NSE7 Troubleshooting and Diagnostics — 15 Questions

Question 1

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

Choose an answer to begin — your selection is scored in the full session.

Accepted Answer

Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.. The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.

Answer

Run 'diagnose debug flow' with the source IP and look for 'no matching policy' or 'dropped' messages.

Answer

Enable 'deny-log' on all policies and check logs for the subnet.

Answer

Enable global traffic logging and review logs after some traffic passes.

Question 2

An organization uses FortiGate with OSPF and BGP. Recently, routes from BGP are not being preferred over OSPF routes, causing suboptimal routing. The administrator wants to ensure BGP routes are preferred. Which two actions can achieve this? (Choose two.)

Accepted Answer

Decrease the administrative distance of BGP routes to 5.. Option A is correct because FortiGate selects routes by administrative distance (AD) first, and lowering the BGP AD to 5 (below OSPF's default of 110) makes BGP routes win the best-route selection. Option C is correct because raising the OSPF administrative distance to 120 (above BGP's default of 20 for eBGP or 200 for iBGP, depending on the source) causes OSPF routes to lose to BGP routes in the RIB comparison. Option B is not correct because a route-map metric only influences BGP path selection among BGP routes (or is used for redistribution), not the AD-based comparison between BGP and OSPF. Option D is not correct because weight is a Cisco/BGP-specific attribute used only to prefer one BGP path over another BGP path, not to override OSPF routes on FortiGate.

Answer

Configure route-map to set metric to 1 on BGP routes.

Answer

Set a higher weight on BGP routes for the prefixes.

Question 3

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

Accepted Answer

Ensure that the pre-shared key matches on both sides.. Option A is correct because IKE Phase 1 authentication fails if the pre-shared key differs between peers, so verifying the PSK matches on both sides is essential when the tunnel won't come up. Option C is correct because basic IP reachability to the remote peer's public IP must exist before IKE can negotiate; if ping fails, the problem is at the network layer rather than in the VPN configuration. Option D is correct because 'diag debug application ike -1' enables verbose IKE debugging on FortiGate, exposing Phase 1/Phase 2 negotiation errors such as proposal mismatches or authentication failures. Option B is not among the marked answers; while UDP 500/4500 blocking is a common cause, it is not one of the three actions designated correct here. Option E is also not marked correct because routing to the remote subnet matters for traffic through an established tunnel, but it does not diagnose why the tunnel itself is failing to come up.

Answer

Confirm that UDP ports 500 and 4500 are not blocked by any firewall.

Answer

Review the routing table to ensure the remote subnet is reachable through the tunnel interface.

Question 4

A FortiGate administrator sees the following kernel log: 'kernel: [pid 1234] received packet with unknown or unsupported protocol 0x0800 on interface port1, drop'. What does this log indicate?

Accepted Answer

The interface is not configured with an IP address or is in the wrong VDOM.. The kernel log indicates that the interface port1 received an Ethernet frame with EtherType 0x0800 (IPv4) but the FortiGate dropped it because the interface is either not configured with an IP address or is bound to the wrong VDOM. Without an IP address or proper VDOM assignment, the kernel cannot process the packet at Layer 3, so it logs the packet as having an 'unknown or unsupported protocol' even though 0x0800 is standard IPv4.

Answer

The packet is an ARP request that failed.

Answer

The packet has an invalid MAC address.

Answer

The packet has IP options set that are not supported.

Question 5

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

Accepted Answer

Traffic from the same source IP arrives on different interfaces for different sessions.. Option B is correct because asymmetric routing specifically means that packets belonging to the same flow or from the same source can enter the FortiGate through different interfaces, which breaks stateful inspection and session tracking. Option E is correct because when return traffic takes a different path that bypasses the FortiGate, the firewall only sees the outbound TCP SYN and never observes the corresponding SYN-ACK, so the session remains incomplete and the application fails. Option A is not indicative of asymmetric routing, since multiple equal-cost paths in the routing table simply describe ECMP and do not by themselves mean traffic flows asymmetrically. Option C is not specific to asymmetric routing, as a policy can log traffic as allowed while the application still fails for many unrelated reasons such as NAT, MTU, or application-layer issues. Option D is not a symptom of asymmetric routing, because sustained high CPU during peak hours reflects resource load rather than a path asymmetry problem.

Answer

The routing table shows multiple equal-cost paths to the same destination.

Answer

Traffic matching a policy is logged as allowed but the application does not work.

Answer

CPU usage is consistently above 90% during peak hours.

Question 6

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

Accepted Answer

Mismatched Phase 2 proxy IDs (local/remote subnets).. The 'no proposal chosen' error during Phase 2, despite Phase 1 being up, indicates a mismatch in the IPsec security association (SA) parameters. Since the remote FortiGate has multiple Phase 2 selectors configured, the most likely cause is that the local and remote proxy IDs (local and remote subnets) do not match any of the configured selectors. Phase 2 negotiation uses these proxy IDs to define which traffic should be encrypted; if they don't align, the IKE SA cannot be established.

Answer

Mismatched pre-shared keys.

Answer

Dead Peer Detection (DPD) settings are too aggressive.

Answer

Certificate validation failure.

Question 7

A FortiGate is set up in a high availability (HA) cluster. The administrator notices that the primary unit is not synchronizing configuration changes to the secondary unit. The HA status shows 'synchronization failed'. What is the most likely cause?

Accepted Answer

The configuration has not been saved on the primary unit.. FortiGate HA requires the configuration to be saved (via 'execute backup config' or 'write memory') on the primary unit before it can be synchronized to the secondary unit. If the configuration is not saved, the primary unit does not have a committed configuration to push, leading to a 'synchronization failed' status even though the HA cluster is otherwise healthy.

Answer

The firmware versions are different on the two units.

Answer

The HA heartbeat interface is down.

Answer

NAT policies are misconfigured.

Question 8

A company runs a FortiGate 600E in NAT/Route mode. They have a site-to-site VPN to a partner using route-based VPN with BGP. Recently, they added a new subnet 192.168.50.0/24 behind the FortiGate. The BGP session is up, and the route is being advertised to the partner. However, traffic from the partner to the new subnet fails. The FortiGate's routing table shows the route to 192.168.50.0/24 is present via the VPN interface. Firewall policies allow the traffic. A packet capture on the FortiGate's internal interface shows the partner's traffic arriving but no SYN-ACK being sent back. The FortiGate's session table shows sessions in 'SYN_RECV' state for the new subnet. What is the most likely cause?

Accepted Answer

The Phase 2 selector for the VPN does not include the new subnet, so the FortiGate does not encrypt the reply traffic.. In a route-based VPN, the Phase 2 selectors define which traffic is allowed to be encrypted and decrypted. Even though BGP advertises the new subnet 192.168.50.0/24, if the Phase 2 selector on either side does not include this subnet, the FortiGate will not encrypt the reply traffic. The packet capture shows the SYN arriving, but no SYN-ACK is sent because the FortiGate cannot find a matching Phase 2 proposal to encrypt the response, causing the session to remain in SYN_RECV state.

Answer

The reverse path forwarding (RPF) check is dropping the incoming SYN.

Answer

The firewall policy is not configured with the correct source interface.

Answer

The BGP route advertisement is being filtered by a route map on the partner side.

Question 9

A FortiGate is blocking HTTP traffic from 10.0.1.5 to 10.0.2.100, despite an explicit allow policy. The exhibit shows the configuration and debug flow output. What is the most likely cause?

Accepted Answer

TCP SYN flood protection is dropping the incomplete session.. The debug flow output shows the session is in a 'SYN_RECV' state and never transitions to 'ESTABLISHED', which is characteristic of TCP SYN flood protection. When the FortiGate's SYN flood protection threshold is exceeded, it drops incomplete sessions before they can be fully established, even if an explicit allow policy exists. This explains why HTTP traffic from 10.0.1.5 to 10.0.2.100 is blocked despite the policy being correctly configured.

Answer

The policy is applied to the wrong source interface.

Answer

The policy action is set to deny.

Answer

The source address object does not include 10.0.1.5.

Question 10

A FortiGate is deployed as the edge firewall for a medium-sized enterprise. The network has three internal zones: Trust (10.10.0.0/16), DMZ (172.16.0.0/24), and Guest (192.168.0.0/24). The FortiGate has an IPSec VPN to a branch office (10.20.0.0/16). Users in the Trust zone report intermittent connectivity to a web server in the DMZ (172.16.0.10, TCP port 443). The FortiGate logs show occasional 'session denied' messages for traffic from Trust to DMZ with reason 'denied by forward policy check'. The security policy has an explicit allow rule for Trust to DMZ HTTPS. The administrator has verified routing is correct and there are no address overlaps. When the issue occurs, the administrator runs 'diag debug flow' and sees that the packet matches the correct policy but still gets denied. The debug output also shows 'forward policy check: denied'. What is the most likely cause and recommended action?

Accepted Answer

A traffic shaping policy or application control profile is blocking the traffic; review and adjust the traffic shaping policy or application control profile applied to the policy.. The debug flow output shows the packet matches the correct security policy but is still denied by 'forward policy check'. This indicates that a secondary policy component, such as a traffic shaping policy or application control profile, is blocking the traffic. These features can override the security policy action if they are configured to deny or drop matching traffic, even when the security policy itself is set to allow.

Answer

The route to the DMZ is intermittently flapping; add a static route with a higher distance.

Answer

The security profiles (AV, IPS) are blocking the traffic; temporarily disable all security profiles on the policy.

Answer

The session helper for HTTPS is interfering; disable the HTTPS session helper.

Question 11

Match each high availability (HA) mode to its characteristic.

Accepted Answer

Active-Passive: One unit is active, others are standby.. The correct matches are A and B. Common confusions involve swapping the characteristics: Active-Passive uses a single active unit with standby, while Active-Active uses all units to handle traffic.

Answer

Active-Passive: All units are active and load balance.

Answer

Active-Active: Only one unit processes traffic, others monitor.

Question 12

A network administrator runs 'diagnose sys top' and sees that the 'ipsengine' process is consistently using 99% CPU. What is the BEST immediate action to reduce CPU load?

Accepted Answer

Disable IPS inspection on policies that don't require it. The 'ipsengine' process consuming 99% CPU indicates that IPS inspection is being applied to traffic that may not require it, causing excessive processing overhead. Disabling IPS on policies that do not need it (Option C) directly reduces the workload on the IPS engine without affecting other security functions or requiring a reboot. This is the most immediate and targeted action to alleviate CPU pressure.

Answer

Reboot the FortiGate

Answer

Increase the session limit

Answer

Change IPS engine to flow-based mode

Question 13

In an HA cluster, after a failover, some established sessions are not being synchronized to the new primary unit. Which setting must be enabled to ensure session synchronization?

Accepted Answer

set session-pickup enable. Session-pickup is the FortiGate HA feature that synchronizes the state of established sessions from the primary unit to the backup unit. When a failover occurs, the new primary unit can continue forwarding traffic for those sessions without interruption only if session-pickup is enabled. Without it, all existing sessions are dropped and must be re-established by the clients.

Answer

set override enable

Answer

set sync-sessions enable

Answer

set priority <value>

Question 14

A FortiGate admin runs 'diagnose debug application authd -1' but sees no output for LDAP authentication attempts. What is the MOST likely reason?

Accepted Answer

The FortiGate is in FIPS mode. The 'diagnose debug application authd -1' command enables verbose debug logging for the authentication daemon. However, on a FortiGate running in FIPS mode, many debug commands are restricted or produce no output to comply with security requirements. This is the most likely reason for observing no LDAP authentication debug output. Other possible reasons include running the command after authentication attempts have completed, but FIPS mode is a definitive system-level constraint.

Answer

The LDAP server is unreachable

Answer

The LDAP server timed out

Answer

Debug flow is not enabled

Question 15

You are troubleshooting a BGP neighbor flapping. The neighbor state shows 'Active'. Which command will help you see the reason for the state change?

Accepted Answer

get router info bgp neighbors. The 'get router info bgp neighbors ' command displays detailed information about a BGP neighbor, including its current state (e.g., Active, Established) and a history of state changes. This helps identify why the session is flapping, as it shows the last few state transitions and the associated reasons (e.g., timeouts, resets). The 'Active' state indicates the router is trying to establish a TCP connection, and the neighbor details can reveal issues like misconfigured IP addresses, AS numbers, or authentication. Option B is incorrect because 'get router info bgp neighbors rejected-routes' shows routes that were rejected by policy, not the reason for state changes. Option C shows routes received from the neighbor, and Option D provides a summary, neither of which directly reveals why the state changed.

Answer

get router info bgp neighbors <neighbor> rejected-routes

Answer

get router info bgp neighbors <neighbor> received-routes

Answer

get router info bgp summary