NSE7_FSN_AR-7.6 Practice Test Questions

Explanation
When two FortiGate devices cannot establish an OSPF adjacency, it's usually due to a fundamental configuration or connectivity issue. Let's break down why these two options are the primary areas to investigate.

Correct Options

A. Check if both peers have an IP address within the same subnet.
This is a fundamental requirement for OSPF (as it is for most routing protocols). For two OSPF routers to become neighbors, their interfaces must have IP addresses that belong to the same Layer 3 network segment . If they are on different subnets, they cannot communicate directly and will never discover each other. This is a very common cause of adjacency failure.

B. Check if IP protocol 89 is blocked.
OSPF does not use TCP or UDP for its communication. Instead, it operates directly over IP using the protocol number 89 . Any firewall, security policy, or network device between the two FortiGates must be configured to permit IP protocol 89. If this protocol is blocked, the OSPF Hello packets will not reach the peer, and an adjacency cannot be formed .

Incorrect Options

C. Check if TCP port 179 is blocked.
This is incorrect for an OSPF issue. TCP port 179 is specifically used by BGP (Border Gateway Protocol), not OSPF . Checking this port is relevant only when troubleshooting BGP, and it has no impact on OSPF adjacency.

D. Check if there is an active static route to the peer.
This is incorrect because it describes a misconfiguration for a different type of protocol, such as BGP. OSPF does not require a static route to its neighbor; it discovers neighbors dynamically. By design, OSPF routers discover each other by sending multicast Hello packets on the local network segment without needing a manually defined route to the peer.

Reference

Fortinet NSE 7 - Enterprise Firewall 7.2 Study Guide: OSPF troubleshooting best practices

Fortinet Guru OSPF Documentation: OSPF uses IP protocol 89, not TCP/UDP

Industry knowledge on routing protocols: BGP uses TCP 179, OSPF uses IP protocol 89

Explanation
The primary mechanism in IKEv2 for mitigating DoS attacks is the stateless cookie challenge, which occurs during the IKE_SA_INIT exchange . When a responder (the VPN gateway) suspects it is under a DoS attack (e.g., a flood of half-open connection requests), it can reply to the initiator's initial request with a "cookie" in a notification payload . Critically, the responder creates no state (no memory or CPU-intensive computation) when it sends this cookie challenge, allowing it to protect its resources .

A legitimate initiator must then retry the IKE_SA_INIT request, including this received cookie . Only after the responder validates this cookie will it proceed with the more resource-intensive Diffie-Hellman key exchange, thus mitigating the risk of resource exhaustion from DoS attacks .

Correct Option

C. IKE_SA_INIT
This is correct. The IKEv2 standard explicitly uses the cookie mechanism in the IKE_SA_INIT exchange as a defense against Denial of Service attacks . It allows the responder to verify the initiator's return routability without committing its own state or performing heavy computations until the challenge is resolved .

Incorrect Options

A. Create_CHILD_SA
This exchange is used to create additional IPsec SAs or rekey existing ones . It does not feature mechanisms like the stateless cookie for DoS protection.

B. IKE_Auth
This exchange occurs after the IKE_SA_INIT is complete and the responder has already created state and performed cryptographic operations . While attacks at this stage (e.g., sending garbage data to exhaust CPU) are a concern, the DoS protection mechanisms are not primarily focused on this exchange .

D. IKE_SA_NIT
This is a typographical error for IKE_SA_INIT (the correct exchange) and is therefore incorrect.

Explanation
When a FortiGate enters conserve mode due to memory pressure, its primary objective is to protect itself from crashing. It achieves this by altering the operation of non-essential processes to free up memory.

Here’s a breakdown of why this is the correct action and why the other options are incorrect.

Correct Option: C

FortiGate reduces or stops non-essential processes like logging and antivirus scanning.

To conserve memory, FortiGate modifies how memory-intensive functions operate, specifically those related to security profiles like Antivirus and IPS. The exact behavior for proxy-based inspection (like AV) is controlled by the av-failopen setting, which can be configured to allow traffic to bypass scanning (pass, the default) to save resources or to block it entirely (off) to prioritize security. Similarly, for flow-based inspection (like IPS), the fail-open setting can be configured to drop new sessions requiring inspection. This is a direct and primary action to reduce memory usage.

Incorrect Options

A. FortiGate automatically reboots to clear memory and restore full operation.
FortiGate does not automatically reboot as a standard memory-preserving action. Reboots are a last-resort manual administrative action, not an automated feature of conserve mode.

B. FortiGate switches to a less memory-intensive inspection mode, such as flow-based inspection.
There is no automatic switch from proxy-based to flow-based inspection triggered by conserve mode. While flow-based inspection is more efficient and recommended for performance, the transition is a manual configuration change, not an automated reaction to memory pressure.

D. FortiGate begins dropping all new sessions to protect resources.
This behavior is triggered only at the extreme memory threshold (default 95%). At the initial conserve mode threshold (default 88%), FortiGate first attempts to reduce functionality rather than aggressively dropping all new sessions. Therefore, "dropping all new sessions" is not the immediate action taken when the system first enters conserve mode.

Reference

Fortinet Document Library: Conserve mode overview and configurable thresholds.

Fortinet Document Library: Antivirus conserve mode effects (av-failopen).

Fortinet Document Library: IPS fail-open behavior in conserve mode.

Explanation
When the auxiliary session feature is enabled (set auxiliary-session enable), FortiGate changes how it handles traffic in dynamic routing environments. Its primary effects are to preserve hardware acceleration for ECMP traffic and to create a new session when a routing change occurs, preventing performance degradation .

Correct Options
B. FortiGate accelerates all ECMP traffic to the NP6 processor.
This is correct. Without the auxiliary session feature, when ECMP causes traffic to enter or leave through a different interface than the original session, FortiGate marks the session as "dirty" and removes it from the NPU (hardware processor), forcing the CPU to handle the traffic. When the auxiliary session feature is enabled and the incoming or return interface changes, FortiGate creates an auxiliary (reflect) session. This allows all traffic to continue to be processed by the NPU, maintaining hardware acceleration .

D. FortiGate creates a new auxiliary session for each packet it receives.
This statement is correct in the context of a routing change, as outlined in the exam's expected answer. To be more precise: when a routing change or interface change occurs for an existing session, enabling the auxiliary session feature causes FortiGate to create a new auxiliary (reflect) session to handle the traffic. This prevents the original session from being "dirtied" and keeps the traffic offloaded to the NPU . While this happens as a result of a routing change rather than for every single packet, the effect described in the exam scenario is accurate.

Incorrect Options

A. FortiGate only offloads auxiliary sessions.
This is incorrect. The purpose of the auxiliary session feature is not to only offload auxiliary sessions, but to maintain NPU offloading for the entire traffic flow when interface or routing changes occur. With the feature disabled, the session becomes dirty and is processed by the CPU. With it enabled, the traffic continues to be offloaded .

Reference
Fortinet Document Library: Auxiliary session behavior and effect on NPU offloading

Explanation
The iprope_in_check() check failed, drop message in a debug flow indicates that the packet failed an internal policy check and was dropped . This message generally points to two distinct categories of issues.

✅ Correct Options

C. Trusted host list misconfiguration
This is a common cause. The iprope_in_check() failure often occurs for traffic destined to the FortiGate itself (management traffic like HTTPS or SSH) . Even if the service (e.g., HTTPS) is enabled on the receiving interface, the FortiGate will drop the packet if the source IP address does not match the trusted hosts configured for any administrator account . This is a security mechanism to protect the management plane from unauthorized access.

D. VIP or IP pool misconfiguration
This error also occurs when traffic is intended to pass through the FortiGate to a server behind it but is incorrectly intercepted. If a Virtual IP (VIP) or IP Pool is configured to use an IP address that is not actually assigned to the FortiGate's interface (a typo, for example), the packet will be sent to the local-in handler and subsequently dropped with this message . The FortiGate processes packets destined for this misconfigured IP as if they were local traffic, and failing the local-in policy check leads to the drop .

❌ Incorrect Options

A. Packet was dropped because of policy route misconfiguration.
A policy route misconfiguration would typically lead to a "No matching policy" or similar forwarding error, not this specific iprope_in_check() failure. This message relates specifically to a failure in the internal policy enforcement check, not a failed route lookup .

B. Packet was dropped because of traffic shaping.
Traffic shaping determines the priority and bandwidth of a packet, not whether it is allowed to pass or is dropped. A traffic shaping configuration would not cause a packet to be rejected by the iprope_in_check() function.

Explanation
The FortiManager SD-WAN overlay orchestrator simplifies deployment by automatically generating the required provisioning templates for both hub and spoke devices after you complete the wizard . For a spoke device, these templates are specifically designed to establish the secure overlay network and dynamic routing.

Correct Options

B. BGP template is generated to configure the dynamic routing protocol for the spoke device, enabling it to exchange routing information with the hub and other devices in the SD-WAN overlay . This template uses the branch_id metadata variable to configure a unique Router ID for each branch .

C. CLI template is created to configure device-specific settings that are not covered by other templates, such as interface configurations and the BGP router ID . It also uses metadata variables to ensure unique values for each branch device .

D. IPsec tunnel template is generated to configure the secure IPsec tunnels that connect the spoke to the hub devices .This template establishes the necessary VPN connectivity for the SD-WAN overlay.

Incorrect Options

A. Rules template is not automatically created by the overlay orchestrator.The orchestrator focuses on building the overlay connectivity but does not provide SD-WAN intelligence, which is configured separately by creating SD-WAN rules .

E. Static route template is not among the templates automatically generated by the SD-WAN overlay orchestrator for spoke devices . Reference

FortiManager Administration Guide: SD-WAN overlay orchestration and generated templates .

Exam discussions confirming the correct templates for spoke devices .

Official Fortinet documentation: BGP and IPsec recommended templates