Troubleshooting Scenario Questions

An administrator is troubleshooting a scenario where IPSec VPN tunnels between two FortiGates are flapping. The logs show Phase 1 is up but Phase 2 fails with 'no proposal chosen'. The remote FortiGate has multiple Phase 2 selectors configured. What is the most likely cause?

A
Mismatched Phase 2 proxy IDs (local/remote subnets).
The error 'no proposal chosen' is often due to mismatched proxy IDs in Phase 2.
B
Mismatched pre-shared keys.
Why wrong: Pre-shared key mismatch would cause Phase 1 to fail, not Phase 2.
C
Dead Peer Detection (DPD) settings are too aggressive.
Why wrong: DPD issues would cause the tunnel to drop after being established, not a Phase 2 failure.
D
Certificate validation failure.
Why wrong: Certificate issues would affect Phase 1 if certificate authentication is used, but logs show Phase 1 is up.

Question 2mediumdrag order

Review the full subnetting walkthrough →

Drag and drop the steps to troubleshoot a FortiGate SSL VPN connection failure into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 3mediummultiple choice

A customer reports intermittent connectivity issues between two internal subnets separated by a FortiGate firewall. The traffic is allowed by the policy, but users experience timeouts during peak hours. Which troubleshooting step should you take first?

A
Run a packet sniffer on the FortiGate to capture traffic between the subnets.
Why wrong: Packet capture is useful but more resource-intensive; should be done after simpler checks.
B
Check the session table for session limits and session congestion.
Peak hour timeouts often indicate session table exhaustion; checking this is the quickest diagnostic step.
C
Disable hardware acceleration on the FortiGate.
Why wrong: This could reduce performance and is not a first step in troubleshooting intermittent connectivity.
D
Configure SNAT on the policy to translate the source IP.
Why wrong: SNAT is not a troubleshooting step and may not resolve the issue.

Question 4mediummulti select

An administrator is troubleshooting a VPN tunnel that is not coming up. The remote peer is a third-party device. Which THREE actions should be taken to diagnose the issue?

A
Ensure that the pre-shared key matches on both sides.
Mismatched PSK is a common cause of tunnel failure.
B
Confirm that UDP ports 500 and 4500 are not blocked by any firewall.
Why wrong: This should be checked, but it's not one of the three most direct actions for a tunnel not coming up; it's more about network path.
C
Verify that the remote peer's IP address is reachable via ping.
Basic connectivity must exist before IKE negotiation.
D
Check the IPSec VPN logs with 'diag debug application ike -1'.
IKE debug shows detailed negotiation steps.
E
Review the routing table to ensure the remote subnet is reachable through the tunnel interface.
Why wrong: This is relevant after the tunnel is established.

Question 5hardmultiple choice

A company uses SSL VPN with FortiGate for remote access. Users report that after connecting, they can access internal web servers but cannot ping them. Which configuration is most likely missing?

A
Split tunneling settings
Why wrong: Split tunneling affects which traffic goes through the tunnel, but does not block ICMP specifically.
B
SSL VPN web portal settings
Why wrong: Web portal settings are for web-mode access, not tunnel-mode policies.
C
Firewall policy allowing ICMP
The firewall policy for SSL VPN traffic must permit ICMP protocol in addition to TCP/80 and TCP/443.
D
DNS server configuration
Why wrong: DNS server is for name resolution, not for ICMP traffic.

Question 6mediummulti select

Which TWO actions are appropriate when troubleshooting a slow network connection through a FortiGate?

A
Increase the session TTL to reduce session setup overhead.
Why wrong: Changing session TTL does not address root cause and may exhaust resources.
B
Check the CPU and memory utilization on the FortiGate.
High resource usage can cause slowdowns; checking this is a standard diagnostic step.
C
Verify the routing table for correct next-hop entries.
Incorrect routing can cause traffic to take suboptimal paths, leading to slowness.
D
Disable flow control on the WAN interface.
Why wrong: Disabling flow control can cause packet drops and worsen performance.
E
Disable all security profiles to free resources.
Why wrong: Disabling security profiles bypasses security and may not be necessary.

Question 7easymultiple choice

An administrator is reviewing the HA configuration shown in the exhibit. The primary unit has failed, and the secondary unit (with priority 100) has taken over. However, the administrator notices that the secondary unit has an IP address of 10.10.10.2 on port3, but cannot ping the management gateway 10.10.10.1. What is the most likely cause?

Exhibit

Refer to the exhibit.

config system ha
    set group-name "HA_Cluster"
    set mode a-p
    set hbdev "port1" 50 "port2" 50
    set session-pickup enable
    set session-pickup-connectionless enable
    set ha-mgmt-status enable
    set ha-mgmt-interface "port3"
    set ha-mgmt-interface-gateway 10.10.10.1
    set override enable
    set priority 200
end

A
The HA management interface IP is not active on the secondary
The management IP is active only on the primary unit; the secondary uses the same IP after failover, but the network may not have updated.
B
The hbdev configuration is incorrect
Why wrong: hbdev is configured correctly.
C
The override setting is preventing the secondary from taking over management
Why wrong: override only affects priority, not management IP.
D
session-pickup is not enabled
Why wrong: session-pickup is enabled in the config.

Question 8mediummulti select

An administrator is troubleshooting an HA cluster issue. The cluster consists of two FortiGate units in active-passive mode. The passive unit is showing a 'heartbeat lost' error in the logs. Which TWO configuration checks should the administrator perform to resolve this issue?

A
Check that the HA password is the same on both units
Why wrong: Password mismatch would cause authentication issues, not heartbeat loss.
B
Ensure the heartbeat interface is physically connected and has a valid IP address in the same subnet
Physical connectivity and IP configuration are necessary for heartbeat.
C
Verify that HA override is enabled on both units
Why wrong: Override setting affects failback, not heartbeat.
D
Confirm that the management interface IP addresses are on the same subnet
Why wrong: Management IPs should be unique per unit, not necessarily same subnet.
E
Verify that the heartbeat interface is configured identically on both units
Heartbeat interface must match for communication.

Question 9hardmultiple choice

An administrator is troubleshooting a ZTNA connection issue where a user can access the ZTNA gateway but the connection to the internal application fails after a few seconds. The FortiGate logs show 'ZTNA session timeout' but the timeout value is set to 30 minutes. What could be the reason?

A
The internal application is not responding to the proxy request.
Why wrong: The log indicates timeout, not application unavailability.
B
The ZTNA proxy idle timeout is set to a lower value than the global timeout.
The proxy idle timeout can be configured separately and may be shorter.
C
The internal application has a 5-second timeout.
Why wrong: The log refers to ZTNA session timeout, not application timeout.
D
The client's FortiClient is not receiving the ZTNA tags.
Why wrong: The client can access the gateway, so tags are likely received.

Question 10mediummultiple choice

An administrator is troubleshooting a scenario where FortiAnalyzer is not receiving logs from a FortiGate. The FortiGate shows 'log-fortianalyzer setting status: disconnected'. Which step should be taken first to resolve this?

A
Check the FortiGate's DNS resolution for the FortiAnalyzer hostname
Why wrong: DNS is only relevant if using hostname; the status shows disconnected, likely IP-based.
B
Verify that the FortiGate can reach the FortiAnalyzer IP address and that the FortiAnalyzer service is running
Connectivity is the most basic check; ping and service status should be verified first.
C
Restart the FortiGate's logging service
Why wrong: Restarting may not resolve underlying connectivity.
D
Disable and re-enable logging to FortiAnalyzer
Why wrong: Toggling may help but should be done after connectivity is confirmed.

Question 11mediummulti select

A FortiGate administrator is troubleshooting slow network performance. The administrator runs the command 'diagnose sys session filter dst 10.0.0.1' and sees many sessions in a 'proto_state=0a' state. What does this state indicate? (Select TWO.)

A
The session has been reset
Why wrong: A reset would show CLOSE state or no session.
B
The session is in FIN_WAIT_2 state
FIN_WAIT_2 is a common state during TCP teardown.
C
The session is in TIME_WAIT state
TIME_WAIT is also part of teardown; FortiGate may report it as 0x0a.
D
The session is actively transferring data
Why wrong: Data transfer states are ESTABLISHED (0x06).
E
The session is in SYN_RECEIVED state
Why wrong: SYN_RECEIVED is typically state 0x02.

Review the full routing breakdown →

Question 12hardmultiple choice

A FortiGate administrator is troubleshooting a scenario where users in VDOM-1 cannot reach a server in VDOM-2. Inter-VDOM routing is configured using a VDOM link. The administrator checks the session table and sees that packets are arriving on the VDOM link interface but are not being forwarded. What is the MOST likely cause?

A
The VDOM link is in the wrong VDOM
Why wrong: If the VDOM link is created, it exists in both VDOMs; misplacement would prevent any traffic from reaching the link.
B
A firewall policy is blocking the traffic from the VDOM link to the destination
Traffic entering a VDOM must match a policy. If no policy permits the traffic, it is dropped. The session table would show the packet arriving but no forward decision.
C
The routing table in VDOM-1 does not have a default route
Why wrong: The route to the server's subnet should be via the VDOM link, but if packets arrive at the link, routing is likely correct.
D
The VDOM link is not administratively up
Why wrong: If the link is down, packets would not arrive at the interface. The symptom is packets arriving but not forwarded.

Question 13mediummulti select

A FortiGate administrator is troubleshooting an issue where IPsec VPN traffic is not being forwarded correctly in a multi-VDOM environment. Which TWO factors should the administrator verify?

A
The firewall policy for the VPN traffic is present in the correct VDOM
Policy must be in the VDOM where traffic flows.
B
The VPN tunnel is configured in the correct VDOM
VPN configuration is VDOM-specific.
C
Inter-VDOM routing is enabled globally
Why wrong: Not required for VPN within same VDOM.
D
The management VDOM has an IPsec policy
Why wrong: Management VDOM does not handle data VPNs.
E
The FortiGate is in transparent mode
Why wrong: Transparent mode is not relevant to IPsec VPN.

Question 14hardmultiple choice

An administrator wants to create an automation stitch that automatically blocks an IP address when a high-severity IPS alert is triggered. The administrator creates a trigger for 'IPS event' and an action of 'Add to Blocked IPs'. However, the action fails to execute. Which of the following is the most likely cause?

A
The automation stitch is set to execute every 5 minutes, not immediately
Why wrong: Timing is configurable but would not cause a failure to execute.
B
The blocked IP list has reached its maximum size
Why wrong: There is a limit, but it is high and would generate a different error.
C
The IPS event trigger does not support IP address extraction
Why wrong: IPS events include source IP, so extraction is possible.
D
The admin account used to configure the stitch does not have permission to modify the blocked IP list
The stitch runs with the privileges of the admin who created it. If that admin lacks write access to address objects, the action fails.

Question 15mediummultiple choice

When troubleshooting an IPsec VPN phase 1 failure, you run 'diagnose vpn ike config' and see that the remote gateway IP address is incorrect. Which command is used to correct the peer IP configuration?

A
set psksecret <secret>
Why wrong: This sets the pre-shared key, not the peer IP.
B
execute vpn tunnel down <tunnel>
Why wrong: This tears down the tunnel, not configures peer IP.
C
config vpn ipsec phase1-interface edit <name> set remote-gw <ip>
This sets the remote gateway IP address.
D
set certificate <name>
Why wrong: This sets the local certificate, not peer IP.