NSE7 Troubleshooting and Diagnostics — 40 Questions

Question 1

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

Accepted Answer

Check the CPU and memory utilization on the FortiGate.. High CPU or memory utilization on a FortiGate can directly cause packet drops, queuing delays, and slow throughput, especially under load. Checking these resources is a fundamental first step in troubleshooting performance issues. Additionally, verifying the routing table ensures that traffic is being forwarded via the correct next-hop interfaces; incorrect routing can lead to suboptimal paths or blackholing, resulting in perceived slowness. Both actions help isolate the root cause of a slow connection.

Answer

Increase the session TTL to reduce session setup overhead.

Answer

Disable flow control on the WAN interface.

Answer

Disable all security profiles to free resources.

Question 2

You are troubleshooting a BGP neighbor flapping. The neighbor state shows 'Active'. Which command will help you see the reason for the state change?

Accepted Answer

get router info bgp neighbors. The 'get router info bgp neighbors ' command displays detailed information about a BGP neighbor, including its current state (e.g., Active, Established) and a history of state changes. This helps identify why the session is flapping, as it shows the last few state transitions and the associated reasons (e.g., timeouts, resets). The 'Active' state indicates the router is trying to establish a TCP connection, and the neighbor details can reveal issues like misconfigured IP addresses, AS numbers, or authentication. Option B is incorrect because 'get router info bgp neighbors rejected-routes' shows routes that were rejected by policy, not the reason for state changes. Option C shows routes received from the neighbor, and Option D provides a summary, neither of which directly reveals why the state changed.

Answer

get router info bgp neighbors <neighbor> rejected-routes

Answer

get router info bgp neighbors <neighbor> received-routes

Answer

get router info bgp summary

Question 3

An administrator runs 'diagnose sys session filter dport 443' and sees output indicating sessions with state 'proto=6 proto_state=01 duration=3600 expire=3598'. What does this output indicate about the session?

Accepted Answer

The session is an expired TCP session that is being removed. The session shows proto=6 (TCP) and proto_state=01, which in FortiOS indicates TCP state SYN_SENT. The duration of 3600 seconds and expire of 3598 seconds suggest the session has been in SYN_SENT for an extended period, which is abnormal. Default SYN_SENT timeout is much shorter, so this session is likely stuck or expired and will be removed soon. Therefore, option A correctly describes it as an expired TCP session being removed.

Answer

The session is a UDP session to port 443 that has been idle for 3600 seconds

Answer

The session is an established TCP session to port 443, lasting 3600 seconds with 3598 seconds remaining

Answer

The session is blocked by a firewall policy and has been logged

Question 4

A FortiGate HA cluster is experiencing persistent split-brain even after both units are rebooted. Which THREE actions should the administrator take to resolve this issue? (Choose three.)

Accepted Answer

Verify that the heartbeat interfaces are properly connected and configured. Split-brain occurs when HA peers lose communication over the heartbeat link, causing each unit to assume the other is down and both become active. Option A is correct because verifying the heartbeat interfaces ensures the dedicated link is functional, which is the most common root cause. Option B is correct because increasing the HA failover hold time (hold down time) can prevent transient network issues from triggering false failovers and flapping, which often resembles split-brain behavior. Option D is correct because split-brain is more likely in active-active mode; configuring active-passive mode ensures only one unit is active at any time, eliminating the possibility of both units operating independently.

Answer

Reduce the priority on the secondary unit

Answer

Disable HA on both units and re-enable

Question 5

A FortiGate is experiencing high memory usage due to a large number of UDP sessions. The administrator wants to reduce memory consumption without dropping legitimate traffic. Which THREE actions could help? (Choose three.)

Accepted Answer

Enable session-ttl to enforce idle timeout. Enabling session-ttl enforces an idle timeout on UDP sessions, preventing them from lingering indefinitely after traffic stops. This reduces memory consumption by ensuring stale UDP sessions are removed without affecting active traffic. Option C is correct because reducing the UDP session timeout shortens the time inactive UDP sessions remain in memory, freeing up resources sooner. Option D is correct because disabling unnecessary session helpers for UDP reduces the memory overhead associated with processing and tracking sessions that don't require deep inspection, further lowering memory usage without dropping legitimate traffic.

Answer

Increase the maximum session limit

Answer

Upgrade the FortiGate hardware

Question 6

An administrator is investigating a security incident using FortiAnalyzer logs. The admin needs to identify all connections from a specific internal IP (10.0.0.100) to external servers on TCP port 443 during the last hour. Which TWO log fields should be used to filter the logs? (Choose two.)

Accepted Answer

dstip. To identify all connections from the specific internal IP 10.0.0.100 to external servers on TCP port 443, the administrator should filter logs using dstip (destination IP) to specify the internal IP as the destination (since logs record the direction from the policy perspective), and policyid to isolate traffic handled by a particular security policy. This combination ensures accurate identification of all relevant connections.

Answer

dstport

Answer

srcip

Answer

action

Question 7

An administrator is troubleshooting a VPN tunnel between two FortiGates. The phase 1 fails to come up. The administrator runs 'diagnose vpn ike log' and sees the error 'no proposal chosen'. Which THREE configuration mismatches could cause this error?

Accepted Answer

Different Diffie-Hellman groups (e.g., DH5 vs DH14). The 'no proposal chosen' error occurs during IKE phase 1 when the peers cannot agree on a common set of security parameters. The three mismatches that cause this error are: A) Different Diffie-Hellman groups (e.g., DH5 vs DH14) because the DH group is part of the IKE proposal; B) Different encryption algorithms (e.g., AES128 vs 3DES) because both sides must use the same encryption algorithm; and E) Different IKE mode (main vs aggressive) because the mode is negotiated in the IKE proposal. Options C and D cause different errors: mismatched IPs typically result in 'no response' or 'no peer found', while mismatched pre-shared keys result in authentication failures (e.g., 'encryption/decrption failed').

Answer

Mismatched local and remote gateway IPs

Answer

Mismatched pre-shared keys

Question 8

A network admin is investigating a high CPU usage issue on a FortiGate firewall. The admin runs 'diagnose sys top' and sees that the 'ipsengine' process is consuming 70% CPU. Which THREE actions should the admin take to reduce CPU load?

Accepted Answer

Review and optimize IPS signatures; disable unnecessary signatures. Disabling unnecessary IPS signatures reduces pattern-matching operations, lowering CPU load. Option D, while extreme, reduces CPU load by stopping all IPS inspection; it can be a temporary measure during troubleshooting. Option E is correct because NPU offloading shifts IPS processing to hardware, reducing CPU usage. Options B and C are incorrect: increasing process priority would starve other processes and likely worsen overall system performance.

Answer

Increase the IPS engine process priority

Answer

Increase the IPS engine process priority

Question 9

An administrator is investigating a security incident using FortiAnalyzer logs. The admin wants to identify all traffic that matched a specific firewall policy. Which TWO log fields should the admin use to filter the logs?

Accepted Answer

policyid. The 'policyid' field in FortiAnalyzer logs directly corresponds to the firewall policy ID that processed the traffic. Filtering on this field isolates all log entries matched against a specific policy. Option E is also correct because the 'srcintf' field indicates the source interface of the traffic. Since firewall policies are often applied to specific interfaces, filtering by source interface can help narrow down logs related to a particular policy, especially when the policy is associated with that interface. Together, these two fields provide an effective way to identify traffic that matched a specific firewall policy.

Answer

user

Answer

appid

Answer

dstip

Question 10

A FortiGate in an HA cluster is experiencing intermittent session synchronization failures. The administrator runs 'diagnose sys ha dump sync-status' and sees that sessions are not being synchronized properly. Which TWO potential causes should the administrator investigate?

Accepted Answer

Excessive number of sessions exceeding the session sync limit. FortiGate HA has a configurable session sync limit (default 500,000 sessions). When the number of concurrent sessions exceeds this limit, the FortiGate stops synchronizing new sessions to the backup unit, leading to intermittent synchronization failures. This can be verified by checking the 'ses_sync_limit' value in the HA configuration and comparing it to the current session count. Option D is correct because high packet loss or latency on the heartbeat interface can cause session synchronization failures. The heartbeat interface carries synchronization traffic, and any degradation in its performance can lead to missed or delayed sync packets, resulting in intermittent sync failures. This can be diagnosed by checking heartbeat interface statistics such as packet loss and latency.

Answer

Mismatched HA group IDs

Answer

Incorrect BGP route advertisements

Answer

Mismatched HA passwords

Question 11

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

Accepted Answer

Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.. The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.

Answer

Run 'diagnose debug flow' with the source IP and look for 'no matching policy' or 'dropped' messages.

Answer

Enable 'deny-log' on all policies and check logs for the subnet.

Answer

Enable global traffic logging and review logs after some traffic passes.

Question 12

An organization uses FortiGate with OSPF and BGP. Recently, routes from BGP are not being preferred over OSPF routes, causing suboptimal routing. The administrator wants to ensure BGP routes are preferred. Which two actions can achieve this? (Choose two.)

Accepted Answer

Decrease the administrative distance of BGP routes to 5.. Decreasing the administrative distance (AD) of BGP routes to 5 makes them more trustworthy than OSPF routes (default AD 110). Since a lower AD is preferred, BGP routes will be installed in the routing table over OSPF routes, ensuring BGP is preferred for forwarding decisions.

Answer

Configure route-map to set metric to 1 on BGP routes.

Answer

Set a higher weight on BGP routes for the prefixes.

Question 13

A FortiGate is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the process 'ipsengine' is using the most CPU. What is the most likely cause?

Accepted Answer

A large volume of traffic is being inspected by IPS, possibly due to a DoS attack.. The ipsengine process handles Intrusion Prevention System (IPS) inspection. High CPU usage by ipsengine typically indicates that the FortiGate is processing a large volume of traffic through IPS signatures, which is computationally intensive. This is often triggered by a DoS attack or a sudden surge in traffic that requires deep packet inspection, overwhelming the CPU.

Answer

The firewall is experiencing a memory leak.

Answer

The antivirus engine is scanning large files.

Answer

There is a routing loop causing packet bouncing.

Question 14

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

Accepted Answer

Ensure that the pre-shared key matches on both sides.. IPsec IKE (Internet Key Exchange) uses the pre-shared key (PSK) during authentication phase 1 (Main Mode or Aggressive Mode). If the PSK does not match on both peers, the IKE SA will fail to establish, and the VPN tunnel will not come up. This is a fundamental prerequisite for any IPsec VPN, and mismatched PSKs are a common misconfiguration.

Answer

Confirm that UDP ports 500 and 4500 are not blocked by any firewall.

Answer

Review the routing table to ensure the remote subnet is reachable through the tunnel interface.

Question 15

A FortiGate administrator sees the following kernel log: 'kernel: [pid 1234] received packet with unknown or unsupported protocol 0x0800 on interface port1, drop'. What does this log indicate?

Accepted Answer

The interface is not configured with an IP address or is in the wrong VDOM.. The kernel log indicates that the interface port1 received an Ethernet frame with EtherType 0x0800 (IPv4) but the FortiGate dropped it because the interface is either not configured with an IP address or is bound to the wrong VDOM. Without an IP address or proper VDOM assignment, the kernel cannot process the packet at Layer 3, so it logs the packet as having an 'unknown or unsupported protocol' even though 0x0800 is standard IPv4.

Answer

The packet is an ARP request that failed.

Answer

The packet has an invalid MAC address.

Answer

The packet has IP options set that are not supported.

Question 16

Based on the debug flow output, what is the reason the packet is dropped?

Accepted Answer

There is no firewall policy that matches the traffic.. The debug flow output indicates that the packet was dropped because no firewall policy matched the traffic. In FortiGate, even if a valid route exists, the packet must be evaluated against firewall policies; if no policy permits the traffic based on source, destination, service, and interface, the packet is silently dropped. The debug flow will show a message like 'no matching policy' or 'deny by policy' in such cases.

Answer

The route to the destination is missing.

Answer

The packet has an invalid source IP address.

Answer

The session table is full.

Question 17

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

Accepted Answer

The service 'HTTP' does not include port 443 or the web application is using HTTPS.. The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.

Answer

The destination address is incorrect.

Answer

The schedule 'always' is not correctly configured.

Answer

The source interface is incorrect.

Question 18

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

Accepted Answer

Traffic from the same source IP arrives on different interfaces for different sessions.. Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.

Answer

The routing table shows multiple equal-cost paths to the same destination.

Answer

Traffic matching a policy is logged as allowed but the application does not work.

Answer

CPU usage is consistently above 90% during peak hours.

Question 19

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

Accepted Answer

The session was created by a local-in traffic (e.g., management traffic) which is not synchronized.. FortiGate A-P clusters synchronize sessions via the HA heartbeat interface, but local-in traffic (e.g., management sessions like HTTPS, SSH, or SNMP) is never synchronized because it is destined to the cluster IP itself and is inherently unit-specific. The 'diagnose sys ha session-sync status' command shows a session count mismatch because the primary unit has local-in sessions that the secondary does not replicate, making D the correct answer.

Answer

The session is using a custom application control profile that prevents synchronization.

Answer

The HA heartbeat interface is down.

Answer

The secondary unit has insufficient memory to accept new sessions.

Question 20

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Accepted Answer

Check the session table for session limits and session congestion.. Intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

Answer

Run a packet sniffer on the FortiGate to capture traffic between the subnets.

Answer

Disable hardware acceleration on the FortiGate.

Answer

Configure SNAT on the policy to translate the source IP.