NSE4 Authentication and VPN Practice Question
You run the following CLI command on a FortiGate: 'diagnose vpn ike config list'. The output includes: 'src 10.0.1.0/24:0 dst 192.168.1.0/24:0'. What does this indicate?
⚠ Common exam trap
Candidates often confuse the 'src' and 'dst' fields in the IKE diagnostic output with firewall policy source/destination, leading candidates to incorrectly select Option A instead of recognizing it as Phase 2 subnet selectors.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The Phase 2 configuration is using 10.0.1.0/24 as local subnet and 192.168.1.0/24 as remote subnet
The 'diagnose vpn ike config list' command displays the Phase 2 configuration for an IPsec VPN tunnel. The output 'src 10.0.1.0/24:0 dst 192.168.1.0/24:0' directly indicates the local and remote subnets defined in the Phase 2 selector, where 'src' is the local subnet and 'dst' is the remote subnet. This confirms that the Phase 2 configuration is using 10.0.1.0/24 as the local subnet and 192.168.1.0/24 as the remote subnet.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The firewall policy is allowing traffic from 10.0.1.0/24 to 192.168.1.0/24
Why it's wrong here
The output from the diagnose command is showing the IKE configuration, which includes phase 1 and phase 2 parameters, not the firewall policy database. Firewall policies are separate objects that match source and destination addresses and are evaluated after the tunnel is established. While 10.0.1.0/24 and 192.168.1.0/24 may be the protected subnets in the VPN, they are acting as the phase 2 proxy IDs, not as a firewall policy allow rule.
- ✓
The Phase 2 configuration is using 10.0.1.0/24 as local subnet and 192.168.1.0/24 as remote subnet
Why this is correct
This statement correctly interprets the diagnostic output: the phase 2 configuration defines the traffic selectors, specifying which local and remote subnets are allowed to communicate through the VPN. In the output, the local quick mode selector is 10.0.1.0/24 and the remote selector is 192.168.1.0/24, meaning that traffic between these subnets will be encrypted. This is a standard site-to-site VPN setup with explicit proxy IDs.
- ✗
The Phase 1 configuration is using 10.0.1.0/24 as local address
Why it's wrong here
Phase 1 configuration establishes the IKE security association and identifies the tunnel endpoints by their interface IP addresses, not by internal LAN subnets. An IKE gateway uses the WAN IP or a specified local address (the interface IP), whereas the local subnet like 10.0.1.0/24 is relevant only at the phase 2 (IPsec SA) level. Therefore, stating that phase 1 uses 10.0.1.0/24 as the local address is a misplacement of the subnet as a tunnel endpoint.
- ✗
The tunnel is in dial-up mode with dynamic remote subnet
Why it's wrong here
In a dial-up IPsec tunnel, the remote peer address is dynamic or undefined, and the remote subnet is often left as 0.0.0.0/0 to accept any remote selector. Since the configuration explicitly shows 192.168.1.0/24 as a specific remote subnet (or wildcard), this indicates a site-to-site tunnel with a static remote network, not a dial-up setup. The presence of a precisely defined remote selector rules out dynamic remote subnet behavior.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 773 original NSE4 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE4 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE4 exam.