Security And VPN practice questions

set metric-type

Why it fails: Metric-type is used for external route types.

set bandwidth-reference

Why it fails: This affects the global cost calculation, not interface-specific cost.

set priority

Why it fails: Priority is used for DR/BDR election.

Weight

Why it fails: Weight is a Cisco-proprietary attribute and not native to standard BGP on FortiGate.

AS-Path

Why it fails: AS-Path is typically used to influence inbound traffic influence from others.

Multi-Exit Discriminator (MED)

Why it fails: MED influences inbound traffic for external peers.

Firewall address object

Why it fails: Address objects are used for policy matching, not SSL bypass.

Application Control override

Why it fails: This manages traffic shaping/blocking, not SSL decryption.

IPS signature exclusion

Why it fails: This affects threat detection, not SSL decryption.

get system hardware status

Why it fails: This shows hardware health, not process CPU.

diagnose sniffer packet

Why it fails: This is for debugging traffic, not system performance.

get router info memory

Why it fails: This is for memory usage, not CPU usage.

An IPSec phase 3 policy

Why it fails: IPsec phase 3 does not exist; FortiOS IPsec configuration comprises phase 1 (IKE parameters) and phase 2 (selectors). Phase 2 definitions would be the relevant concept, but permitting remote-initiated traffic additionally requires an inbound firewall policy matching the tunnel interface and source subnet.

A static route to the remote subnet

Why it fails: A static route only directs outbound packets toward the remote subnet; it does not permit inbound sessions. The scenario needs a firewall policy allowing traffic from the remote site's address range, since FortiGate blocks unsolicited inbound traffic by default. Static routes are correct when reachability, not policy, is the missing piece.

A NAT rule for the remote subnet

Why it fails: NAT rules translate addresses for outbound internet access or destination NAT for published services; they do not govern which traffic traverses a tunnel. NAT would be correct for hiding internal subnets behind a public address, but remote-initiated VPN traffic is permitted by firewall policy and routing, not address translation.

Identical prefix lists

Why it fails: Prefix lists filter route advertisements; they are not exchanged during session setup, so mismatched lists still allow the adjacency to form. They are tempting because filtering is a common BGP task, but the mandatory attributes are the AS number, authentication, and matching hold timers.

Identical router IDs

Why it fails: Router IDs are used for BGP router identification and tie-breaking; two peers with different router IDs still form an adjacency, so identical IDs are not mandatory. It is tempting because router IDs appear in BGP configuration, and matching them would matter only when comparing routes from the same originating router.

A firewall policy allowing DNS traffic from internal clients to the FortiGate

Why it fails: This is required if the FortiGate acts as a DNS server.

An OSPF area configuration

Why it fails: DNS is independent of routing protocols.

An IPSec tunnel for DNS traffic

Why it fails: DNS does not require a tunnel.

A static route to the internet

Why it fails: While a route is required for general connectivity, it is not a specific configuration for DNS resolution.

Re-route to a specific switch port

Why it fails: Routing is determined by the routing table, not policy action.

Disable hardware acceleration

Why it fails: Policy matches trigger security actions such as allow, deny, authentication or traffic logging; hardware acceleration is an inspection setting, not a policy action. Disabling it is tempting because offloading interferes with some UTM inspections, and that toggle is correct when troubleshooting accelerated sessions bypassing content scanning.

An IKEv2 quick mode selector that includes the 10.0.0.0/24 subnet.

Why it fails: The quick mode selector defines the interesting traffic for the tunnel, but it does not enforce which local traffic is encrypted. The FortiGate uses firewall policies to determine what traffic is sent into the tunnel. Even with correct selectors, missing policy means traffic will not be encrypted and forwarded.

A static route for 10.0.0.0/24 pointing to the IPsec tunnel interface.

Why it fails: A static route alone does not cause traffic to be encrypted. While routing is necessary, the FortiGate requires a firewall policy to allow and direct traffic into the tunnel. Without the policy, the route is unused for that traffic, and packets may be dropped or sent elsewhere depending on other policies.

A phase 2 proposal with matching encryption and authentication algorithms.

Why it fails: Phase 2 proposals must match for the tunnel to establish, but the tunnel is already up. The issue is not tunnel establishment but traffic routing and encryption. The missing element is a firewall policy that matches the source subnet and directs traffic to the tunnel interface.

Enable 'auto-negotiate' on both phase-1 configurations.

Why it fails: Auto-negotiate is used for dial-up VPNs to allow the remote peer to initiate the tunnel. In a site-to-site redundancy scenario with static peers, auto-negotiate is not required and does not influence failover or failback. The primary/secondary selection is handled by routing and DPD, not by auto-negotiate.

Enable Dead Peer Detection (DPD) on both phase-2 selectors.

Why it fails: DPD is enabled on phase-1, not phase-2. While DPD helps detect dead peers, it does not directly control tunnel failover and failback. The question asks for configuration steps to achieve automatic failover and failback; DPD alone is insufficient and misconfiguring it on phase-2 is not possible. Therefore, this is not a required step.

Configure the primary tunnel with a lower priority value in the phase-1 settings.

Why it fails: Phase-1 priority is used for dial-up VPN load balancing, not for route selection. It does not affect which tunnel is preferred for traffic egress. The FortiGate uses routing table metrics to choose the active tunnel. Therefore, this setting alone does not achieve the required failover behavior.

Verify the firewall policy that allows traffic from the internal network to the VPN tunnel.

Why it fails: While firewall policies are important, the scenario states the tunnel is up, which implies phase 1 and phase 2 are established. If the policy were missing, traffic would be blocked, but the tunnel would still be up. However, the first thing to check after confirming tunnel status is often the selectors, as they directly affect traffic encryption. Policy check is also valid, but selectors are a common culprit when tunnel is up but no traffic passes.

Check the routing table to ensure there is a route to the remote subnet via the tunnel.

Why it fails: A route to the remote subnet is necessary for traffic to be directed into the tunnel. However, if the tunnel is up, routes are often automatically added. But it is still a valid check. However, the most common issue when tunnel is up but no traffic is mismatched selectors. Routing would cause traffic to not be sent to the tunnel, but the question implies traffic is not passing at all, so selectors are a more direct cause.

Restart the IPsec daemon to renegotiate the tunnel.

Why it fails: Restarting the daemon is a drastic step and not a troubleshooting method. It may temporarily disrupt other tunnels. The tunnel is already up, so renegotiation is not needed. The issue is likely configuration-related, such as selectors or routing, not a daemon failure. This action does not address the root cause.

IPsec tunnel interface with 'auto-negotiate' enabled

Why it fails: Auto-negotiate is not a valid FortiGate IPsec feature. While some platforms support similar concepts, FortiGate uses 'auto-discover' for dial-up tunnels, but that does not provide WAN failover. This option is a distractor and does not exist in the FortiGate IPsec configuration.

WAN link load balancing with redundant interfaces and route priorities

Why it fails: Load balancing distributes traffic across multiple links but does not inherently provide failover for IPsec tunnels. Without proper route priorities and health checks, tunnels may not automatically migrate to the secondary link. This option alone is insufficient; additional configuration is required.

Dead Peer Detection (DPD) with a shorter interval and retry count

Why it fails: DPD detects peer failures and triggers tunnel renegotiation, but it does not automatically select a different WAN interface for the tunnel. It only helps detect dead peers on the existing path; without additional routing or interface failover configuration, the tunnel may not re-establish over the secondary link.

Verify that the firewall policy has the correct source and destination interfaces.

Why it fails: While the firewall policy must have correct interfaces, if the policy is correctly configured as stated, the issue is more likely with the VPN selectors. The policy might be correct but the VPN phase-2 selectors might not match the remote subnet, causing traffic to be sent unencrypted. Checking interfaces is important but not the primary suspect here.

Run 'diagnose vpn tunnel list' to check the status of the tunnel.

Why it fails: Checking the tunnel status confirms if the tunnel is up, but if the tunnel is up and traffic is not encrypted, the problem is not tunnel status but rather traffic selection. This command would show that the tunnel is established, but not why specific traffic is bypassing it. It is not the most direct troubleshooting step.

Run 'diagnose debug application ike -1' to check IKE negotiation.

Why it fails: Debugging IKE negotiation helps identify phase-1 and phase-2 issues, but if the tunnel is up and traffic is not encrypted, the problem is likely in the policy or routing. IKE debugging would not show why specific traffic is bypassing the tunnel; it focuses on tunnel establishment, not traffic selection.

Create an SSL inspection profile that uses the internal CA certificate as the signing certificate, and apply it to a firewall policy that matches only the server's IP address.

Why it fails: Using the internal CA as the signing certificate would cause the FortiGate to re-sign all inspected certificates with that CA. However, this does not restrict inspection to only the specific server; the firewall policy matches the server's IP, but if other traffic also matches that policy (e.g., due to routing or misconfiguration), it could be inspected. More importantly, the signing certificate should be the FortiGate's CA, not the internal CA that signed the server's certificate. This option is incorrect because it confuses the signing CA with the server's CA.

Configure a firewall policy that matches the server's IP address and apply an SSL inspection profile set to 'protect' mode with the FortiGate's default CA.

Why it fails: Setting the SSL inspection profile to 'protect' mode enables deep inspection, but applying it to a policy that matches the server's IP address does not automatically exclude other traffic. The policy matches only the server's IP, so only that traffic is inspected. However, the question asks to avoid breaking SSL to other sites; if the policy is correctly scoped, it would work. But the issue is that the profile must also be configured to not inspect other traffic. This option is not the best because it does not explicitly mention excluding other traffic or using a custom signing CA. It is plausible but not fully correct.

Enable 'untrusted SSL' inspection on the FortiGate's default CA and apply it to all policies.

Why it fails: Enabling untrusted SSL inspection would cause the FortiGate to inspect SSL traffic to sites with untrusted certificates, which could break connections to other sites. Applying it to all policies would inspect all SSL traffic, not just the specific server. This is the opposite of what is needed. The requirement is to inspect only one server, so this option is incorrect.

Configure a single phase 1 with multiple remote gateways and enable redundant tunnel.

Why it fails: FortiGate does not support a single phase 1 with multiple remote gateways for redundancy in the way described. Instead, you create separate phase 1 configurations for each remote gateway. The 'redundant tunnel' feature is not a standard FortiGate setting for this purpose.

Configure two separate phase 1 interfaces with different remote gateway IP addresses and set them as members of a redundant interface.

Why it fails: Creating a redundant interface with two phase 1 interfaces is not a standard method for VPN redundancy on FortiGate. Redundant interfaces are for physical link redundancy, not for IPsec tunnels. Instead, you would configure two separate VPN tunnels and use routing or SD-WAN to fail over.

Configure BGP with the two tunnels to dynamically exchange routes and influence path selection.

Why it fails: While BGP can be used over IPsec tunnels to exchange routes and influence path selection, it is not strictly required for basic failover. The question asks for configurations required to achieve automatic failover; BGP is an advanced option, not a requirement. DPD and SD-WAN are more direct.

FortiGuard category-based SD-WAN rules

Why it fails: SD-WAN rules are used for traffic steering based on link quality and other criteria, not for SSL inspection exemptions. While they can match categories, they do not control whether traffic is decrypted. Thus, they are not the right feature for this requirement.

Application control sensor

Why it fails: Application control identifies and controls applications, but it does not provide SSL inspection exemptions based on website categories. It operates on application signatures, not on the decision to decrypt traffic. Therefore, it cannot exclude financial websites from inspection.

Web filter profile with category-based actions

Why it fails: A web filter profile can block or allow categories, but it does not control SSL inspection exemptions. You can use web filter to allow financial sites, but the traffic would still be inspected unless exemptions are set. Thus, it does not achieve the required granular control over inspection.

Set the action to 'Reset' for the signatures.

Why it fails: The 'Reset' action sends a TCP RST packet to terminate the connection, but it does not drop the malicious packet itself. While it can disrupt the attack, it is not the same as blocking. The administrator wants to block attacks, so the 'Block' action is more appropriate. Reset may be used in addition to blocking, but it is not the primary action for blocking.

Change the IPS sensor mode from Monitor to Protect in the global settings.

Why it fails: IPS sensors do not have a global mode setting called Monitor or Protect. The action is set per signature or filter within the sensor. Changing a global mode is not possible. The administrator must edit the individual signature actions to Block to enable blocking.

Enable 'Block Malicious Traffic' in the firewall policy.

Why it fails: There is no such option as 'Block Malicious Traffic' in a firewall policy. IPS blocking is controlled by the IPS sensor action, not by a policy setting. Enabling a non-existent option would not achieve the desired result. The administrator must modify the IPS sensor configuration instead.

Enable 'blackhole' on the static route.

Why it fails: A blackhole route discards traffic matching the route, but it does not automatically remove the route when the next-hop fails. It is a manual configuration to prevent routing loops or to discard unwanted traffic. It does not provide automatic failover.

Set the route's administrative distance to a lower value.

Why it fails: Administrative distance is used to select between routes from different sources; it does not provide automatic removal when the next-hop fails. Lowering the distance would make the route more preferred, but it would remain in the table even if the next-hop is unreachable, potentially causing blackholes.

Configure a dynamic routing protocol to redistribute the static route.

Why it fails: Redistributing a static route into a dynamic protocol does not automatically remove it upon next-hop failure. The static route remains in the routing table until manually removed or the interface goes down. Dynamic protocols have their own mechanisms for detecting failures, but redistribution alone does not provide that.

Set the spoke's remote gateway to 0.0.0.0 and enable the 'dynamic' keyword in the phase 2 selector.

Why it fails: Using 0.0.0.0 as the remote gateway is for dial-up VPNs where the hub does not know the spoke IP, but it is not sufficient by itself. The dynamic keyword in phase 2 is not a valid configuration for this purpose; that keyword exists in phase 1 for dial-up. This option misplaces the setting and would not trigger re-establishment based on DDNS.

Set the spoke's remote gateway to the DDNS hostname and configure the hub to use IKEv2 with aggressive mode.

Why it fails: Aggressive mode is used for dial-up VPNs where the initiator's identity is exchanged in the first message, but it is not required for FQDN-based dynamic gateways. Using IKEv2 with aggressive mode is a misconfiguration because aggressive mode is an IKEv1 feature. The key element is the FQDN, not the IKE version or mode.

Enable dead peer detection (DPD) on the hub and set the retry count to 3 with a 10-second interval.

Why it fails: DPD detects when a peer is unreachable and can trigger tunnel teardown or renegotiation, but it does not learn a new IP address. If the spoke's IP changes, DPD will simply mark the tunnel as down after retries; it cannot discover the new address. DPD is useful for failure detection but not for dynamic endpoint discovery.

Change the IKE version to IKEv1.

Why it fails: While IKEv1 can also support NAT-T, the problem is not the IKE version. The remote gateway is not responding to initial IKE packets, which suggests a NAT traversal issue. Switching to IKEv1 would not inherently solve the problem and may introduce other compatibility issues.

Set the local gateway to use a dynamic IP address.

Why it fails: The local FortiGate is not behind NAT; it is the remote office that uses NAT. Changing the local gateway to dynamic would not help the remote gateway respond. The issue is likely NAT traversal detection, not local IP addressing.

Configure a static route to the remote public IP address.

Why it fails: A static route is necessary for reachability, but the scenario states that the remote gateway is not responding to IKE packets, implying that basic IP connectivity exists. The issue is more likely related to NAT traversal, not routing.