN zone upon creation. This is the only method that automatically places the tunnel into the zone without manual intervention. Other options either refer to unrelated features or misrepresent CLI syntax.

Answer

Create a firewall address object for the tunnel and add it to an SD-WAN zone via a policy route.

Answer

Set the 'interface' parameter in the SD-WAN zone configuration to reference the tunnel.

Answer

Enable 'auto-discovery' in the IPsec Phase 1 settings.

Question 17

A FortiGate hub is configured with an IPsec VPN tunnel to a branch office. The branch FortiGate is behind a broadband router performing NAT, and the tunnel frequently drops after a period of inactivity. The administrator wants the tunnel to remain established even when no interesting traffic is present. Which configuration parameter should be enabled on the hub's Phase 1 configuration?

Accepted Answer

Enable 'keepalive' on the Phase 2 configuration.. The correct answer is to enable keepalive on the Phase 2 configuration. In IPsec VPNs, especially when NAT traversal is involved, the tunnel can be torn down if no traffic is sent for a period. Keepalive packets sent at regular intervals keep the tunnel and the NAT session active. This ensures the tunnel remains established and ready for traffic.

Answer

Enable 'dpd' (Dead Peer Detection) on the Phase 1 configuration.

Answer

Enable 'auto-negotiate' on the Phase 1 configuration.

Answer

Set the Phase 1 'nattraversal' to 'forced'.

Question 18

A network administrator is deploying ADVPN 2.0 between a hub and multiple spokes. The administrator wants to ensure that when a spoke-to-spoke shortcut tunnel is established, the routing protocol automatically installs the shortcut route without manual intervention. Which routing protocol feature must be enabled on the hub and spokes to support this dynamic shortcut route installation?

Accepted Answer

Enable BGP route exchange and ensure that the hub reflects the spoke routes to other spokes using BGP route reflection or full mesh.. ADVPN 2.0 uses BGP to exchange routes between hub and spokes. When a shortcut tunnel is established, the spoke advertises its local routes over the shortcut using BGP. For other spokes to learn these routes, the hub must either reflect them (using BGP route reflection) or the spokes must have direct BGP sessions with each other (full mesh). This ensures that the shortcut route is installed dynamically without manual configuration.

Answer

Use RIP with split horizon disabled on all ADVPN interfaces.

Answer

Enable OSPF with point-to-multipoint network type on all ADVPN interfaces.

Answer

Configure BGP with the 'advertise-shortcut' option under the neighbor configuration.

Question 19

A network administrator has deployed an IPsec VPN tunnel between two FortiGate devices. The administrator wants to ensure that the tunnel only carries traffic from specific subnets, and that any other traffic is dropped. Which IPsec Phase 2 configuration parameter should be configured to achieve this?

Accepted Answer

Configure the Phase 2 'src-subnet' and 'dst-subnet' to the desired subnets.. The correct approach is to configure the Phase 2 'src-subnet' and 'dst-subnet' parameters to define the traffic selectors for the IPsec tunnel. These selectors determine which traffic is encrypted and sent through the tunnel. However, to drop non-matching traffic, firewall policies must be configured to deny it. The other options do not achieve the desired filtering because they either do not exist or serve a different purpose.

Answer

Enable 'inbound' and 'outbound' filters in Phase 2.

Answer

Set the Phase 2 'src-name' and 'dst-name' to the desired subnets.

Answer

Set the Phase 2 'keylifeseconds' to a low value to force rekeying and drop non-matching traffic.

Question 20

An administrator has deployed an SD-WAN solution with two IPsec overlays (Overlay_A and Overlay_B) and one underlay MPLS circuit. A new SD-WAN rule is configured to route Microsoft 365 traffic exclusively over Overlay_A, while all other business traffic uses the underlay. Users report that Microsoft 365 is intermittently failing over to the underlay. Which FortiOS configuration element must the administrator verify to ensure that only the IPsec overlay is eligible for the Microsoft 365 rule?

Accepted Answer

The SD-WAN rule's 'Interface' member list must include only Overlay_A.. To force Microsoft 365 traffic exclusively over an IPsec overlay, the rule's member list must be restricted. The 'Interface' parameter defines the eligible SD-WAN members for that rule. Including only the desired overlay ensures that the underlay and other overlays are never considered, preventing unintended failover and maintaining consistent security and performance.

Answer

The SD-WAN rule's 'Gateway' must be set to the remote gateway IP of Overlay_A.

Answer

The SD-WAN rule's 'Priority' member list must include only Overlay_A.

Answer

The SD-WAN rule's 'Source' must be set to the local subnet that uses Microsoft 365.