Which two statements about Security Fabric communications are true? (Choose two.)
Answer(s): C,D
FortiTelemetry is a critical part of Security Fabric communications and requires explicit configuration for each participating FortiGate interface. The administrative access setting "fabric" (corresponding to FortiTelemetry) must be manually enabled per interface on both upstream and downstream devices. This is performed in the GUI under Administrative Access or via the CLI using the command set allowaccess fabric for the relevant network interface. Without this step, FortiTelemetry communications will not occur on that interface.Additionally, the default communication between downstream and upstream FortiGate units in the Security Fabric is over TCP port 8013. This port is well-documented as the standard for Security Fabric and FortiTelemetry connections, and must be open and permitted across the network path for connectivity and status enforcement between units. The downstream FortiGate initiates the connection to the upstream via this port unless otherwise configured. This has also been documented as a PCI-relevant port, showing its default usage.Other options:Neighbor Discovery in FortiOS uses IPv6 ND protocol, not TCP.FortiTelemetry port (8013) can be modified, but the interface Administrative Access for the Security Fabric must be manually enabled; Neighbor Discovery port modification is not documented as a supported change for FortiGate.
FortiGate/FortiOS Administration Guide: Enabling FortiTelemetry (fabric) on interfacesFortinet Technical Tip: FortiTelemetry uses TCP port 8013 by defaultPCI compliance documentation on port 8013 usage for Security FabricFortinet Security Fabric setup procedures and interface options
Refer to the exhibit, which contains the output of diagnose vpn tunnel list.Which command will capture ESP traffic for the VPN named DialUp_0?
Answer(s): D
Exhibit.Refer to the exhibit, which shows the output of diagnose automation test.What can you observe from the output? (Choose two.)
Answer(s): A,D
Refer to the exhibit, which shows partial outputs from two routing debug commands.Which change must an administrator make on FortiGate to route web traffic from internal users to the internet, using ECMP?
What are two reasons you might see iprope_in_check() check failed, drop when using the debug flow? (Choose two.)
Post your Comments and Discuss Fortinet FCSS_NST_SE-7.6 exam prep with other Community members:
Our website is free, but we have to fight against AI bots and content theft. We're sorry for the inconvenience caused by these security measures. You can access the rest of the FCSS_NST_SE-7.6 content, but please register or login to continue.