NSE7 Advanced VPN and Zero Trust — 10 Questions

Question 1

Refer to the exhibit. A FortiGate administrator has configured an IPsec VPN tunnel to a branch office. The tunnel fails to establish. What is the most likely cause?

Accepted Answer

The phase2 interface name does not match the phase1 name. The tunnel fails because the phase2 interface name does not match the phase1 interface name. In FortiGate IPsec VPN configuration, the phase2 settings must reference the correct phase1 interface. If the names are mismatched, the VPN will not establish. This is a common misconfiguration.

Answer

Phase 2 proposal (aes256-sha1) is not compatible with Phase 1 proposal (aes256-sha256)

Answer

The pre-shared key is encrypted in the configuration

Answer

The 'net-device disable' setting prevents tunnel creation

Question 2

A network admin is configuring a hub-and-spoke ADVPN. The spoke FortiGates are behind NAT. After configuring IKE phase 1 with aggressive mode, the spokes can establish VPN tunnels to the hub, but shortcut tunnels between spokes are not forming. What is the MOST likely cause?

Accepted Answer

The hub FortiGate is not using IKEv2 for the phase 1 configuration. ADVPN shortcut tunnels require IKEv2 to exchange NAT traversal information between spokes. IKEv1 aggressive mode allows spoke-to-hub connectivity but lacks the necessary payloads for the hub to learn the public IP/port of each spoke, which is essential for shortcut tunnel establishment behind NAT.

Answer

The spoke FortiGates are using main mode instead of aggressive mode for IKE phase 1

Answer

The spoke FortiGates have 'set net-device disable' on the phase 1 interface

Answer

The hub FortiGate is not configured with 'set add-route enable' on the phase 1 interface

Question 3

A FortiGate is configured with OSPF over an IPsec VPN tunnel to exchange routes with a remote site. The OSPF neighbor states are stuck in 'INIT' and never progress to 'FULL'. What is the MOST likely cause?

Accepted Answer

OSPF authentication is not configured on both sides. OSPF over IPsec requires careful configuration. When OSPF authentication is enabled on one side but not the other, Hello packets are discarded, preventing neighbor state progression beyond INIT. The correct approach is to ensure authentication settings match on both ends. The other options are less likely: MTU issues typically cause packet fragmentation or loss but not specifically INIT state; phase 2 selectors must include multicast addresses, but that is less common for stuck-in-INIT; hello interval mismatch would cause a different state (typically EXSTART/EXCHANGE).

Answer

The MTU on the VPN interface is too high

Answer

The IPsec phase 2 proposal does not include the OSPF multicast IP address (224.0.0.5)

Answer

The OSPF hello interval is too short

Question 4

You run 'diagnose sys session filter dport 443' and see the following output:
proto=6 proto_state=01 duration=3600 expire=3599
What does this indicate about the traffic?

Accepted Answer

The session is in a half-open state, waiting for SYN-ACK. The output shows `proto=6` (TCP) and `proto_state=01`, which in Fortinet's session table encoding indicates TCP SYN_SENT (half-open state). The session has been in this state for 3600 seconds and expires in 3599 seconds, meaning it is waiting for a SYN-ACK response and has not yet completed the handshake. Therefore, the traffic is in a half-open state.

Answer

The session is being blocked by the firewall

Answer

The session is an established TCP connection

Answer

The session is a UDP connection with a long timeout

Question 5

A FortiGate administrator is configuring OSPF over an IPsec VPN between a hub and a spoke. The OSPF adjacency forms correctly, but routes from the spoke are not being advertised to the hub. The administrator checks the OSPF database on the hub and sees no Type-1 LSAs from the spoke. What is the most likely issue?

Accepted Answer

The OSPF network type is set to broadcast on both ends. The most likely issue is that the OSPF network type is set to broadcast on both ends of the IPsec VPN. In a hub-and-spoke topology, the IPsec tunnel is a point-to-point link, but using the broadcast network type causes OSPF to attempt a DR/BDR election. The spoke typically has only one neighbor, so it cannot become DR, and this can lead to the spoke not advertising its Type-1 LSAs to the hub, even though the adjacency appears to be full. The correct network type for IPsec VPNs is usually point-to-point or point-to-multipoint, which avoids election issues and ensures proper route advertisement.

Answer

The OSPF hello interval is set too high

Answer

The OSPF interface is configured as passive

Answer

The MTU mismatch between the two VPN interfaces

Question 6

A FortiGate administrator needs to ensure that only devices with an updated antivirus can access a sensitive internal application via ZTNA. The administrator has created a ZTNA tag 'AV_Updated' in EMS and configured a ZTNA rule on FortiGate that requires this tag. Which TWO additional steps are necessary to enforce this access control? (Choose two.)

Accepted Answer

Create a firewall policy that references the ZTNA rule. To enforce ZTNA tag-based access, the FortiGate must be configured as an EMS connector and import the ZTNA tag (option D), and the ZTNA rule must be referenced in a firewall policy (option C). Without the firewall policy, the rule is not applied to traffic.

Answer

Configure the application server to use HTTPS

Answer

Enable SSL VPN on the FortiGate for ZTNA traffic

Answer

Install a client certificate on each device for authentication

Question 7

A network administrator is configuring a hub-and-spoke ADVPN with FortiGates. The spokes are behind NAT and use dynamic IPs. The hub has a static IP. Which IKEv2 configuration is REQUIRED to allow the spokes to initiate the VPN and receive shortcut tunnels?

Accepted Answer

Set the phase1 remote-gateway to 0.0.0.0 and enable 'accept-any-remote-gateway' on the hub. In Fortinet ADVPN, spokes behind NAT with dynamic IPs must initiate connections to the hub, and the hub must accept these connections from any source IP. Setting the phase1 remote-gateway to 0.0.0.0 and enabling 'accept-any-remote-gateway' on the hub allows the hub to accept IKE negotiations from any remote gateway, which is required for dynamic spoke IPs. This configuration option (A) correctly satisfies the requirement. Option C is incorrect because the hub's local-gateway interface is configured with its own static IP, not the remote gateway. Option B is invalid because IKEv2 does not support aggressive mode. Option D is not sufficient as the spoke's public IP may change, so setting a fixed local ID would not work for dynamic IPs.

Answer

Set IKE version 2 to aggressive mode to allow rapid negotiation

Answer

Configure the hub with a static IP in the phase1 local-gateway interface

Answer

Use a preshared key and set the local ID to the spoke's public IP

Question 8

An administrator configures OSPF over an IPsec VPN overlay between two FortiGates. The OSPF neighbors show a state of 'EXSTART/EXCHANGE' but never reach 'FULL'. The IPsec tunnel is up and passes ICMP traffic. What is the MOST likely cause?

Accepted Answer

The OSPF hello interval is mismatched. The EXSTART/EXCHANGE state indicates the routers are attempting to exchange OSPF database information. If the OSPF hello intervals are mismatched, the routers may not maintain a stable adjacency even after reaching EXSTART, preventing the transition to FULL. This is because each router expects hello packets at specific intervals; a mismatch can cause the neighbor to be declared dead and reset the adjacency, cycling through states but never reaching FULL.

Answer

The MTU on the tunnel interface is too large

Answer

OSPF is not enabled on the tunnel interface

Answer

The IPsec tunnel is using ESP with authentication

Question 9

A FortiGate administrator is configuring Auto Discovery VPN (ADVPN) in a hub-and-spoke topology. Spokes are FortiGates with dynamic public IPs. Which setting is required on the spoke for it to automatically initiate shortcut tunnels to other spokes when needed?

Accepted Answer

set shortcut-station enable. ADVPN shortcut tunnels require the spoke to be able to initiate shortcut offers. Setting 'set shortcut-station enable' on the spoke's phase1 interface enables the spoke to act as a shortcut station and initiate shortcut tunnels to other spokes. The 'set add-route enable' option only allows the spoke to install routes for shortcuts, but does not enable the initiation process.

Answer

set net-device disable

Answer

set mode aggressive

Answer

set add-route enable

Question 10

A FortiGate administrator configures a ZTNA rule to allow access to an internal application. The rule uses a ZTNA tag to identify the application server. However, users cannot connect to the application. What is the most likely cause if the ZTNA proxy and firewall policies are correctly configured?

Accepted Answer

The user's device posture check fails. In Fortinet's ZTNA, tags are assigned to clients via FortiClient EMS for posture assessment. If the client's device posture check fails, the FortiGate will deny access even if the ZTNA proxy and firewall policies are correctly configured. The ZTNA tag on the application server is used for server identification, not for client access control. Therefore, the most likely cause is that the user's device does not meet security posture requirements.

Answer

The ZTNA tag is not assigned to the application server in FortiClient EMS

Answer

The ZTNA proxy is configured with the wrong port

Answer

The application server does not have FortiClient installed