NSE4 Authentication and VPN Practice Question
A FortiGate administrator has configured a hub-and-spoke IPsec VPN. The hub FortiGate has two Phase 2 selectors with spokes, but traffic between spokes is not routed via the hub. What must be configured on the hub to allow spoke-to-spoke communication?
⚠ Common exam trap
Watch out — candidates often assume spoke-to-spoke communication requires only Phase 2 selectors to be configured, but they overlook the need for the hub to have routes to both spoke subnets, which 'add-route' provides automatically.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Enable 'add-route' on the hub Phase 2
In a hub-and-spoke IPsec VPN, the hub FortiGate must have 'add-route' enabled on its Phase 2 selectors to automatically install routes for the spoke subnets into its routing table. Without this, the hub knows how to reach each spoke but does not have routes to forward traffic between spokes, so spoke-to-spoke traffic is dropped. Enabling 'add-route' on the hub's Phase 2 configurations ensures the hub learns the remote subnets and can route traffic between spokes.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Set the hub as the default gateway on each spoke
Why it's wrong here
Setting the hub as the default gateway on each spoke would indeed force all non-local traffic to the hub, but the hub must have specific routes to the destination spoke subnets and matching Phase 2 selectors to forward it. Without those, traffic is silently dropped or blackholed. This also undesirably hairpins internet-bound traffic through the hub, creating a bottleneck and potential policy violations, so it is not the correct fix.
- ✗
Use policy-based VPN instead of route-based
Why it's wrong here
Policy-based VPNs and route-based VPNs can both support hub-and-spoke topologies if configured correctly; the fundamental issue here is not the VPN mode but the lack of routing information on the hub. In a policy-based VPN, traffic selection is tied to firewall policies that still require proper Phase 2 selectors and, additionally, do not automatically create routes. Switching modes would not resolve the missing routes or selector mismatches, so this is a distraction.
- ✗
Configure NAT on the hub
Why it's wrong here
NAT on the hub would modify the source or destination addresses of packets, which is not needed for pure routing between spokes and would likely break end-to-end connectivity. Since the core problem is that the hub has no route to the remote spoke subnets, NAT cannot help—the packets are discarded because the hub does not know where to send them. Implementing NAT would introduce complexity and force you to create exceptions, making the issue worse.
- ✓
Enable 'add-route' on the hub Phase 2
Why this is correct
Enabling 'add-route' on the hub's Phase 2 configuration is the correct solution because it instructs FortiGate to automatically install static routes for each spoke's protected subnet via the respective IPsec tunnel interface. With these routes in place, when the hub receives traffic from one spoke destined for another spoke, it can route the packets out the appropriate tunnel. This eliminates the need for manual static routes or a dynamic routing protocol and is the intended method for simple hub-and-spoke IPsec VPNs.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE4 question from scratch — 282 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.