NSE4 Authentication and VPN Practice Question
A FortiGate is configured in an HA active-passive cluster. When the active unit fails, the passive unit takes over, but IPsec VPN tunnels fail to re-establish. The configuration is synchronized. What is the most likely cause?
⚠ Common exam trap
It's easy for candidates to assume configuration synchronization covers all aspects of VPN operation, overlooking that IPsec tunnels bind to physical interface IPs by default unless explicitly configured with a virtual IP or floating address.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The IPsec VPN is using the physical interface IP instead of a virtual IP (VIP) or floating IP.
In an HA active-passive cluster, IPsec VPN tunnels typically bind to the physical interface IP address. When failover occurs, the passive unit assumes the cluster's virtual MAC and IP addresses, but the IPsec tunnel endpoints remain tied to the original physical IP. Since the new active unit has a different physical interface IP, the remote peer sees a mismatched source address and drops the connection. Using a virtual IP (VIP) or floating IP ensures the tunnel endpoint stays consistent across failover.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The pre-shared key is different on the two units.
Why it's wrong here
In an active-passive HA configuration, all settings including IPsec VPN pre-shared keys are replicated from the primary to the secondary unit, so the keys always match. A PSK mismatch would cause IKE authentication failures immediately when the tunnel is negotiated, not specifically after a failover event. Given that the tunnel works before failover and only breaks afterward, the pre-shared key is definitely not the culprit.
- ✗
The firewall policies for VPN traffic are not synchronized.
Why it's wrong here
Firewall policies are part of the synchronized configuration in a FortiGate HA cluster, so both units have identical security policies and address objects. The issue in this scenario is that the IPsec tunnel itself fails to re-establish after failover, which points to an addressing or endpoint problem, not a missing or mismatched policy. Even if all policies are correct, the tunnel cannot come up if the local IP address used for IPsec is not reachable or consistent.
- ✗
The HA heartbeat interface is down.
Why it's wrong here
The HA heartbeat interface is responsible for detecting a unit failure and triggering the failover process. If that interface were down, the cluster would either not fail over at all or experience a split-brain condition, not a clean failover with broken tunnels. Since the failover did occur and the problem is IPsec tunnels failing afterward, the heartbeat interface is functioning correctly.
- ✓
The IPsec VPN is using the physical interface IP instead of a virtual IP (VIP) or floating IP.
Why this is correct
In an active-passive HA pair, the physical interface IP address is owned by the active unit only, and when failover occurs the new active unit uses its own physical IP, which differs from the previous one. IPsec tunnels identify peers by IP address during IKE phase 1 and phase 2, so any change in the local endpoint breaks the existing SAs and prevents new ones from being established. Configuring a virtual IP or floating IP for the IPsec endpoint ensures the address stays constant across failover, allowing the tunnel to survive the transition.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 282 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.