NSE7_SDW Security Profiles Routing And IPsec — 25 Questions

Question 1

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Accepted Answer

The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links. When 'Lowest Cost (SLA)' strategy is selected, FortiOS uses the configured priority and weight, or the specific metric defined in the SLA parameters (such as lowest latency, jitter, or packet loss among those meeting the threshold). If multiple links meet the SLA thresholds, it selects based on priority and weight, or lowest cost based on the metric specified. Wait, Lowest Cost uses the cost assigned to the SD-WAN members or interface weights. Let's look at the options.

Answer

The round-robin algorithm applied sequentially across all active links

Answer

The lowest physical port number on the FortiGate hardware

Answer

The highest interface bandwidth capacity defined in the static route table

Question 2

An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?

Accepted Answer

set net-device enable. To support ADVPN 2.0 shortcuts, the Phase 1 configuration must have 'set net-device enable' and 'set advpn enable' (or equivalent shortcut settings depending on FortiOS version, such as 'set tunnel-search' or 'set shortcut-forwarding'). In modern FortiOS, 'set net-device enable' is required so each dynamic shortcut creates a virtual network interface.

Answer

set mode aggressive

Answer

set dhcp-interception enable

Answer

set pfs-group modp1024

Question 3

An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?

Accepted Answer

Local Preference. MED (Multi-Exit Discriminator) or Local Preference can influence inbound/outbound path selection. Local Preference is used to influence outbound routing decisions within an AS, while MED influences inbound traffic from external peers. For internal path selection across SD-WAN tunnels terminating on the same autonomous system or IBGP peers, Local Preference or weight (cisco-specific, but weight is local to FortiGate) / Route-map setting local-preference is standard.

Answer

AS-PATH prepend

Answer

Cluster ID

Answer

Origin code

Question 4

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Accepted Answer

Inside the firewall policy that matches the traffic being steered by the SD-WAN rule. Security profiles in FortiOS are always applied within firewall policies, not directly inside SD-WAN rules or interface configurations. The SD-WAN rule handles routing/path selection, while the firewall policy handling that traffic enforces security profiles.

Answer

Directly inside the SD-WAN rule configuration under the advanced settings tab

Answer

Globally under the system settings as an SD-WAN overlay inspection profile

Answer

Within the IPsec tunnel phase 2 security association settings

Question 5

A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?

Accepted Answer

Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly. IPsec encapsulation adds overhead, and if the Path MTU Discovery (PMTUD) fails due to ICMP fragmentation-needed messages being blocked by security profiles or firewalls along the path, packet drops occur for UDP streams exceeding the actual MTU. Adjusting the TCP MSS or enabling ipsec-phase1-interface fragmentation settings/tcp-mss-enforcement resolves this.

Answer

SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth

Answer

The Antivirus proxy buffer is overflowing due to UDP streaming packets

Answer

The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops

Question 6

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. On high-latency or high-jitter links like satellite connections, the default DPD retry count and interval may be too aggressive. Increasing the DPD retry count and/or interval or switching the DPD mode to 'on-idle' or 'on-demand' helps prevent false drops.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode

Question 7

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

Accepted Answer

diagnose vpn tunnel list. The command 'get system session info' or specific VPN commands such as 'getvpn status' or 'diagnose vpn tunnel list' are used, but for ADVPN shortcuts specifically, 'diagnose sys ipsec tunnel list' or 'get vpn ipsec status' displays the dynamic child SAs. More precisely, 'get vpn advpn status' or querying the routing table with 'get router info routing-table database' shows shortcuts. Wait, the exact diagnostic command for checking ADVPN shortcuts in FortiOS is 'diagnose vpn swift list' or checking the IPsec tunnels via 'diagnose vpn tunnel list'. Let's look at the options to find the correct diagnostic command.

Answer

execute router clear bgp all

Answer

get system sdwan neighbor

Answer

diagnose netlink interface list

Question 8

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Accepted Answer

diagnose sys sdwan health-check. FortiOS provides diagnostic commands to check SD-WAN health check status and SLA metrics. The correct command is 'diagnose sys sdwan health-check'.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 9

An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?

Accepted Answer

Disable next-hop-self on the hub's BGP neighbor configuration or adjust OSPF interface settings so the advertising router is not forced as the next hop. In ADVPN environments running dynamic routing protocols like OSPF or BGP, network-object settings or interface settings such as setting the route-map or disabling next-hop-self on the hub allow spokes to properly resolve shortcut routes. Specifically, modifying the BGP next-hop or OSPF next-hop behavior ensures traffic is steered directly to the requesting spoke's IP rather than looping back through the hub.

Answer

Enable split-horizon globally within the OSPF routing process

Answer

Enable exchange-interface in the hub's OSPF interface configuration

Answer

Configure a static blackhole route for all spoke subnets on the hub

Question 10

An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?

Accepted Answer

Create a custom application signature override in the Application Control profile to correctly identify the traffic by port, IP, or pattern. When custom or specific applications are misidentified, administrators can create a Custom Application override or custom signature, or adjust the Application Control profile overrides to change the action (e.g., allow or assign to a specific app category) without disabling security entirely.

Answer

Disable all security profiles on the SD-WAN interface zone

Answer

Configure static routes for the application servers and bypass SD-WAN rules completely

Answer

Switch the inspection mode from flow-based to proxy-based for all firewall policies

Question 11

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

Accepted Answer

http-match. In SD-WAN health check (ping, tcp-echo, http, dns), when HTTP is selected as the server-type, administrators can configure a 'security-string' or 'http-match' / 'expect' string to validate the HTTP response body.

Answer

probe-packet-size

Answer

sla-break-time

Answer

server-response-timeout

Question 12

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

Accepted Answer

The SD-WAN rules are evaluated sequentially from top to bottom; an earlier broad SD-WAN rule with matching source/destination IP addresses is intercepting the traffic before the service-specific rule is reached. For SD-WAN rules based on applications or destination services to take effect, the matching firewall policy must have application control or appropriate inspection enabled, or the SD-WAN rule position/criteria order must match correctly. Furthermore, explicit proxy or policy routing interactions can interfere if implicit firewall rules intercept the traffic first.

Answer

IPsec VPN phase 2 selectors must be set to 0.0.0.0/0 for service-based rules to evaluate

Answer

The firewall policy containing the traffic has SSL inspection disabled, preventing service-based identification

Answer

The FortiGate kernel requires hardware acceleration (NP7) to be disabled for service-based SD-WAN rules to function

Question 13

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

Accepted Answer

Weight is evaluated first in the BGP best-path selection algorithm on FortiOS, allowing local preference override without altering global AS path attributes. Weight is a Cisco/FortiOS-specific BGP attribute that is local to the router on which it is configured. It is evaluated first in the BGP best-path selection algorithm, allowing administrators to deterministically force traffic out of a specific SD-WAN/BGP member without affecting other routers in the AS.

Answer

Weight replaces the need for SD-WAN SLA rules by performing layer 7 packet inspection

Answer

Weight automatically adjusts the SD-WAN health check probe frequency based on route stability

Answer

Weight is propagated to all iBGP peers, ensuring cluster-wide path synchronization

Question 14

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

Accepted Answer

The FortiGate kernel detects traffic matching a dynamic BGP route over the IPsec interface and initiates an IKE shortcut negotiation with the target spoke. ADVPN shortcuts are triggered when traffic matches a shortcut trigger mechanism. In ADVPN 2.0, IPsec phase 1 shortcut settings ('set advpn shortcut') and dynamic routing protocols working together allow the kernel to generate shortcut requests when traffic hits the phase 1 interface.

Answer

OSPF sends a special multicast hello packet across the hub to establish mesh point-to-point links

Answer

FortiManager pushes a dynamic static route to both spokes simultaneously

Answer

The Web Filtering profile intercepts the packet and redirects it via proxy to the destination spoke

Question 15

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

Accepted Answer

Under the router bgp neighbor configuration block in the CLI. BGP authentication passwords (such as MD5) are configured within the BGP neighbor configuration under router bgp in the FortiOS CLI.

Answer

Within the firewall policy authentication settings

Answer

Under the IPsec phase 1 interface advanced settings

Answer

Inside the SD-WAN health check probe configuration

Question 16

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

Accepted Answer

The FortiGate's self-signed CA certificate must be installed in the trusted root certificate store of the client endpoints. When using SSL Full Inspection (DPI), the FortiGate acts as a man-in-the-middle and re-signs certificates using a Certificate Authority (CA) certificate. This CA certificate must be installed and trusted on the client devices.

Answer

ADVPN 2.0 shortcut certificates must be exchanged between spokes

Answer

BGP MD5 authentication keys must match on both routers

Answer

A pre-shared key must be configured in the IPsec Phase 1 proposal

Question 17

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Accepted Answer

Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown. When shortcuts time out, routes must cleanly transition back to the hub route without creating transient routing loops. Adjusting route redistribution metrics, using specific distance values, or configuring 'shortcut-routing' / route-map timers / asymmetric routing settings prevents loops. In FortiOS ADVPN, setting appropriate dead timers or using dynamic routing distance adjustments ensures the hub route has a predictable preference when the shortcut drops.

Answer

Disable OSPF on the spoke units and rely entirely on static default routes

Answer

Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out

Answer

Configure asymmetric routing bypass on all firewall policies

Question 18

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

The firewall policy permitting traffic from the Guest Wi-Fi interface to the internal VPN interface lacks proper security profile enforcement or is missing a deny rule blocking inter-zone access. SD-WAN rules route internet or specific traffic based on criteria, but traffic between zones (like Guest Wi-Fi to Corporate LAN) is governed by firewall policies. If a firewall policy permits traffic from Guest Wi-Fi directly to Corporate LAN, it bypasses SD-WAN rules because SD-WAN rules only evaluate traffic matching egress SD-WAN zones/interfaces specified by the rule or routing table lookup. To prevent guest traffic from reaching internal subnets, the firewall policy must block or restrict that inter-zone traffic.

Answer

The SD-WAN health check probe is not monitoring the corporate subnet gateway

Answer

The IPsec Phase 2 security association selectors include the guest subnet range

Answer

The SD-WAN rule priority for the internal VPN interface is set higher than the broadband interface

Question 19

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. In BGP over ADVPN, Route Reflection is typically enabled on the hub so that spoke-to-spoke routes are reflected correctly, or next-hop behavior is manipulated. Wait, if we want spokes not to learn routes or to handle them correctly without full mesh, BGP Route Reflection (with no-client-to-client reflection if desired, or standard route reflection) is used. Alternatively, disabling next-hop-self or using peer groups. Let's look at the options. BGP Route Reflection on the hub allows the hub to reflect routes between spoke iBGP peers without requiring a full mesh iBGP session between every spoke.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 20

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

Accepted Answer

diagnose sys sdwan service. To view runtime statistics and hit counts for SD-WAN rules, the command 'diagnose sys sdwan service' is used.

Answer

show system sdwan

Answer

execute router clear sdwan cache

Answer

get firewall policy statistics