NSE7 Advanced Networking and SD-WAN Practice Question
You run 'diagnose sys session filter dport 179' on a FortiGate and see many sessions with proto=6 and proto_state=01. What does this indicate about the BGP sessions?
⚠ Common exam trap
Many candidates assume any session on port 179 with proto=6 (TCP) means BGP is working, but they overlook the TCP state field; FortiGate's proto_state values directly map to TCP connection phases, and 01 specifically indicates the session is still in the handshake phase, not established.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
BGP sessions are in the process of being established, but not yet fully up.
Proto=6 indicates TCP, and proto_state=01 corresponds to TCP SYN_SENT (state 1 in the Linux TCP state model used by FortiGate). This means the BGP session has sent a SYN but has not yet received a SYN-ACK, so the three-way handshake is incomplete and the session is not established. BGP uses TCP port 179, so seeing many sessions in this state indicates ongoing connection attempts that have not yet completed.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
BGP sessions are fully established and exchanging routes.
Why it's wrong here
Established BGP sessions would show a different state (e.g., ESTABLISHED).
- ✗
BGP sessions are being actively torn down.
Why it's wrong here
Teardown would show FIN or RST states.
- ✓
BGP sessions are in the process of being established, but not yet fully up.
Why this is correct
proto_state=01 means SYN_SENT, indicating TCP handshake is incomplete.
- ✗
BGP sessions are using TCP port 179 but are idle.
Why it's wrong here
Idle sessions would not show active sessions.
Visual reference
Go deeper
Related to this question
About these practice questions
Courseiva writes every NSE7 question from scratch — 940 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.