NSE4 System and Network Administration Practice Question
An administrator is troubleshooting a FortiGate that is not passing traffic. The policy allows traffic, but the session table shows no sessions. Which THREE steps should the administrator take to diagnose the issue? (Choose three.)
⚠ Common exam trap
Many candidates assume a policy allowing traffic guarantees session creation, but they overlook that the FortiGate must first be able to physically receive and forward the traffic, which depends on interface, ARP, and routing being correctly configured.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Verify the interface status and link state.
If the interface is down or has a link issue, the FortiGate cannot send or receive any traffic, resulting in no sessions being created even if the policy allows traffic. Verifying interface status and link state is a fundamental first step in troubleshooting connectivity issues, as it ensures the physical or logical layer is operational before checking higher-layer configurations.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Verify the interface status and link state.
Why this is correct
Verifying the physical and logical interface state is the first step in any FortiGate connectivity troubleshooting. If the interface is administratively down or the link has no carrier (e.g., bad cable, remote device powered off), all traffic through that interface is dropped regardless of routes or policies. Use `get system interface physical` and `diagnose hardware deviceinfo nic` to confirm link status, speed, and duplex.
- ✗
Run 'diagnose npu np6 show' to check offloading.
Why it's wrong here
The `diagnose npu np6 show` command is designed for FortiGate models equipped with NP6 network processors to inspect offloading counters and performance statistics. It does not diagnose basic connectivity issues like interface state, routing, or ARP resolution, and on non-NP6 models it will error out. Since offloading is a performance optimization rather than a forwarding prerequisite, this command is irrelevant to isolating traffic failures.
- ✓
Check the ARP table to ensure the next-hop MAC is resolved.
Why this is correct
For a FortiGate to forward a packet to a next-hop router, it must first resolve that router's IP address to a MAC address in its ARP cache. If the ARP entry is incomplete or missing—due to a misconfigured gateway, L2 isolation, VDOM issues, or an unresponsive peer—the FortiGate cannot construct the Layer 2 frame and silently drops the packet. Verify with `get system arp` or `diagnose ip arp list` to ensure the next-hop MAC is present and correct.
- ✓
Examine the routing table for the destination network.
Why this is correct
The FortiGate must have an active route in its routing table that matches the destination network to determine the outgoing interface and next-hop IP. If no such route exists—whether static, connected, or learned via dynamic routing—the FortiGate drops the traffic and often sends an ICMP destination unreachable message to the source. Use `get router info routing-table all` or `get route` to confirm a valid path; without a route, no policy can ever match the traffic because the route lookup happens first.
- ✗
Disable the firewall policy and check if traffic flows.
Why it's wrong here
Disabling the firewall policy is a blunt, insecure test that removes the security barrier without revealing the actual root cause. If traffic starts flowing after disabling the policy, the issue might be in policy matching (source/destination, service, schedule), but the problem could also be elsewhere, and disabling the policy would not fix forwarding failures caused by an interface down, missing route, or unresolved ARP. This approach increases risk and provides no diagnostic value; you should first verify the underlying Layer 1 through Layer 3 elements.
Visual reference
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 773-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.