NSE7 Troubleshooting and Diagnostics Practice Question
A FortiGate administrator is troubleshooting a VPN tunnel that connects to a remote site. The tunnel is up, but traffic is not passing. The administrator checks the Phase 2 settings and sees that the local and remote subnets are correctly defined. What is the next step to diagnose the issue?
⚠ Common exam trap
Watch out — candidates often assume a working Phase 2 (tunnel up) guarantees traffic flow, but FortiGate requires an explicit firewall policy to permit traffic through the VPN interface, unlike some other vendors where a route alone is sufficient.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Check the firewall policies that reference the VPN interface
When the VPN tunnel is up (Phase 1 and Phase 2 are established) but traffic is not passing, the most common cause is that a firewall policy referencing the VPN interface is either missing or misconfigured. Even with correct Phase 2 selectors and routing, the FortiGate will drop traffic if no policy explicitly permits it from the source to the destination over the VPN interface. Therefore, checking the firewall policies is the logical next step.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Check the firewall policies that reference the VPN interface
Why this is correct
Even if the tunnel is up, traffic must be allowed by a firewall policy from the VPN interface to the destination zone.
- ✗
Check the routing table for the remote subnet
Why it's wrong here
Routing is typically handled by the tunnel interface; if the tunnel is up, routes are usually present.
- ✗
Run 'diagnose vpn ike log' to check for Phase 1 errors
Why it's wrong here
Phase 1 is already up; this would not reveal traffic forwarding issues.
- ✗
Restart the VPN tunnel
Why it's wrong here
Restarting would not resolve missing policies.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.