Security Profiles Routing And IPsec

A network administrator needs to apply a security profile to traffic that matches a specific SD-WAN rule. The SD-WAN rule steers traffic out of two IPsec tunnels based on application detection. Where should the administrator apply the security profile?

An administrator is configuring an IPsec VPN tunnel between two FortiGates for SD-WAN. The administrator wants to ensure that the tunnel interface is not used for routing until the IPsec tunnel is fully established and the health check passes. Which configuration step should be taken?

A FortiGate is configured with an SD-WAN rule that uses an SLA target and includes two IPsec tunnels. The administrator wants to ensure that security profiles are applied to traffic steered by this rule. Which two statements are correct regarding the enforcement of security profiles for SD-WAN traffic? (Choose two.)

An IPsec VPN tunnel used as an SD-WAN member is experiencing intermittent flapping due to DPD (Dead Peer Detection) timeout issues over a high-latency satellite link. How should the administrator adjust the Phase 1 IPsec settings on FortiOS to stabilize the tunnel without completely disabling failure detection?

An enterprise network uses OSPF over SD-WAN IPsec tunnels. The administrator notices that OSPF adjacency is constantly dropping over a specific backup SD-WAN member link due to intermittent packet loss. Which THREE configuration adjustments can improve OSPF stability over unstable SD-WAN IPsec links? (Choose three)

An administrator configures an SD-WAN rule that matches traffic to a specific destination subnet and sets the strategy to 'Lowest Cost (SLA)'. The rule includes two members: 'Tunnel-1' with cost 10 and 'Tunnel-2' with cost 20. Both tunnels pass their SLA health checks. Which tunnel will be selected for the traffic?

An administrator is setting up an IPsec VPN tunnel between a FortiGate hub and a branch office FortiGate. The administrator wants to ensure that the branch office can access the internet through the hub's internet connection while also accessing resources at the headquarters. Which type of IPsec VPN configuration should the administrator use to achieve this?

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor two IPsec tunnels. The health check is configured with a single ping probe to 8.8.8.8. The administrator notices that the SD-WAN rule fails over to the secondary tunnel even when the primary tunnel is up, but with high latency. The administrator wants the health check to consider latency and only fail over when latency exceeds a threshold. What should the administrator configure to achieve this?

An administrator needs to inspect encrypted traffic traversing an SD-WAN IPsec tunnel using Deep Packet Inspection (DPI). What must be installed on the client endpoints or configured on the FortiGate to prevent browser trust warnings when using SSL/TLS full inspection?

An administrator is troubleshooting an SD-WAN setup where traffic is not being routed through the preferred IPsec tunnel despite the tunnel being up and passing health checks. The administrator reviews the SD-WAN rule and notices that the rule is configured with the 'maximize-bandwidth (SLA)' strategy and includes two tunnels with different bandwidths. The administrator expects traffic to use the tunnel with higher bandwidth, but it is using the lower bandwidth tunnel. What could be the reason for this behavior?

A FortiGate is running SD-WAN with two IPsec tunnels to different data centers. The administrator wants to apply a Web Filtering profile only to HTTP/HTTPS traffic that is steered by a specific SD-WAN rule, while other traffic on the same tunnels remains unfiltered. Where should the Web Filtering profile be applied?

A FortiGate is configured with an IPsec VPN tunnel to a remote peer. The administrator wants to apply an IPS sensor to traffic traversing the tunnel. However, the IPS sensor must inspect traffic after decryption but before it is routed to the internal network. Where should the IPS sensor be applied?

An administrator wants to route traffic from a specific source subnet through an SD-WAN zone that contains two member interfaces: a dedicated internet link and an MPLS link. The administrator needs to ensure that traffic from that subnet always uses the MPLS link when it is available, but falls back to the internet link if the MPLS link fails. Which SD-WAN rule configuration should be used?

An administrator configures an SD-WAN health check with multiple probes (e.g., ping and HTTP) to monitor a set of IPsec VPN tunnels. Which THREE criteria or settings govern how FortiOS determines whether an SD-WAN member has met or failed the performance SLA? (Choose three)

An administrator wants to ensure that an SD-WAN rule only selects a member if its measured latency is below 100 ms and packet loss is below 2%. Which SD-WAN feature should be configured to enforce these thresholds?

An administrator wants to view the active SD-WAN rule hit counts and verify which traffic is matching a specific SD-WAN rule in FortiOS. Which command should be used?

An enterprise network uses ADVPN 2.0 with BGP running over IPsec tunnels. A spoke needs to initiate a shortcut tunnel to another spoke. Which FortiOS CLI command is used on the hub to verify the active shortcut tunnels and view the shortcut state information?

An administrator configures an SD-WAN rule with an SLA target that includes latency, jitter, and packet loss. The rule uses the 'lowest cost (SLA)' strategy. Both tunnels meet the SLA, but one tunnel has a lower configured cost. How does FortiOS select the egress interface for a new session?

When troubleshooting SD-WAN performance SLA packet loss, an administrator wants to view real-time latency, jitter, and packet loss statistics for individual health check members. Which CLI command should be executed?

An administrator configures an IPsec VPN tunnel between two FortiGates for SD-WAN use. The tunnel is up, but traffic from the local subnet 10.10.10.0/24 to the remote subnet 10.20.20.0/24 is not passing. The administrator verifies that the Phase 2 selectors are configured with the correct local and remote subnets. What is the most likely cause?

When configuring advanced IPsec VPN tunnels to act as members of an SD-WAN zone, which TWO configuration parameters on the FortiGate are critical for ensuring proper IPsec tunnel operation and traffic steering? (Choose two)

An administrator is troubleshooting BGP route propagation over SD-WAN IPsec tunnels where a branch office is not receiving specific routes from the datacenter hub. Which TWO CLI commands on the FortiGate are most useful for diagnosing BGP peering and advertised route issues? (Choose two)

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link, which has lower latency. The administrator wants to ensure that if the MPLS link fails the SLA for latency, the traffic is automatically routed over the internet VPN. Which SD-WAN strategy should be used to achieve this?

An administrator configures a static route where the gateway is an SD-WAN zone instead of a specific IP address. How does FortiOS process this SD-WAN static route?

A FortiGate is configured with an SD-WAN rule that steers traffic based on application control. The administrator applies a security profile (Antivirus and IPS) to the SD-WAN zone. However, they notice that traffic matching the SD-WAN rule is not being inspected by the security profiles. What is the most likely reason?

A network administrator is configuring an IPsec VPN tunnel between a FortiGate hub and a spoke. The administrator wants to ensure that the spoke can dynamically learn routes from the hub and also advertise its local subnets. Which routing protocol is most commonly used in Fortinet SD-WAN deployments to achieve this?

A network administrator has deployed SD-WAN with two IPsec overlays and one internet breakout on a FortiGate. The administrator wants to ensure that traffic from a specific source subnet uses the VPN overlay for a business-critical application, while all other traffic follows the default route. The SD-WAN rule must also verify that the overlay meets an SLA for jitter. Which SD-WAN configuration object should the administrator use to define the source subnet and application criteria?

A network administrator is deploying SD-WAN with IPsec tunnels and wants to ensure that if a tunnel goes down, traffic is automatically redirected to another member. The administrator has configured two IPsec tunnels in the same SD-WAN zone and a health check for each. Which SD-WAN rule configuration ensures that traffic uses the tunnel with the lowest latency and fails over when the primary tunnel fails the health check?

An administrator implements BGP over SD-WAN tunnels to a cloud provider. The cloud provider requires BGP MD5 authentication on all peering sessions. Where is BGP MD5 authentication configured on the FortiGate?

An administrator is configuring an SD-WAN rule that uses the 'SLA' strategy with two members: a primary MPLS link and a backup LTE link. The SLA target is latency < 100 ms and packet loss < 1%. The administrator notices that when the MPLS link fails the SLA, traffic is not failing over to LTE. What could be the cause?

A FortiGate SD-WAN deployment uses a firewall policy with an Intrusion Prevention System (IPS) profile applied. After turning on IPS, administrators notice that throughput over an IPsec SD-WAN tunnel drops significantly. What is the primary reason for this throughput reduction, and how can it be mitigated?

A FortiGate is configured with an SD-WAN rule that uses a health check to monitor an IPsec tunnel. The health check is configured with a ping probe to a remote IP. The administrator notices that the tunnel is marked as down even though the remote IP is reachable via the tunnel. What is a possible cause?

An administrator is configuring an SD-WAN rule to route traffic from a specific source subnet to a destination subnet over a preferred IPsec tunnel. The administrator wants to ensure that if the preferred tunnel fails, traffic automatically switches to a backup tunnel. Which SD-WAN rule configuration is required to achieve this?

An administrator configures an SD-WAN rule using the 'Volume' strategy across two IPsec tunnels with different bandwidth capacities (Tunnel A: 100 Mbps, Tunnel B: 50 Mbps). How does FortiOS distribute traffic across these members when using the Volume strategy?

An administrator is configuring BGP over SD-WAN IPsec tunnels between a headquarters FortiGate and branch FortiGates. Which TWO configuration steps are required to ensure robust and stable dynamic routing over the SD-WAN IPsec tunnels? (Choose two)

A network administrator is configuring a static route on a FortiGate to direct traffic to a remote subnet through an IPsec VPN tunnel. The tunnel interface is named 'VPN_Tunnel'. Which of the following is the correct way to configure the static route?

An administrator is troubleshooting an SD-WAN deployment where traffic matching an SD-WAN rule with a destination service object (e.g., HTTPS) is not being steered according to the SLA priority. Instead, it is always taking the default static route member. Upon checking the firewall policies, what is the most common reason why an SD-WAN rule fails to process application or service-based traffic matching?

An administrator has configured an SD-WAN rule to steer traffic based on the "maximize bandwidth (SLA)" strategy. The rule uses two IPsec tunnels: one with 100 Mbps and one with 50 Mbps. The administrator expects traffic to be load-balanced proportionally to the bandwidth. However, all traffic is going through the 100 Mbps tunnel. What is the most likely reason?

An administrator is configuring an IPsec VPN tunnel that will be used as an SD-WAN member. The tunnel must be able to carry multicast traffic for OSPF. Which IPsec Phase 2 configuration parameter must be enabled to support this requirement?

When configuring an SD-WAN health check to monitor internet reachability using HTTP/HTTPS requests, which parameter defines the specific string the FortiGate expects to receive in the server response body to validate that the path is healthy?

In an ADVPN 2.0 deployment, a hub unit uses BGP to advertise routes to spokes. When a spoke learns a prefix via BGP from the hub, what mechanism allows the spoke to automatically initiate an ADVPN shortcut tunnel directly to another spoke when traffic flows between them?

An administrator is configuring an IPsec VPN tunnel between two FortiGate devices for SD-WAN. The administrator wants to ensure that the tunnel interface can be used in SD-WAN rules and that the tunnel is established only when the underlying physical interface is up. Which IPsec Phase 1 configuration parameter is required to bind the tunnel to a specific outgoing interface?

A network administrator wants to ensure that IPsec traffic between two FortiGate SD-WAN members is encrypted with a specific set of algorithms. The administrator configures Phase 2 selectors on both peers. Which Phase 2 parameter must match on both ends for the tunnel to come up?

An administrator applies security profiles (Antivirus, Web Filtering, and IPS) to traffic steered by an SD-WAN rule. Performance issues arise. Which TWO methods can the administrator use to optimize inspection performance without completely disabling security? (Choose two)

An administrator configures an SD-WAN rule that uses the 'maximize bandwidth (SLA)' strategy across three IPsec overlays. A security profile group containing IPS and Application Control is applied to the firewall policy that references the SD-WAN zone. Users report that some sessions are being re-evaluated mid-stream and reset when a health check fails. Which FortiOS behavior explains the resets?

An administrator wants to apply a Web Filtering security profile to traffic that is being dynamically steered via an SD-WAN rule. Where must this security profile be enforced in FortiOS?

An administrator troubleshoots a scenario where traffic matching an application-based SD-WAN rule is bypassing the preferred high-speed MPLS tunnel and taking the backup broadband tunnel instead. Which THREE factors should the administrator check to resolve this routing discrepancy? (Choose three)

An administrator is configuring an SD-WAN rule to route VoIP traffic over the MPLS link and all other traffic over the internet link. The administrator wants to ensure that VoIP traffic is prioritized and that the rule only selects the MPLS link if it meets specific latency and jitter thresholds. Which SD-WAN configuration should be used?

A FortiGate is configured with two IPsec overlays in an SD-WAN zone. The administrator wants to ensure that return traffic from the remote subnet arrives on the same overlay that the original session used, but the remote gateway IP is the same on both overlays. Which SD-WAN member setting should be configured to achieve this?

A FortiGate is configured with an SD-WAN rule that steers traffic to an IPsec overlay tunnel. A security administrator needs to inspect the traffic with an IPS sensor before it egresses the tunnel. Where must the IPS sensor be applied so that it inspects traffic matching the SD-WAN rule?

An administrator configures an SD-WAN rule that steers Microsoft 365 traffic over the IPsec tunnel 'MPLS-VPN' and sets the rule's 'Priority' to 1. A second SD-WAN rule for the same traffic exists, but its 'Priority' is 10. Which statement accurately describes how FortiOS evaluates these rules?

An administrator is troubleshooting an IPsec VPN tunnel that is part of an SD-WAN zone. The tunnel is up, but SD-WAN health checks are failing, causing the tunnel to be marked as down. The administrator verifies that the Phase 2 selectors include the health check server's IP address. What is the next most likely cause to investigate?

An enterprise deploys BGP over SD-WAN with multiple MPLS and broadband connections. A route-map is applied to incoming BGP updates on the FortiGate to set a specific weight for routes learned over the MPLS interface. Why is the 'weight' attribute particularly effective in this FortiOS SD-WAN and BGP integration scenario?

An administrator is configuring a new SD-WAN rule to steer traffic based on application signatures. The administrator wants to ensure that the rule only matches traffic for Microsoft Teams and prioritizes it over other traffic. Which SD-WAN rule configuration should be used?