NSE7 Advanced VPN and Zero Trust Practice Question
A FortiGate administrator is troubleshooting an IPsec VPN tunnel that fails to establish. The administrator runs 'diagnose vpn ike gateway list' and sees the tunnel state as 'connecting' but no phase2 selectors are listed. Which step should the administrator take next to identify the issue?
⚠ Common exam trap
The trap here is using summary commands like 'diagnose vpn tunnel list' or incorrect commands instead of enabling detailed IKE debug to see the actual negotiation failure.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Run 'diagnose debug application ike -1' and then attempt to bring up the tunnel to capture IKE negotiation details.
When an IPsec tunnel is stuck in 'connecting' with no phase2 selectors, the issue is likely in phase2 negotiation. Enabling IKE debug with 'diagnose debug application ike -1' will show the detailed negotiation, including proposals and selectors, and any error messages. This is the best next step to identify the cause, such as mismatched phase2 proposals or incorrect proxy IDs. Other commands may not provide the necessary detail.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Run 'diagnose debug application ike -1' and then attempt to bring up the tunnel to capture IKE negotiation details.
Why this is correct
When phase2 selectors are missing, it indicates that phase2 negotiation has not completed or failed. Enabling IKE debug with 'diagnose debug application ike -1' will show the detailed exchange, including proposals, selectors, and any error messages. This is the most effective way to identify why phase2 is not establishing, such as mismatched proposals or proxy IDs. The debug output will pinpoint the failure.
- ✗
Run 'diagnose vpn tunnel list' to check the status of all IPsec tunnels and their selectors.
Why it's wrong here
'diagnose vpn tunnel list' shows the status of established tunnels and their selectors. However, if the tunnel is stuck in 'connecting' and phase2 selectors are not listed, the tunnel is not yet up. This command may not show the pending phase2 negotiation details. It is more useful for verifying existing tunnels rather than troubleshooting negotiation failures.
- ✗
Run 'diagnose vpn ike gateway list' with the 'name' parameter to see detailed phase1 and phase2 information.
Why it's wrong here
The 'diagnose vpn ike gateway list' command already provides a summary. Adding the 'name' parameter may filter output but does not provide additional detail beyond what is already shown. To see detailed phase2 information, other debug commands like 'diagnose debug application ike -1' are needed. This step would not reveal why phase2 selectors are missing.
- ✗
Run 'diagnose vpn ike status' to check the IKE status and any error counters.
Why it's wrong here
There is no 'diagnose vpn ike status' command in FortiOS. The correct commands are 'diagnose vpn ike gateway list' and 'diagnose vpn ike gateway clear'. Using an incorrect command will not provide any useful information. The administrator should use the correct debug commands to capture IKE negotiation details.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.