NSE4 Authentication and VPN Practice Question
You are troubleshooting an SSL VPN connection. The user can reach the SSL VPN portal but cannot ping or access any internal resources. The portal shows the user as authenticated. Which configuration is MOST likely missing?
⚠ Common exam trap
It's easy for candidates to assume authentication success implies full network access, but FortiGate requires an explicit firewall policy for SSL VPN traffic, separate from the authentication and tunnel setup.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
There is no firewall policy allowing traffic from ssl.root to the internal network
The user can authenticate and reach the SSL VPN portal, which indicates that the SSL VPN tunnel itself is established and authentication is successful. However, the inability to ping or access internal resources despite being authenticated points to a missing firewall policy that explicitly permits traffic from the SSL VPN interface (ssl.root) to the internal network. Without this policy, the FortiGate will drop all traffic from the SSL VPN tunnel, even though the user is logged in.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
There is no firewall policy allowing traffic from ssl.root to the internal network
Why this is correct
In Fortinet's SSL VPN design, the SSL VPN interface (typically ssl.root) is just a virtual interface; after authentication, the tunnel is up but traffic is still subject to normal firewall policy checks. Without a policy that matches source ssl.root and destination internal network with the appropriate action (accept), the FortiGate silently drops the packets. Thus users can authenticate and establish the tunnel, but cannot reach internal resources until an explicit policy is created, often with NAT and security profiles as needed.
- ✗
Client certificate authentication is required but not provided
Why it's wrong here
If client certificate authentication is required, the FortiGate would reject the SSL VPN handshake or the user would fail to authenticate before any tunnel is established. Since the user is able to connect (we are troubleshooting traffic flow after successful login), the issue is not at the authentication stage. Therefore this option is wrong; it would manifest as a login failure, not as a connectivity problem after the tunnel is up.
- ✗
Split tunneling is disabled
Why it's wrong here
Split tunneling controls whether the client sends only specific routes over the tunnel (split) or all traffic (full tunnel). When split tunneling is disabled (i.e., full tunnel is in effect), the client sends all traffic through the SSL VPN tunnel, which actually would allow more traffic to the internal network, not block it. The issue here is at the FortiGate firewall policy level, not on the client side. Thus disabling split tunneling would not prevent access; it would direct more traffic into the tunnel.
- ✗
The SSL VPN realm is not configured correctly
Why it's wrong here
The realm is used in the SSL VPN portal URL to select a specific authentication method and portal configuration. If the realm were misconfigured, the user would not be able to access the correct login page or would receive an authentication error. The traffic forwarding after a successful connection is independent of realm settings; realms affect the pre-authentication phase and portal presentation, not how the FortiGate routes traffic from ssl.root to internal networks.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
This NSE4 question is part of Courseiva's 282-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.