CCNA System Configuration Questions

The 'set allowaccess' command on an interface controls which management protocols are enabled. By enabling only SSH and SNMP, other protocols are blocked. Additionally, trusted hosts on administrator accounts restrict SSH access to specific IPs. For SNMP, the community string and allowed hosts can be configured separately.

Even in transparent mode, firewall policies are required to permit traffic between interfaces. The FortiGate acts as a Layer 2 bridge, but security inspections (AV, IPS, etc.) are applied via firewall policies. Without policies allowing traffic from the internal interface to the external interface, traffic will be blocked, and no inspection will occur.

Link monitors (also called link health monitors) can detect when a next-hop is unreachable. By enabling 'update-static-route', the FortiGate will remove static routes that use the monitored interface or next-hop when the link monitor fails. This ensures the route is withdrawn if the next-hop becomes unreachable.

Session pickup enables the primary unit to synchronize session state to the backup, so established TCP sessions can continue after a failover. Without it, the new primary would not know about existing connections and would drop them. This directly addresses the requirement for session continuity during an HA failover.

Inter-VDOM links create a virtual point-to-point interface pair between the two VDOMs. Assigning a unique transfer subnet allows routing between them, and firewall policies in both the IT and Mgmt VDOMs control the permitted TCP 514 traffic. This preserves isolation because no other traffic can cross without explicit policies.

802.3ad Aggregate bundles multiple physical interfaces into a single logical link, providing Layer 2 redundancy and increased throughput. If one member link fails, traffic continues over the remaining links, satisfying the stem's requirement for redundancy at Layer 2. This differs from Layer 3 redundancy mechanisms such as VRRP, which operate on IP addresses rather than interface aggregation.

This is the correct configuration. The redundant interface acts as a single logical interface, and the IP address is assigned to it. The physical member interfaces are enslaved and do not have IP addresses. Failover occurs automatically if one member fails.

To handle return traffic, 'vdom1' needs a route to send internet-bound traffic to 'root' via an inter-VDOM link. 'root' then routes to the internet. Firewall policies must allow traffic from 'vdom1' to 'root' and from 'root' to the internet. This ensures that the server's return traffic is correctly forwarded through the VDOMs, maintaining the VIP in 'root'.

Multi-VDOM mode allows interfaces to be assigned to VDOMs and supports creating subinterfaces within the same VDOM. The correct sequence is to assign the physical interface first, then create the VLAN subinterface under that interface while operating in the 'internal' VDOM context. This provides proper isolation and management.

In transparent mode, the FortiGate operates as a layer 2 bridge, forwarding frames based on MAC addresses. It inspects the traffic but does not perform NAT or routing, so IP addresses remain unchanged. This allows the FortiGate to be inserted into an existing network without changing IP addressing schemes, which is the desired behavior.

This command displays the checksums of the configuration for each HA cluster member. By comparing the checksums, the administrator can identify if the configurations are out of sync. It is the correct tool for verifying HA synchronization status.

FortiOS evaluates firewall policies sequentially from the top of the list to the bottom. The first policy that matches the traffic's source, destination, service, and other criteria is applied, and no further policies are evaluated. Therefore, more specific policies should be placed above more general ones to ensure they are matched first.

A multi-VDOM interface is a special interface type that can be assigned to multiple VDOMs simultaneously. Each VDOM gets its own logical instance of the interface, with separate IP addresses and routing. This is the intended FortiOS feature for sharing a single physical port across VDOMs.

The command 'execute backup config usb' is used to back up the current configuration to a USB drive connected to the FortiGate. This command is available in the CLI and will save the configuration file to the USB storage. It is the correct method for backing up to USB, provided the USB drive is properly formatted and inserted. This meets the administrator's requirement.

Inter-VDOM links create a dedicated virtual interface pair connecting two VDOMs, enabling traffic to route and be inspected by firewall policies between them. This satisfies the requirement to inspect inter-VDOM traffic, since VDOMs otherwise remain isolated and cannot pass traffic for policy enforcement without such a link.

User certificates are stored within the FortiGate configuration file, including imported local certificates and their associated private keys used for VPN or inspection. They are therefore captured in configuration backups and restored alongside other settings.

By default, administrative access protocols are disabled on WAN interfaces for security. Enabling HTTPS administrative access on the WAN interface specifically allows remote management via HTTPS. This is a deliberate configuration step that must be performed, and it is often combined with restricting trusted hosts to limit exposure.

This command displays sessions that are offloaded to the NP6 processor. It provides details such as the session ID, protocol, and offload status. This is the most direct way to verify which sessions are being accelerated by the NP6 and thus bypassing the CPU. The administrator can use this to confirm if traffic is offloaded and troubleshoot why security profiles are not applied.

In a VDOM-enabled FortiGate, administrator accounts can be bound to individual VDOMs, limiting each admin's visibility and configuration rights to those virtual domains. This scoping satisfies the stem's requirement for how accounts are managed across multiple VDOMs.

Switching from no-vdom to multi-vdom restructures the entire configuration into multiple virtual domains, a fundamental change to how policies, interfaces and routing are stored, so FortiGate requires a reboot before the new mode takes effect.

This command sequence enables logging to FortiAnalyzer and specifies the server IP address. It is the correct syntax under the 'config log fortianalyzer setting' context. The 'set status enable' activates the feature, and 'set server' defines the FortiAnalyzer's IP.

Link aggregation distributes traffic based on a hashing algorithm, which typically uses source and destination IP addresses, and sometimes Layer 4 ports. If the traffic is a single flow (same source and destination IP and ports), all packets will hash to the same link, causing imbalance. This is a common limitation of link aggregation; it does not load-balance per-packet but per-flow. To achieve better distribution, multiple flows with varying IPs/ports are needed.

The command get router info routing-table all displays the complete routing table, and when executed within a specific VDOM context it returns that VDOM's routes. This satisfies the requirement to view the current routing table for a specific VDOM rather than the management or global routing instance.

SSL/TLS decryption and deep inspection are CPU-intensive tasks that are not offloaded to the NP6 processor. The NP6 handles basic firewall functions like forwarding, NAT, and some IPS, but encrypted traffic must be decrypted and inspected by the CPU. This can cause significant CPU load, especially with high volumes of HTTPS traffic.

Release notes document the supported upgrade path, firmware compatibility, and known issues for the target FortiOS version. Reviewing them before upgrading confirms the HA cluster can move between versions without breaking synchronisation or clustering behaviour.

FortiGate always uses the CPU for the first packet to perform routing, policy lookup, and session creation. Only after the session is established is it offloaded to the NP6. The administrator's observation is correct and expected; no configuration change is needed. This is a core concept of NP offload architecture.

In transparent mode, broadcast forwarding is a global setting that, when enabled, allows the FortiGate to forward broadcast packets received on one interface to all other interfaces except the ingress interface. This is essential for protocols like DHCP to function across the FortiGate. The setting is found under System > Network > Interfaces, but it applies globally to all interfaces. This matches the requirement to allow DHCP broadcasts.

A VDOM link is a virtual point-to-point connection internal to the FortiGate. Assigning each end to a VDOM and adding policies that reference the vlink interfaces enables direct inter-VDOM routing without external hardware. This is the standard method to allow traffic between VDOMs on the same device.

This is correct because a VDOM link is a virtual point-to-point connection that connects two VDOMs. You must assign IP addresses to both ends of the link, then create firewall policies in each VDOM to allow traffic to traverse the link. This allows the 'root' VDOM to inspect the traffic with its own policies, satisfying the requirement.

Virtual MAC configuration lets an HA cluster present a single shared MAC address for its interfaces, so switches and hosts keep a consistent ARP mapping during failover. This prevents stale ARP cache entries pointing at the failed node, satisfying the stated requirement.

A VDOM link creates a virtual point-to-point connection between two VDOMs. Traffic traversing this link can be inspected by firewall policies applied to the link's interfaces, enabling security profiles. This is the standard method for inter-VDOM inspection.

Inter-VDOM links are virtual point-to-point interfaces that allow traffic to be routed between VDOMs within the same FortiGate. By creating a pair of IVLs and assigning IP addresses, the FortiGate can apply security policies between the VDOMs. This is the standard method for inter-VDOM routing and inspection.

Active session tables synchronise between HA members so that established flows continue uninterrupted after a failover, satisfying the requirement for session continuity. FortiGate HA replicates session state across the heartbeat link, letting the secondary device forward existing traffic without re-establishing connections when it assumes the primary role.

The 'config system global' command enters the global system configuration mode. Within this mode, you can set the hostname with 'set hostname', configure the administrative timeout with 'set admintimeout', and enable SSH on interfaces using 'set ssh-port' and other related settings. This is the correct starting point for these global system parameters.

Interface IP addresses and static routes are core network settings that must match across HA nodes. They are synchronized by default to ensure that after a failover, the new primary unit can immediately forward traffic using the same addressing and routing information without manual reconfiguration.

Dedicated HA interfaces carry only synchronisation and heartbeat traffic between cluster members, keeping it off the data plane. This prevents production throughput from delaying or dropping heartbeat packets, satisfying the requirement for reliable failover detection without contending with user traffic.

To send alert emails, the FortiGate must be configured with an SMTP server address, port, and authentication if required. This is done under System Settings > Alert Email. Without a valid SMTP server, the FortiGate cannot send emails. The administrator must also specify sender and recipient addresses, but the SMTP server is the essential first step.

The command 'execute backup config usb <filename>' correctly backs up the current configuration to a USB drive with the specified filename. This is the standard CLI syntax for backing up the configuration to an external USB device. The administrator must provide a filename, and the backup will be saved in the root directory of the USB drive.

In FortiGate HA, override is disabled by default, so a rebooted or recovered unit does not automatically reclaim the primary role. This satisfies the stem's default-behaviour constraint: priority values are ignored unless override is enabled, preventing unnecessary failovers and keeping the currently active primary stable.

The read_only administrator profile is a built-in profile that allows users to view configuration and monitor system status but prevents any changes. It is exactly designed for users who need to observe without modifying. Assigning this profile ensures the account can only view logs and status, meeting the requirement.

A redundant interface must have at least one physical member interface assigned. Without members, the interface has no active link and cannot pass traffic. The 'set member' command under the redundant interface configuration adds physical interfaces to the group, enabling failover and traffic forwarding.

In transparent mode the FortiGate forwards frames by MAC address without routing. When the destination MAC is unknown, it floods the frame out all ports except the ingress port, exactly as a learning bridge does, until the address is learned.

Transparent mode requires a management IP address so the FortiGate can be reached for administration, DNS, and FortiGuard updates. Configuring 10.10.10.1 with the correct mask and a default gateway on the management interface allows the unit to be managed while still forwarding user traffic transparently between the internal and external segments.

VLAN sub-interfaces carry 802.1Q tags, letting a single physical interface present distinct Layer 2 segments that are bound to separate VDOMs. This tag-based separation keeps each VDOM's traffic isolated, achieving traffic separation without dedicating a physical port per VDOM.

Switching to multi-vdom restructures the CLI command hierarchy, requiring `config vdom` before VDOM-specific commands such as firewall policy and routing. This directly satisfies the stem's constraint that the global setting alters system-wide CLI behaviour, since administrators must now enter a VDOM context to configure interfaces, policies and routing objects.

FortiGate HA supports a virtual MAC address feature that assigns a common MAC to the cluster interfaces. This prevents ARP cache inconsistencies on switches during failover, as the MAC remains the same regardless of which unit is active.

The 'diagnose sys top' command displays real-time CPU and memory usage of processes running on the FortiGate. By default, it shows the top processes, and the IPS engine typically appears as 'ipsengine'. This allows the administrator to confirm if the IPS engine is consuming high CPU. The command can be sorted by CPU usage to quickly identify the culprit.

A member is a logical grouping that bundles multiple physical interfaces, allowing SD-WAN rules and health checks to reference the group rather than individual links. This abstraction satisfies the stem's question about how member configuration relates to the underlying physical interfaces.

OFTP (FortiGate-FortiAnalyzer protocol) over TLS is the secure method for log transmission between FortiGate and FortiAnalyzer. It uses TLS encryption to protect the data in transit and allows the FortiGate to verify the FortiAnalyzer's certificate, ensuring authenticity. This meets both security and identity verification requirements.

In transparent mode, the FortiGate acts as a Layer 2 bridge, but it still requires a management IP address to be reachable for administrative access. This IP is assigned to a VDOM and HTTPS access must be enabled on the interface connected to the management network.

Traffic shaping enforces a guaranteed bandwidth and allows bursting up to a maximum bandwidth when excess capacity is available. This matches the requirement to guarantee 2 Mbps for SIP while permitting bursts up to 4 Mbps. It also allows unused bandwidth to be shared, which is exactly what the administrator needs for the VoIP VLAN.

OFTP (FortiGate's proprietary log transfer protocol) is used for secure log transmission to FortiAnalyzer. It encrypts logs using SSL/TLS and ensures integrity. This is the recommended protocol when encryption is required, as it provides a secure channel. Configuring log forwarding to use OFTP involves specifying the FortiAnalyzer IP and enabling encryption, which is the default behavior for OFTP.

`diagnose sys top` lists live processes with their CPU and memory percentages, letting you confirm whether the IPS engine (`ipsengine`) is consuming excessive CPU. This directly satisfies the stem's requirement to identify the process responsible for high CPU usage on the FortiGate.

Session pickup (also known as session synchronization) ensures that session state information is synchronized between HA nodes. When enabled, the primary unit sends session data to the secondary unit, allowing the secondary to maintain existing sessions if a failover occurs. This minimizes disruption because established sessions can continue without requiring re-establishment. This is the correct setting to achieve the requirement.

In transparent mode, the FortiGate forwards traffic at Layer 2, so a firewall policy must permit traffic between the two interfaces without NAT. The policy action ACCEPT allows the traffic to pass, and NAT must remain disabled because the FortiGate does not modify IP addresses in transparent mode. This is the correct step to restore connectivity.

This command uses the FortiGate CLI syntax to back up the configuration to a TFTP server. The filename is specified first, followed by the server IP address. It is the correct way to create a configuration backup over TFTP from the CLI, which is exactly what the administrator needs before making changes.

CP offloading assigns SSL inspection processing to dedicated hardware acceleration on the appliance, freeing CPU cycles for other security tasks. This satisfies the requirement to offload SSL inspection to hardware rather than performing it in software on the general-purpose processor.