NSE7_NST-7-2 Practice Questions

IKE (Internet Key Exchange): IKE is a protocol used to set up a security association (SA) in the IPsec

protocol suite. It is utilized to negotiate, create, and manage SAs.

NAT-T (Network Address Translation-Traversal): NAT-T is used to enable IPsec VPN traffic to pass

through NAT devices. It encapsulates IPsec ESP packets into UDP packets.

Transport Protocol: Both IKE and IKE NAT-T use UDP as their transport protocol.

Port Numbers: By default, IKE uses UDP port 500. NAT-T typically uses UDP port 4500. However,

these port numbers can be configured as needed.

Reference:

Fortinet Network Security Support Engineer Study Guide for FortiOS 7.2​(Fortinet Docs)​​(ebin.pub)​.

Fortinet Documentation on IPsec VPN Configuration​(Fortinet Docs)​.

Remote Gateway IP:

The output shows 10.200.5.1 as the remote gateway IP, confirming that this is the IP address of the

remote gateway involved in the IPsec VPN tunnel.

Quick Mode Selectors:

The quick mode selectors specify the subnets involved in the VPN. The output shows src:

0:10.1.2.0/255.255.255.0:0 and dst: 0:10.1.1.0/255.255.255.0:0, indicating the subnets being

tunneled.

DPD (Dead Peer Detection):

DPD is shown as mode=on-demand on=1 idle=20000ms retry=3 count=0 seqno=0, indicating that

DPD is enabled in on-demand mode.

Anti-replay:

The output includes replaywin=2048 and replaywin_lastseq=00000000, which are indicators that

anti-replay protection is enabled for the IPsec tunnel.

Reference:

Fortinet Network Security 7.2 Support Engineer Documentation

VPN Configuration and Diagnostic Guides

Current Configuration Analysis:

The firewall policy currently allows ICMP traffic from port1 to port3, enabling the ICMP echo request

to reach the server.

However, for the server to send an ICMP echo reply back to the laptop, the traffic must be allowed

from port3 to port1.

Required Configuration:

To ensure the server at 10.4.0.1/24 can send the ICMP echo reply back to the laptop at 10.1.0.1/24,

the administrator needs to configure a new firewall policy.

The policy must explicitly allow ICMP traffic from port3 to port1.

Steps to Configure:

Access the FortiGate configuration interface.

Navigate to the Firewall Policy section.

Create a new policy allowing ICMP traffic from port3 to port1.

Save and apply the new policy to ensure bidirectional ICMP traffic is permitted.

Reference:

Fortinet Network Security 7.2 Support Engineer Documentation

FortiGate Firewall Policy Configuration Guides

Session Table Overview:

The session table in FortiOS tracks all active and pending sessions. It includes details like the type of

session (TCP, UDP, etc.), status, and statistics.

Interpreting the Exhibit:

The exhibit from the diagnose sys session stat command shows detailed session statistics.

The specific value indicating "166 TCP sessions waiting to complete the three-way handshake"

reflects the number of sessions that have initiated but not yet completed the TCP three-way

handshake process (SYN, SYN-ACK, ACK).

Reference:

Fortinet Documentation: Understanding and troubleshooting session tables​(Hammertux)​.

Fortinet Community: Explanation of session states and statistics​(Welcome to the Fortinet

Community!)​​(Hammertux)​.

The session table entry provided shows detailed information about a specific network session

passing through the FortiGate device. From the session details, we can see that the session has

various attributes such as state, protocol, policy, and inspection details.

The session state (proto_state=11) indicates that the session is being actively processed and

inspected.

The npd_state=00000000 suggests that the session is being handled by the CPU rather than

offloaded to a Network Processor (NP).

The session is marked for security profile inspection, evident from the detailed byte/packet counts

and other session parameters.

From these indicators, it's clear that FortiGate is using its CPU to perform security profile inspection

on this session rather than simply forwarding the traffic without inspection or relying solely on IPS

inspection.

Reference:

Fortinet Documentation on Session Table

Fortinet Community Discussion on Session Table

LDAP Authentication Process:

LDAP (Lightweight Directory Access Protocol) authentication involves several steps: Bind Request,

Search Request, and Bind Response.

The Bind Request is used to authenticate the client to the LDAP server.

The Search Request is used to find the directory entry that matches the provided criteria.

Analyzing the Exhibit:

The exhibit shows a real-time LDAP debug output.

The debug log includes a successful resolution of the LDAP FQDN, indicating that the LDAP server

was reached.

The debug log also shows the start of a search using the distinguished name (DN) base and a filter to

locate the user jsmith.

Conclusion:

Since FortiOS successfully resolved the LDAP server and initiated a search for the user jsmith, it

indicates that the LDAP server was located, and the search request was performed.

Reference:

Fortinet Community: Understanding LDAP authentication steps and troubleshooting​(Fortinet Docs)​.

Fortinet Documentation: LDAP integration and debugging in FortiOS​(Welcome to the Fortinet

Community!)​.

Session Creation: The output shows an expected session, likely due to a pinhole, which is a

dynamically created rule to allow specific traffic through the firewall.

Routing Decision:

The original direction of traffic comes from the IP address 10.171.121.38.

The next-hop IP address for this traffic is 10.0.1.10 as indicated by the routing decision in the output.

Pinhole Session: Pinhole sessions are typically created for protocols that require additional sessions

(e.g., FTP, SIP) to function properly. This ensures the necessary traffic can pass through the firewall.

Debugging Commands: The diagnose sys session list command is used to list session information,

which helps in understanding traffic flow and troubleshooting connectivity issues.

Reference:

Fortinet Network Security Support Engineer Study Guide for FortiOS 7.2​(ebin.pub)​.

General IPsec VPN configuration from Fortinet documentation​(Fortinet Docs)​.

Conserve Mode Overview: Conserve mode is a state that FortiGate enters to protect itself from

running out of memory. It is triggered when the memory usage reaches certain thresholds.

Thresholds: The default settings for conserve mode thresholds are:

Red Threshold: 88% memory usage.

Extreme Threshold: 95% memory usage.

Green Threshold: 82% memory usage.

Impact on Sessions: When in conserve mode:

New sessions requiring flow-based content inspection are blocked.

New sessions requiring proxy-based content inspection are also blocked to free up memory

resources.

Current Memory State in Exhibit: The exhibit shows:

Total RAM: 3040 MB.

Memory used: 2706 MB (89% of total RAM).

Memory usage exceeds the red threshold (88%), thus triggering conserve mode.

Given that the memory usage is above the red threshold and conserve mode is active, the FortiGate

will block new sessions requiring both flow-based and proxy-based content inspection to conserve

memory.

Reference:

Fortinet Community: Explanation of Conserve Mode and Its Impact​(Welcome to the Fortinet

Community!)​​(Welcome to the Fortinet Community!)​.

Fortinet Documentation: Conserve Mode Settings and Management​(Fortinet Docs)​.

OSPF Interface Network Types:

The network types of the interfaces on both FortiGate devices must match. Common network types

include broadcast, point-to-point, and non-broadcast multi-access (NBMA).

Authentication Settings:

Both devices must have matching authentication settings (if authentication is used). This includes the

same authentication type (none, simple password, or MD5) and the same password or key.

OSPF Router IDs:

Each OSPF router must have a unique router ID within the OSPF domain. The router ID is typically an

IPv4 address selected from one of the router's interfaces or manually configured.

Link Costs and Interface Priority:

While link costs and interface priorities are important for route selection and designated router (DR)

elections, they do not prevent OSPF adjacency formation if they differ.

Reference:

Fortinet Network Security 7.2 Support Engineer Documentation

OSPF Configuration Guides

The exhibit shows a sniffer capture where TCP port 8013 is being used for communication. The

communication appears one-way, indicating potential issues with the upstream FortiGate receiving

the necessary packets or being able to respond.

To ensure successful communication in a Security Fabric setup:

Ensure TCP port 8013 is not blocked along the way: Verify that no firewalls or network devices

between the downstream and upstream FortiGates are blocking TCP port 8013. This port is crucial for

Security Fabric communication.

Authorize the downstream FortiGate on the root FortiGate: In the Security Fabric, the root FortiGate

must recognize and authorize the downstream FortiGate to allow proper communication and

management.

Enable Security Fabric/Fortitelemetry on the receiving interface of the upstream FortiGate: The

upstream FortiGate must have the Security Fabric or Fortitelemetry enabled on the interface that

receives the communication from the downstream FortiGate. This enables proper data exchange and

monitoring within the Security Fabric.

Reference:

Fortinet Documentation on Security Fabric Configuration

Fortinet Community Discussion on Port Requirements