NSE7_SDW Security Profiles Routing And IPsec — Timed 10 Questions

Question 1

An administrator configures an SD-WAN rule with a 'Lowest Cost (SLA)' strategy. What determines the metric used by FortiOS to select the best interface when multiple links meet the SLA criteria?

Accepted Answer

The lowest packet loss, jitter, or latency value measured by the health check among the qualifying links. When 'Lowest Cost (SLA)' strategy is selected, FortiOS uses the configured priority and weight, or the specific metric defined in the SLA parameters (such as lowest latency, jitter, or packet loss among those meeting the threshold). If multiple links meet the SLA thresholds, it selects based on priority and weight, or lowest cost based on the metric specified. Wait, Lowest Cost uses the cost assigned to the SD-WAN members or interface weights. Let's look at the options.

Answer

The round-robin algorithm applied sequentially across all active links

Answer

The lowest physical port number on the FortiGate hardware

Answer

The highest interface bandwidth capacity defined in the static route table

Question 2

An administrator configures an IPsec tunnel template for ADVPN 2.0 on a FortiGate hub. Which specific Phase 1 configuration parameter must be enabled to support dynamic shortcut creation between spokes in ADVPN 2.0?

Accepted Answer

set net-device enable. To support ADVPN 2.0 shortcuts, the Phase 1 configuration must have 'set net-device enable' and 'set advpn enable' (or equivalent shortcut settings depending on FortiOS version, such as 'set tunnel-search' or 'set shortcut-forwarding'). In modern FortiOS, 'set net-device enable' is required so each dynamic shortcut creates a virtual network interface.

Answer

set mode aggressive

Answer

set dhcp-interception enable

Answer

set pfs-group modp1024

Question 3

An administrator has configured BGP over multiple SD-WAN IPsec tunnels to provide redundant paths to a datacenter. However, asymmetric routing is causing stateful inspection drops on a secondary FortiGate firewall downstream. To ensure that BGP selects the preferred primary SD-WAN member consistently, which BGP attribute is best manipulated via a route-map applied to the BGP neighbor in FortiOS?

Accepted Answer

Local Preference. MED (Multi-Exit Discriminator) or Local Preference can influence inbound/outbound path selection. Local Preference is used to influence outbound routing decisions within an AS, while MED influences inbound traffic from external peers. For internal path selection across SD-WAN tunnels terminating on the same autonomous system or IBGP peers, Local Preference or weight (cisco-specific, but weight is local to FortiGate) / Route-map setting local-preference is standard.

Answer

AS-PATH prepend

Answer

Cluster ID

Answer

Origin code

Question 4

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

Accepted Answer

Inside the firewall policy that matches the traffic being steered by the SD-WAN rule. Security profiles in FortiOS are always applied within firewall policies, not directly inside SD-WAN rules or interface configurations. The SD-WAN rule handles routing/path selection, while the firewall policy handling that traffic enforces security profiles.

Answer

Directly inside the SD-WAN rule configuration under the advanced settings tab

Answer

Globally under the system settings as an SD-WAN overlay inspection profile

Answer

Within the IPsec tunnel phase 2 security association settings

Question 5

A FortiGate device is configured with an SD-WAN rule utilizing a SLA rule for latency and packet loss. Security profiles including Deep Packet Inspection (DPI) SSL inspection and an Antivirus profile are applied to the firewall policy allowing this traffic. Users report intermittent connection drops on real-time UDP-based applications. Upon troubleshooting, the administrator notices that packet drops occur only when the SD-WAN rule dynamically steers traffic to a backup IPsec tunnel that has a smaller MTU. What is the most likely root cause and mitigation for this behavior?

Accepted Answer

Path MTU Discovery is failing because ICMP unreachable messages are blocked, and TCP MSS clamping is not adjusting the encapsulated IPsec packet size correctly. IPsec encapsulation adds overhead, and if the Path MTU Discovery (PMTUD) fails due to ICMP fragmentation-needed messages being blocked by security profiles or firewalls along the path, packet drops occur for UDP streams exceeding the actual MTU. Adjusting the TCP MSS or enabling ipsec-phase1-interface fragmentation settings/tcp-mss-enforcement resolves this.

Answer

SD-WAN health check probes are overwhelming the IPsec tunnel bandwidth

Answer

The Antivirus proxy buffer is overflowing due to UDP streaming packets

Answer

The SSL inspection profile is attempting to decrypt UDP traffic, causing kernel panic and packet drops

Question 6

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

Accepted Answer

Increase the DPD retry count and interval settings under the IPsec Phase 1 configuration. On high-latency or high-jitter links like satellite connections, the default DPD retry count and interval may be too aggressive. Increasing the DPD retry count and/or interval or switching the DPD mode to 'on-idle' or 'on-demand' helps prevent false drops.

Answer

Disable DPD entirely so the FortiGate never tears down the tunnel

Answer

Enable NP6/NP7 hardware offloading for Phase 1 SA renegotiation

Answer

Change the IPsec phase 1 mode from Main mode to Aggressive mode

Question 7

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

Accepted Answer

diagnose vpn tunnel list. The command 'get system session info' or specific VPN commands such as 'getvpn status' or 'diagnose vpn tunnel list' are used, but for ADVPN shortcuts specifically, 'diagnose sys ipsec tunnel list' or 'get vpn ipsec status' displays the dynamic child SAs. More precisely, 'get vpn advpn status' or querying the routing table with 'get router info routing-table database' shows shortcuts. Wait, the exact diagnostic command for checking ADVPN shortcuts in FortiOS is 'diagnose vpn swift list' or checking the IPsec tunnels via 'diagnose vpn tunnel list'. Let's look at the options to find the correct diagnostic command.

Answer

execute router clear bgp all

Answer

get system sdwan neighbor

Answer

diagnose netlink interface list

Question 8

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

Accepted Answer

diagnose sys sdwan health-check. FortiOS provides diagnostic commands to check SD-WAN health check status and SLA metrics. The correct command is 'diagnose sys sdwan health-check'.

Answer

get system interface physical

Answer

execute ping-server status

Answer

show system sdwan

Question 9

An administrator configures an ADVPN 2.0 deployment between a FortiGate hub and multiple spokes using OSPF as the dynamic routing protocol. The spoke units need to establish direct shortcut tunnels dynamically. Which configuration step is mandatory on the hub to ensure that BGP or OSPF next-hop resolution works correctly for ADVPN shortcut creation?

Accepted Answer

Disable next-hop-self on the hub's BGP neighbor configuration or adjust OSPF interface settings so the advertising router is not forced as the next hop. In ADVPN environments running dynamic routing protocols like OSPF or BGP, network-object settings or interface settings such as setting the route-map or disabling next-hop-self on the hub allow spokes to properly resolve shortcut routes. Specifically, modifying the BGP next-hop or OSPF next-hop behavior ensures traffic is steered directly to the requesting spoke's IP rather than looping back through the hub.

Answer

Enable split-horizon globally within the OSPF routing process

Answer

Enable exchange-interface in the hub's OSPF interface configuration

Answer

Configure a static blackhole route for all spoke subnets on the hub

Question 10

An enterprise FortiGate is running SD-WAN with multiple internet breakouts. The administrator applies an Application Control security profile to the firewall policy. Some custom business applications are being incorrectly classified or blocked by the Application Control profile. To ensure SD-WAN can reliably steer this traffic using application signatures while preventing false positives, what is the recommended procedure?

Accepted Answer

Create a custom application signature override in the Application Control profile to correctly identify the traffic by port, IP, or pattern. When custom or specific applications are misidentified, administrators can create a Custom Application override or custom signature, or adjust the Application Control profile overrides to change the action (e.g., allow or assign to a specific app category) without disabling security entirely.

Answer

Disable all security profiles on the SD-WAN interface zone

Answer

Configure static routes for the application servers and bypass SD-WAN rules completely

Answer

Switch the inspection mode from flow-based to proxy-based for all firewall policies