NSE7_SDW Security Profiles Routing And IPsec — Timed 10 Questions

Question 1

An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?

10 minute time limit — choose an answer to begin.

Accepted Answer

Local Preference. Local Preference is the best BGP attribute to manipulate via a route-map applied to the BGP neighbor in FortiOS to ensure consistent primary path selection. Local Preference is used within an autonomous system to indicate the preferred exit point for outbound traffic. By setting a higher local preference on routes learned from the primary SD-WAN member, BGP will prefer that path. This attribute is propagated only within the local AS, making it ideal for influencing outbound path selection without affecting external peers.

Answer

AS-PATH prepend

Answer

Cluster ID

Answer

Origin code

Question 2

A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?

Accepted Answer

Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly. The most likely root cause is that Path MTU Discovery (PMTD) is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not correctly adjusting the encapsulated IPsec packet size. When traffic is steered to a backup IPsec tunnel with a smaller MTU, large UDP packets may exceed the tunnel MTU and be dropped if PMTUD cannot signal the need for fragmentation. The mitigation is to ensure ICMP unreachable messages are allowed and to configure TCP MSS clamping appropriately, though for UDP, adjusting the MTU or enabling fragmentation before encryption may be necessary.

Answer

SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth

Answer

The Antivirus proxy buffer is overflowing due to UDP streaming packets

Answer

The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops

Question 3

An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?

Accepted Answer

Disable next-hop-self on the hub's BGP neighbor configuration or adjust OSPF interface settings so the advertising router is not forced as the next hop. For ADVPN shortcuts to form, the spoke must be able to resolve the next-hop of the remote spoke's subnet to the remote spoke's public IP rather than to the hub. If the hub advertises routes with next-hop-self (BGP) or forces itself as the OSPF advertising router, spokes will always route through the hub and never trigger a shortcut. Disabling next-hop-self or adjusting OSPF so the original advertising router is preserved allows the spoke to see the true next hop and initiate an IKE shortcut.

Answer

Enable split-horizon globally within the OSPF routing process

Answer

Enable exchange-interface in the hub's OSPF interface configuration

Answer

Configure a static blackhole route for all spoke subnets on the hub

Question 4

An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?

Accepted Answer

Create a custom application signature override in the Application Control profile to correctly identify the traffic by port, IP, or pattern. Creating a custom application signature override in the Application Control profile lets the administrator correct the misclassification by defining the traffic via port, IP, or pattern, so SD-WAN can reliably steer it using the corrected application signature. This preserves security inspection while eliminating false positives, which is the recommended Fortinet procedure for custom business apps.

Answer

Disable all security profiles on the SD-WAN interface zone

Answer

Configure static routes for the application servers and bypass SD-WAN rules completely

Answer

Switch the inspection mode from flow-based to proxy-based for all firewall policies

Question 5

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Accepted Answer

The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links. When 'Lowest Cost (SLA)' strategy is selected, FortiOS uses the configured priority and weight, or the specific metric defined in the SLA parameters (such as lowest latency, jitter, or packet loss among those meeting the threshold). If multiple links meet the SLA thresholds, it selects based on priority and weight, or lowest cost based on the metric specified. Wait, Lowest Cost uses the cost assigned to the SD-WAN members or interface weights. Let's look at the options.

Answer

The round-robin algorithm applied sequentially across all active links

Answer

The lowest physical port number on the FortiGate hardware

Answer

The highest interface bandwidth capacity defined in the static route table

Question 6

An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?

Accepted Answer

set net-device enable. To support ADVPN 2.0 shortcuts, the Phase 1 configuration must have 'set net-device enable' and 'set advpn enable' (or equivalent shortcut settings depending on FortiOS version, such as 'set tunnel-search' or 'set shortcut-forwarding'). In modern FortiOS, 'set net-device enable' is required so each dynamic shortcut creates a virtual network interface.

Answer

set mode aggressive

Answer

set dhcp-interception enable

Answer

set pfs-group modp1024

Question 7

A FortiGate device is running ADVPN 2.0 with OSPF. A spoke experiences transient routing loops when a shortcut tunnel tears down due to inactivity timeout. Which configuration adjustment on the FortiGate hub and spokes prevents these temporary routing blackholes or loops during shortcut teardown?

Accepted Answer

Adjust the administrative distance or use route redistribution filters with appropriate metrics so hub routes and shortcut routes do not conflict during teardown. During shortcut teardown, routing loops or blackholes can occur if the hub and spoke have conflicting routes with the same or better administrative distance. Adjusting administrative distance or using route redistribution filters with appropriate metrics ensures that hub routes and shortcut routes do not conflict during the transition, allowing OSPF to converge cleanly.

Answer

Disable OSPF on the spoke units and rely entirely on static default routes

Answer

Set the IPsec phase 1 lifetime to infinite to prevent shortcuts from timing out

Answer

Configure asymmetric routing bypass on all firewall policies

Question 8

An administrator configures an SD-WAN rule to route guest Wi-Fi traffic out of a secondary broadband internet connection. However, guest users are still able to access internal corporate subnets that are routed over the primary IPsec VPN tunnel. What configuration is missing or incorrect?

Accepted Answer

The firewall policy permitting traffic from the Guest Wi-Fi interface to the internal VPN interface lacks proper security profile enforcement or is missing a deny rule blocking inter-zone access. The issue is that the firewall policy allowing traffic from the Guest Wi-Fi interface to the internal VPN interface is either missing a deny rule to block inter-zone access or lacks proper security profile enforcement. This allows guest users to access internal subnets despite the SD-WAN rule routing internet traffic out of the secondary connection.

Answer

The SD-WAN health check probe is not monitoring the corporate subnet gateway

Answer

The IPsec Phase 2 security association selectors include the guest subnet range

Answer

The SD-WAN rule priority for the internal VPN interface is set higher than the broadband interface

Question 9

An enterprise network implements BGP over ADVPN. Spoke units advertise their local subnets to the hub via BGP. To prevent spokes from learning each other's subnets directly through the hub via regular BGP route propagation before an ADVPN shortcut is established (forcing them to route through the hub unnecessarily), or conversely, to optimize route distribution, what BGP feature is typically configured on the hub?

Accepted Answer

BGP Route Reflection configured on the hub with spoke routers set as clients. BGP Route Reflection is the standard solution for iBGP full-mesh scalability. In an ADVPN, spokes establish iBGP sessions with the hub, and without route reflection, the hub would not re-advertise routes learned from one spoke to another because of iBGP split-horizon rules. Configuring the hub as a route reflector with spokes as clients allows the hub to reflect routes between spokes, enabling them to learn each other's subnets via BGP. This ensures that before an ADVPN shortcut is established, spokes have the necessary routes to initiate shortcut negotiation, and after the shortcut is up, BGP can still be used to exchange routes directly or via the hub as needed.

Answer

BGP Multipath relaxing with maximum-paths set to 32

Answer

Static default route redistribution with aggregate-address suppression

Answer

BGP Confederation with each spoke acting as a separate autonomous system

Question 10

An administrator troubleshoots an ADVPN 2.0 deployment where dynamic shortcut tunnels fail to establish between branch spokes. Which THREE diagnostic steps or log checks should the administrator perform on the FortiGate hub or spoke to isolate the issue? (Choose three)

Accepted Answer

Check 'diagnose vpn tunnel list' to verify if dynamic shortcut child security associations are being created. Option A is correct because 'diagnose vpn tunnel list' shows the IPsec tunnel and child SA state on the FortiGate, allowing the administrator to confirm whether the dynamic shortcut child security associations between spokes are actually being negotiated and created. Option C is correct because enabling IKE real-time debugging with 'diagnose vpn ike log-filter' lets the administrator inspect the IKE negotiation messages (proposals, nonces, traffic selectors, and any error notifications) exchanged between the hub and spokes, which is essential to pinpoint where shortcut establishment fails. Option E is correct because 'get router info routing-table database' reveals whether the dynamic shortcut routes are being injected into the routing table when traffic matches the ADVPN phase 1 interface, confirming that route propagation for the shortcut is working. Option B is not appropriate because SD-WAN rule hit counts are unrelated to ADVPN shortcut tunnel negotiation and would not isolate an IKE or routing failure. Option D is not appropriate because formatting the internal flash is a destructive action that would erase configuration and logs, and it is not a valid troubleshooting step for ADVPN certificate or shortcut issues.

Answer

Check the firewall policy statistics to ensure SD-WAN rules have zero hit counts globally

Answer

Execute 'execute format disk' to reset the internal flash storage and clear corrupted ADVPN certificates