NSE7 Troubleshooting and Diagnostics — Timed 10 Questions

Question 1

A FortiGate administrator notices that traffic from a specific subnet is being dropped unexpectedly. The security policy allows the traffic, and there are no firewall policies blocking it. What is the most efficient first step to identify the cause of the drops?

Accepted Answer

Use the 'diag sniffer packet any "host 10.0.1.0/24" 4' command to capture packets and analyze where they are dropped.. The 'diag sniffer packet any "host 10.0.1.0/24" 4' command captures packets at the kernel level before firewall processing, allowing you to see if traffic is reaching the FortiGate and where it is being dropped (e.g., due to reverse-path forwarding, session helper, or DoS policies). This is the most efficient first step because it provides immediate, low-level visibility into packet drops without requiring configuration changes or waiting for logs.

Answer

Run 'diagnose debug flow' with the source IP and look for 'no matching policy' or 'dropped' messages.

Answer

Enable 'deny-log' on all policies and check logs for the subnet.

Answer

Enable global traffic logging and review logs after some traffic passes.

Question 2

An organization uses FortiGate with OSPF and BGP. Recently, routes from BGP are not being preferred over OSPF routes, causing suboptimal routing. The administrator wants to ensure BGP routes are preferred. Which two actions can achieve this? (Choose two.)

Accepted Answer

Decrease the administrative distance of BGP routes to 5.. Option A is correct because decreasing the administrative distance (AD) of BGP routes to 5 makes them more trustworthy than OSPF routes (default AD 110). Since a lower AD is preferred, BGP routes will be installed in the routing table over OSPF routes, ensuring BGP is preferred for forwarding decisions.

Answer

Configure route-map to set metric to 1 on BGP routes.

Answer

Set a higher weight on BGP routes for the prefixes.

Question 3

A FortiGate is experiencing high CPU usage. The administrator runs 'diagnose sys top' and sees that the process 'ipsengine' is using the most CPU. What is the most likely cause?

Accepted Answer

A large volume of traffic is being inspected by IPS, possibly due to a DoS attack.. The ipsengine process handles Intrusion Prevention System (IPS) inspection. High CPU usage by ipsengine typically indicates that the FortiGate is processing a large volume of traffic through IPS signatures, which is computationally intensive. This is often triggered by a DoS attack or a sudden surge in traffic that requires deep packet inspection, overwhelming the CPU.

Answer

The firewall is experiencing a memory leak.

Answer

The antivirus engine is scanning large files.

Answer

There is a routing loop causing packet bouncing.

Question 4

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

Accepted Answer

Ensure that the pre-shared key matches on both sides.. Option A is correct because IPsec IKE (Internet Key Exchange) uses the pre-shared key (PSK) during authentication phase 1 (Main Mode or Aggressive Mode). If the PSK does not match on both peers, the IKE SA will fail to establish, and the VPN tunnel will not come up. This is a fundamental prerequisite for any IPsec VPN, and mismatched PSKs are a common misconfiguration.

Answer

Confirm that UDP ports 500 and 4500 are not blocked by any firewall.

Answer

Review the routing table to ensure the remote subnet is reachable through the tunnel interface.

Question 5

A FortiGate administrator sees the following kernel log: 'kernel: [pid 1234] received packet with unknown or unsupported protocol 0x0800 on interface port1, drop'. What does this log indicate?

Accepted Answer

The interface is not configured with an IP address or is in the wrong VDOM.. The kernel log indicates that the interface port1 received an Ethernet frame with EtherType 0x0800 (IPv4) but the FortiGate dropped it because the interface is either not configured with an IP address or is bound to the wrong VDOM. Without an IP address or proper VDOM assignment, the kernel cannot process the packet at Layer 3, so it logs the packet as having an 'unknown or unsupported protocol' even though 0x0800 is standard IPv4.

Answer

The packet is an ARP request that failed.

Answer

The packet has an invalid MAC address.

Answer

The packet has IP options set that are not supported.

Question 6

Based on the debug flow output, what is the reason the packet is dropped?

Accepted Answer

There is no firewall policy that matches the traffic.. The debug flow output indicates that the packet was dropped because no firewall policy matched the traffic. In FortiGate, even if a valid route exists, the packet must be evaluated against firewall policies; if no policy permits the traffic based on source, destination, service, and interface, the packet is silently dropped. The debug flow will show a message like 'no matching policy' or 'deny by policy' in such cases.

Answer

The route to the destination is missing.

Answer

The packet has an invalid source IP address.

Answer

The session table is full.

Question 7

An administrator applies the above policy but users from 10.0.1.0/24 cannot access web servers at 10.0.2.0/24. However, they can ping the servers. What is the most likely cause?

Accepted Answer

The service 'HTTP' does not include port 443 or the web application is using HTTPS.. The policy allows HTTP traffic (port 80), but the web servers are likely using HTTPS (port 443). Since the service object 'HTTP' in FortiGate typically only includes TCP/80, HTTPS traffic is denied by default. The administrator can ping the servers because ICMP is permitted by an implicit or explicit policy, confirming that routing and connectivity are functional.

Answer

The destination address is incorrect.

Answer

The schedule 'always' is not correctly configured.

Answer

The source interface is incorrect.

Question 8

A FortiGate is experiencing high latency on traffic passing through it. The administrator suspects that asymmetric routing is occurring. Which TWO symptoms are indicative of asymmetric routing?

Accepted Answer

Traffic from the same source IP arrives on different interfaces for different sessions.. Asymmetric routing occurs when traffic from the same source IP takes different paths through the network, causing packets to arrive on different FortiGate interfaces for different sessions. This breaks stateful inspection because the firewall expects all packets of a session to traverse the same interface; when they don't, it can lead to session timeouts or dropped packets, manifesting as high latency.

Answer

The routing table shows multiple equal-cost paths to the same destination.

Answer

Traffic matching a policy is logged as allowed but the application does not work.

Answer

CPU usage is consistently above 90% during peak hours.

Question 9

A FortiGate cluster (A-P) has a session that is not synchronizing to the secondary unit. The administrator runs 'diagnose sys ha session-sync status' and sees that the session count is different between primary and secondary. Which is the most likely cause?

Accepted Answer

The session was created by a local-in traffic (e.g., management traffic) which is not synchronized.. FortiGate A-P clusters synchronize sessions via the HA heartbeat interface, but local-in traffic (e.g., management sessions like HTTPS, SSH, or SNMP) is never synchronized because it is destined to the cluster IP itself and is inherently unit-specific. The 'diagnose sys ha session-sync status' command shows a session count mismatch because the primary unit has local-in sessions that the secondary does not replicate, making D the correct answer.

Answer

The session is using a custom application control profile that prevents synchronization.

Answer

The HA heartbeat interface is down.

Answer

The secondary unit has insufficient memory to accept new sessions.

Question 10

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

Accepted Answer

Check the session table for session limits and session congestion.. Option B is correct because intermittent connectivity during peak hours strongly suggests session table exhaustion or session congestion. The FortiGate's session table has a finite capacity, and when it fills up, new sessions are dropped, causing timeouts. Checking the session table for limits and congestion is the fastest, least intrusive first step to confirm whether the firewall is running out of session resources before performing more complex diagnostics.

Answer

Run a packet sniffer on the FortiGate to capture traffic between the subnets.

Answer

Disable hardware acceleration on the FortiGate.

Answer

Configure SNAT on the policy to translate the source IP.