NSE 7 - Enterprise Firewall (NSE7_EFW) (NSE7_EFW) — Questions 151–204

The Read_Only administrative profile in FortiManager allows users to view configurations, policies, and device status without the ability to make any modifications. This aligns perfectly with the requirement for a user who should only monitor and not change anything.

This command displays the routing table entry that would be used for a specific destination IP. It shows the next-hop, interface, and other details. By specifying the remote subnet's IP, you can verify that the route points to the IPsec tunnel interface. If the route is missing or incorrect, traffic will not pass. This is the correct command to diagnose routing issues for VPN traffic.

In dial-up IPsec VPNs, the FortiGate must assign IP addresses to clients so that they can be routed on the internal network. Without mode-cfg, clients may establish the tunnel but have no IP address, preventing proper routing. Enabling mode-cfg in phase 1 allows the FortiGate to act as a DHCP-like server for the VPN clients, ensuring their traffic is sourced from a known subnet that can be routed.

A normalized interface is a logical placeholder in FortiManager that maps to a specific physical interface on each managed FortiGate through per-device mapping. Defining the policy against the normalized interface lets FortiManager substitute port1 on one device and wan1 on another during install, which is exactly the cross-device abstraction this scenario requires.

After assigning IP addresses to VPN clients, a firewall policy is needed to permit traffic from the VPN tunnel interface to the internal network. The policy should specify the source as the assigned IP range (or the VPN interface) and the destination as internal resources. Without this policy, the FortiGate will drop the traffic by default, even though the tunnel is up and clients have IP addresses. This is a fundamental step in VPN configuration.

Transparent mode requires a management IP address so the FortiGate can be reached for administration, DNS, and FortiGuard updates. Configuring 10.10.10.1 with the correct mask and a default gateway on the management interface allows the unit to be managed while still forwarding user traffic transparently between the internal and external segments.

Service objects define protocols and port ranges referenced by firewall policies, and FortiManager installs them with the package so rules resolve correctly on the managed FortiGate. They satisfy the package contents requirement alongside address objects and policies.

The installation preview shows the exact commands that will be sent to the device, allowing the administrator to verify the changes. This helps identify unintended modifications and ensures that only the desired changes are applied. It is a crucial step to avoid downtime and misconfigurations.

VLAN sub-interfaces carry 802.1Q tags, letting a single physical interface present distinct Layer 2 segments that are bound to separate VDOMs. This tag-based separation keeps each VDOM's traffic isolated, achieving traffic separation without dedicating a physical port per VDOM.

HTTPS encrypts the management session, and Trusted Hosts restricts which source addresses may connect, satisfying the requirement for the most secure remote administration. This combination blocks unencrypted access and limits exposure to approved administrative subnets.

Phase 2 negotiates the encryption and authentication parameters, including the proxy IDs and subnet selectors. If the local and remote quick-mode selectors differ, the tunnel proposal is rejected and Phase 2 never reaches the up state.

Setting the action to 'Monitor' allows the traffic to pass but logs the event when the signature matches. This helps in identifying false positives without blocking legitimate traffic. By monitoring, the administrator can review logs, tune the signature, and later decide to block if appropriate. This is the recommended approach for signatures that are known to cause false positives, as it balances security and availability.

UDP 4500 carries ESP packets encapsulated inside UDP datagrams, which is what NAT-Traversal requires. Because NAT devices cannot translate ESP (IP protocol 50) reliably, wrapping it in UDP 4500 lets the traffic traverse NAT boundaries while preserving confidentiality and integrity. This directly satisfies the NAT-T constraint in the stem.

Configuration drift occurs when changes are made directly on the FortiGate device, either through CLI or GUI, without updating FortiManager. FortiManager is the central management point, and direct changes can cause the device configuration to differ from the policy package. To prevent drift, all changes should be made through FortiManager. The other options do not typically cause drift.

When the FortiGate performs SSL inspection, it intercepts the SSL connection and re-signs the server's certificate with its own CA certificate. For clients to trust this re-signed certificate and avoid errors, the FortiGate's SSL inspection CA certificate must be installed as a trusted root on the client devices.

Administrative profiles in FortiManager define granular permissions, including which ADOMs a user can access and what actions they can perform within those ADOMs. By creating a profile that grants read-write access to the specific ADOM and includes permissions for policy editing and installation, while omitting ADOM-level configuration rights, the administrator can delegate exactly the required capabilities without over-provisioning access.

An IPS sensor override lets you disable or set the specific signature to monitor-only for the targeted server, clearing the false positive without weakening protection from other signatures. This is narrower than editing the whole profile, satisfying the requirement to maintain security while resolving the drop efficiently.

Provisioning Templates in FortiManager allow administrators to define a model device with pre-configured settings such as management IP, admin credentials, and firewall policies. This is ideal for zero-touch provisioning of remote devices that lack direct internet access, as the configuration can be prepared in advance and installed once the device connects to the manager.

Switching to multi-vdom restructures the CLI command hierarchy, requiring `config vdom` before VDOM-specific commands such as firewall policy and routing. This directly satisfies the stem's constraint that the global setting alters system-wide CLI behaviour, since administrators must now enter a VDOM context to configure interfaces, policies and routing objects.

FortiGuard delivers continuously updated signatures, IP reputations and category databases to the FortiGate, enabling real-time enforcement against emerging threats without manual intervention. This satisfies the stem's requirement for live threat intelligence, since detection depends on current data rather than static, locally maintained definitions that age quickly.

The 'Replace Object' feature in FortiManager allows administrators to replace an object (such as a security profile) with another object throughout the policy package. This efficiently updates all policies that reference the old profile, ensuring consistency and saving time. It is the intended tool for bulk object replacement in policy packages.

FortiGate HA supports a virtual MAC address feature that assigns a common MAC to the cluster interfaces. This prevents ARP cache inconsistencies on switches during failover, as the MAC remains the same regardless of which unit is active.

The 'diagnose sys top' command displays real-time CPU and memory usage of processes running on the FortiGate. By default, it shows the top processes, and the IPS engine typically appears as 'ipsengine'. This allows the administrator to confirm if the IPS engine is consuming high CPU. The command can be sorted by CPU usage to quickly identify the culprit.

This is correct because the Installation Preview shows the CLI commands that will be applied to the FortiGate, including any object creation. If a duplicate object exists, the preview will display the conflicting command, allowing the administrator to pinpoint the issue. This is the most direct way to diagnose installation errors related to object conflicts.

A member is a logical grouping that bundles multiple physical interfaces, allowing SD-WAN rules and health checks to reference the group rather than individual links. This abstraction satisfies the stem's question about how member configuration relates to the underlying physical interfaces.

Policy Check is a FortiManager feature that validates firewall policies against a set of predefined or custom rules to ensure compliance and best practices. It can be run manually or automatically before installation. By configuring Policy Check, the administrator can enforce corporate security standards and prevent non-compliant policies from being deployed, thus meeting the requirement for automatic validation.

FortiGates can be configured with a single FortiManager IP or FQDN. If they are set to the primary's IP only, after failover the secondary takes over the primary's IP, so connectivity should be maintained if the IP is virtual. However, if the FortiGates are configured with the physical IP of the primary and the secondary uses a different IP, they will not reconnect. The typical HA setup uses a virtual IP that moves, but misconfiguration can cause this.

Policy packages are ADOM-specific. A policy package created in one ADOM cannot be installed on a device in another ADOM. Therefore, the FortiGate must reside in the same ADOM as the policy package. This is a fundamental requirement for installation; otherwise, the package will not be available for that device.

Compression reduces the on-disk footprint of each log record before it is written, so higher compression ratios store more events per gigabyte. This directly governs how efficiently FortiAnalyzer and FortiManager consume available storage, making it a primary factor in log storage efficiency.

Provisioning Templates in FortiManager allow administrators to define system-level settings, including NTP servers, and apply them to multiple devices. By creating a system template with the required NTP servers and assigning it to all devices in the ADOM, the administrator ensures consistent configuration across all FortiGates with minimal effort. This is the intended use case for provisioning templates.

OFTP (FortiGate-FortiAnalyzer protocol) over TLS is the secure method for log transmission between FortiGate and FortiAnalyzer. It uses TLS encryption to protect the data in transit and allows the FortiGate to verify the FortiAnalyzer's certificate, ensuring authenticity. This meets both security and identity verification requirements.

Tunnel-mode SSL VPN presents a portal over TLS, so clients validate the server's identity. A valid SSL certificate, trusted by the client and matching the portal's FQDN, is required; otherwise browsers and FortiClient reject the connection before the tunnel establishes.

The aggregate-address command with summary-only suppresses advertisement of the more specific component routes, so the ISP receives only the aggregate. This satisfies the requirement to advertise the summary route alone rather than leaking the contributing prefixes.

When a FortiGate is managed by FortiManager, direct configuration changes on the FortiGate (via CLI or GUI) can cause the device to become out of sync with FortiManager. FortiManager detects these changes and flags the device as out of sync. The administrator must then import the changes or re-install the FortiManager configuration to restore synchronization.

The antivirus profile scans files for viruses and malware. To inspect files transferred over HTTP, the firewall policy must have an antivirus profile applied and deep inspection enabled for the protocol. This allows the FortiGate to extract and scan the files before delivering them to the client, blocking malicious content.

In transparent mode, the FortiGate acts as a Layer 2 bridge, but it still requires a management IP address to be reachable for administrative access. This IP is assigned to a VDOM and HTTPS access must be enabled on the interface connected to the management network.

A route map attached to the OSPF redistribute command filters which connected routes are advertised, matching only the specified subnet. This satisfies the constraint of redistributing connected routes selectively rather than all of them, which a plain redistribute statement cannot achieve.

Traffic shaping enforces a guaranteed bandwidth and allows bursting up to a maximum bandwidth when excess capacity is available. This matches the requirement to guarantee 2 Mbps for SIP while permitting bursts up to 4 Mbps. It also allows unused bandwidth to be shared, which is exactly what the administrator needs for the VoIP VLAN.

OFTP (FortiGate's proprietary log transfer protocol) is used for secure log transmission to FortiAnalyzer. It encrypts logs using SSL/TLS and ensures integrity. This is the recommended protocol when encryption is required, as it provides a secure channel. Configuring log forwarding to use OFTP involves specifying the FortiAnalyzer IP and enabling encryption, which is the default behavior for OFTP.

`diagnose sys top` lists live processes with their CPU and memory percentages, letting you confirm whether the IPS engine (`ipsengine`) is consuming excessive CPU. This directly satisfies the stem's requirement to identify the process responsible for high CPU usage on the FortiGate.

Session pickup (also known as session synchronization) ensures that session state information is synchronized between HA nodes. When enabled, the primary unit sends session data to the secondary unit, allowing the secondary to maintain existing sessions if a failover occurs. This minimizes disruption because established sessions can continue without requiring re-establishment. This is the correct setting to achieve the requirement.

In transparent mode, the FortiGate forwards traffic at Layer 2, so a firewall policy must permit traffic between the two interfaces without NAT. The policy action ACCEPT allows the traffic to pass, and NAT must remain disabled because the FortiGate does not modify IP addresses in transparent mode. This is the correct step to restore connectivity.

NAT traversal (NAT-T) enables the FortiGate to encapsulate IKE and ESP packets within UDP datagrams, allowing the VPN to pass through NAT devices. This is the correct setting to ensure the tunnel can be established when the client is behind NAT. It is configured in the phase 1 settings and is essential for dial-up VPNs where clients may be behind NAT.

To exempt specific sites from SSL inspection, you can create a firewall policy that matches the destination address of the banking site and set the SSL inspection profile to 'no-inspection'. This allows the traffic to pass without deep inspection, so the FortiGate does not re-sign the certificate, and the browser sees the original certificate, eliminating the warning. This is a common practice for sites that use certificate pinning or are sensitive.

This command uses the FortiGate CLI syntax to back up the configuration to a TFTP server. The filename is specified first, followed by the server IP address. It is the correct way to create a configuration backup over TFTP from the CLI, which is exactly what the administrator needs before making changes.

FortiGate processes policies top-down and, absent any matching explicit rule, applies the built-in implicit deny that drops the traffic. This default satisfies the scenario's constraint of no explicit policy matching, ensuring unmatched sessions are blocked rather than permitted.

In transparent mode, the FortiGate still enforces firewall policies. Traffic between interfaces (even in the same subnet) must be explicitly allowed by a security policy. If no policy permits internal-to-external traffic, the implicit deny will block internet access while internal traffic might be allowed by a different policy.

RADIUS is a supported remote authentication protocol on FortiGate, letting the firewall forward user credentials to an external RADIUS server for validation. This satisfies the question's requirement for a valid user authentication method, alongside local and LDAP or TACACS+ options.

The SSL inspection profile includes an exemptions list where you can specify destination addresses or wildcard FQDNs that should not be inspected. Adding banking websites to this list ensures their traffic is not decrypted, preserving privacy. This is the correct method to bypass SSL inspection for specific destinations.

DPD is used to detect if the remote peer is no longer responding. By enabling DPD and configuring appropriate intervals, the FortiGate can quickly detect a failure and tear down the tunnel or renegotiate, allowing for faster recovery. This directly addresses the requirement for quick recovery from network disruptions.

The 'NO_PROPOSAL_CHOSEN' error indicates that the two peers cannot agree on a phase 2 proposal. This typically occurs when the encryption algorithms, authentication algorithms, or perfect forward secrecy (PFS) settings do not match. Ensuring both sides have identical phase 2 proposals will allow the tunnel to establish successfully.

CP offloading assigns SSL inspection processing to dedicated hardware acceleration on the appliance, freeing CPU cycles for other security tasks. This satisfies the requirement to offload SSL inspection to hardware rather than performing it in software on the general-purpose processor.

ADOM-level objects are specific to an ADOM and can be used by all devices within that ADOM. They provide a common set of objects while still allowing devices to have their own local objects. This meets the requirement of sharing objects within the ADOM without affecting other ADOMs or preventing device-specific objects.

If Workspace mode is enabled, changes are saved in a workspace and must be approved and installed. Even if an install is triggered, unapproved changes are not included. The engineer should check if the policy change is pending approval in the workspace. This is a common oversight when multiple administrators manage the same ADOM.