NSE7 Advanced VPN and Zero Trust Practice Question
You run 'diagnose vpn ike gateway list' and see the following: gateway name: HUB_GW version: IKEv2 state: UP mode: main local: 10.0.0.1:500 remote: 203.0.113.5:500 auth: psk dpd: on rekey: 86400 num_peers: 2 total_tunnels: 2 auto-discovery: enabled What does the 'auto-discovery: enabled' indicate about this VPN gateway?
⚠ Common exam trap
NSE7 often tests the confusion between ADVPN auto-discovery (spoke shortcut negotiation) and generic IKE features like DPD, rekey, or phase2 selector auto-creation, so candidates must map the exact CLI output field to its ADVPN meaning.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation
In FortiOS, 'auto-discovery: enabled' on an IKE gateway indicates the gateway is operating as an ADVPN (Auto-Discovery VPN) hub. The hub advertises learned spoke routes to other spokes via IKE, enabling them to establish dynamic shortcut tunnels directly with each other instead of hairpinning traffic through the hub. This is the defining behavior of an ADVPN hub in the 'diagnose vpn ike gateway list' output.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
The gateway will automatically create new phase2 selectors for any remote subnet
Why it's wrong here
Auto-discovery enables IKEv2 gateway discovery of additional peers, not automatic phase2 selector creation. It is tempting because it sounds like dynamic subnet handling, but it would be the answer if the gateway were learning remote peers rather than generating selectors.
- ✓
The gateway is acting as an ADVPN hub and will advertise routes to spokes for shortcut tunnel creation
Why this is correct
Auto-discovery enabled confirms the gateway runs ADVPN hub behaviour: it exchanges shortcut offers and forwards spoke subnet routes so spokes can build direct tunnels. The two peers and two tunnels reflect the hub's multiple spoke connections.
- ✗
The gateway will automatically renegotiate IKEv2 keys before expiration
Why it's wrong here
This field concerns dynamic gateway or peer discovery, not key lifetime management. IKEv2 rekeying before expiry is governed by the rekey timer and SA lifetime settings shown separately in the output. It is tempting because both features automate IKEv2 behaviour, but they operate on entirely different mechanisms.
- ✗
The gateway will discover other VPN gateways on the same network and form peer relationships
Why it's wrong here
Auto-discovery here refers to IKEv2 gateway discovery for dial-up hub-and-spoke topologies, letting spokes locate the hub dynamically; it does not scan the network for arbitrary peers. It is tempting because discovery sounds like peer detection, but that role belongs to ADVPN shortcut negotiation, not this field.
Quick reference
VPN Protocol Comparison
| Protocol | Port | Encryption | Authentication | Use Case |
|---|---|---|---|---|
| IKEv2 / IPsec | UDP 500 / 4500 | AES-256 | Certificates / PSK | Site-to-site & remote access |
| SSL / TLS VPN | TCP 443 | TLS 1.3 | Certificates / MFA | Clientless remote access |
| L2TP / IPsec | UDP 1701 | AES (IPsec) | PSK / Certificates | Legacy remote access |
| WireGuard | UDP 51820 | ChaCha20 | Public keys | Modern high-performance VPN |
| PPTP | TCP 1723 | MPPE (weak) | MS-CHAPv2 | Legacy — avoid in production |
PPTP is considered insecure. IKEv2/IPsec and SSL VPN are the current recommended options.
Go deeper
Related to this question
About these practice questions
One of 718 original NSE7 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official Fortinet exam blueprint
This NSE7 practice question is part of Courseiva's free Fortinet certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the NSE7 exam.