A FortiGate device with UTM profiles is reaching the resource limits, and the administrator expects the traffic in the enterprise network to increase.The administrator has received an additional FortiGate of the same model.Which two protocols should the administrator use to integrate the additional FortiGate device into this enterprise network? (Choose two.)
Answer(s): A,B
When adding an additional FortiGate to an enterprise network that is already reaching its resource limits, the goal is to distribute traffic efficiently and ensure high availability.FGSP (FortiGate Session Life Support Protocol) with external load balancersFGSP allows session-aware load balancing between multiple FortiGate units without requiring them to be in an HA (High Availability) cluster.With external load balancers, incoming traffic is evenly distributed across multiple FortiGate devices.This approach is useful for scaling out traffic handling capacity while ensuring that sessions remain synchronized between firewalls.FGSP is effective when stateful failover is required but without the constraints of traditional HA.FGCP (FortiGate Clustering Protocol) in active-active mode and with switchesFGCP active-active mode enables multiple FortiGate devices to share traffic loads, increasing throughput and efficiency.Active-active mode is suitable for balancing UTM processing across multiple FortiGates, making it ideal when resource limits are a concern.Using switches ensures redundancy and avoids single points of failure in the network.This mode is commonly used in enterprise networks where both scalability and redundancy are required.
Refer to the exhibit.The routing tables of FortiGate_A and FortiGate_B are shown. FortiGate_A and FortiGate_B are in the same autonomous system.The administrator wants to dynamically add only route 172.16.1.248/30 on FortiGate_A.What must the administrator configure?
Answer(s): B
FortiGate_A and FortiGate_B are in the same autonomous system (AS), and FortiGate_A does not currently have route 172.16.1.248/30 in its routing table. However, FortiGate_B has this route as a connected route.To dynamically advertise only 172.16.1.248/30 from FortiGate_B to FortiGate_A, the administrator must configure a BGP route map out on FortiGate_B that specifically permits only this prefix.A BGP route map out on FortiGate_B controls which routes FortiGate_B advertises to FortiGate_A. If no filtering is applied, FortiGate_B might advertise all BGP-learned and connected routes, which is not what the administrator wants. The route map should include a prefix-list that explicitly allows only 172.16.1.248/30 and denies everything else.
Refer to the exhibit, which shows a network diagram showing the addition of site 2 with an overlapping network segment to the existing VPN IPsec connection between the hub and site 1.Which IPsec phase 2 configuration must an administrator make on the FortiGate hub to enable equal-cost multi-path (ECMP) routing when multiple remote sites connect with overlapping subnets?
Answer(s): A
When multiple remote sites connect to the same hub using overlapping subnets, FortiGate needs to determine which route should be used for traffic forwarding. The route-overlap setting in IPsec Phase 2 allows FortiGate to handle this scenario by deciding whether to keep the existing route (use-old) or replace it with a new route (use-new).In an ECMP (Equal-Cost Multi-Path) routing setup, both routes should be retained and balanced, but FortiGate does not support ECMP directly over overlapping routes in IPsec Phase 2. Instead, an administrator must decide which connection takes precedence using route-overlap settings.
An administrator wants to scale the IBGP sessions and optimize the routing table in an IBGP network.Which parameter should the administrator configure?
Answer(s): D
In an IBGP (Internal BGP) network, all routers must be fully meshed, meaning every router must establish a BGP session with every other router in the same autonomous system (AS). This does not scale well in large networks due to the exponential increase in BGP sessions.To optimize and scale IBGP, Route Reflectors (RRs) are used. A Route Reflector (RR) reduces the number of IBGP peer connections by allowing a centralized router (RR) to redistribute IBGP routes to other IBGP peers (called clients). This eliminates the need for a full mesh, significantly reducing BGP session overhead.By configuring the route-reflector-client setting on IBGP peers, an administrator can:●Scale IBGP sessions by reducing the number of direct BGP peer connections.●Optimize the routing table by ensuring routes are efficiently propagated within the IBGP network.●Eliminate the need for full mesh topology, making IBGP more manageable.
Refer to the exhibits.The configuration of a user's Windows PC, which has a default MTU of 1500 bytes, along with FortiGate interfaces set to an MTU of 1000 bytes, and the results of PC1 pinging server 172.16.0.254 are shown.Why is the user in Windows PC1 unable to ping server 172.16.0.254 and is seeing the message: Packet needs to be fragmented but DF set?
Answer(s): C
The issue occurs because FortiGate enforces the "do not fragment" (DF) bit in the packet, and the packet size exceeds the MTU of the network path. When the Windows PC1 (with an MTU of 1500 bytes) attempts to send a 1400-byte packet, the FortiGate interface (with an MTU of 1000 bytes) needs to fragment it. However, since the DF bit is set, FortiGate drops the packet instead of fragmenting it.To resolve this, the user should adjust the ping packet size to fit within the path MTU. In this case, reducing the packet size to 972 bytes (1000 bytes MTU minus 28 bytes for the IP and ICMP headers) should allow successful transmission.
Post your Comments and Discuss Fortinet FCSS_EFW_AD-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCSS_EFW_AD-7.6 content, but please register or login to continue.