NSE7 Advanced VPN and Zero Trust Practice Question
Which THREE conditions must be met for an IPsec VPN to successfully establish phase2?
⚠ Common exam trap
Many exam-takers confuse firewall policy requirements with Phase 2 negotiation requirements, mistakenly thinking that firewall policies must allow traffic before Phase 2 can establish, when in fact Phase 2 only requires matching proxy IDs, proposals, and PFS settings.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Proxy IDs (local and remote subnets) match on both sides
For IPsec phase2 (Quick Mode) to establish, the proxy IDs (local and remote subnet selectors) must match on both peers, because mismatched selectors cause the responder to reject the Quick Mode proposal — so option A is correct. Option C is correct because if PFS is enabled, both peers must use the same Diffie-Hellman group (e.g., group 2, 5, or 14) during phase2; a mismatch in PFS settings or DH group will fail the key exchange. Option D is correct because phase2 proposals (encryption algorithm, hash, and SA lifetime) must match between peers for the IPsec SA to be negotiated successfully. Option B is not a phase2 negotiation requirement — firewall policies permitting subnet traffic are needed for actual data flow, not for the IKE/IPsec SA establishment itself. Option E is also not required for phase2; NAT-T is only needed when NAT devices exist between peers and is negotiated in phase1, not a mandatory condition for phase2.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Proxy IDs (local and remote subnets) match on both sides
Why this is correct
Phase 2 selectors define which source and destination subnets each peer encrypts. If the local and remote proxy IDs configured on each FortiGate do not mirror the other side's, the quick-mode negotiation fails because no matching security association can be built for the traffic.
- ✗
Firewall policies allow traffic between the subnets
Why it's wrong here
Firewall policies permitting subnet traffic are needed only once the tunnel is up, to pass data through it; phase2 itself negotiates the SA via IKE, which is permitted by the IKE policy, not subnet policies. It is tempting because policy checks do block tunnel traffic, but that is a phase2 data-flow requirement, not an establishment condition.
- ✓
Perfect Forward Secrecy (PFS) settings match if enabled
Why this is correct
Phase2 requires matching PFS settings when enabled on both peers. If one gateway demands a Diffie-Hellman group and the other omits or specifies a different group, the quick mode exchange fails, so the tunnel never reaches the established state.
- ✓
Phase2 proposals match between peers
Why this is correct
Phase 2 proposals specify the encryption and authentication algorithms, encapsulation, and lifetime used for the IPsec security association. Both peers must offer at least one identical proposal; mismatched algorithm sets cause the quick-mode exchange to fail before any SA is installed.
- ✗
NAT traversal is enabled on both sides
Why it's wrong here
NAT-T is negotiated automatically when IKE detects NAT between peers; enabling it manually on both sides is not a phase2 establishment condition. It is tempting because NAT-T is genuinely required when a device sits behind a NAT gateway, but the question asks about the three conditions for phase2, which are proposal match, PFS settings and proxy IDs.
Visual reference
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 718 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.