An administrator wants to capture encrypted phase 2 traffic between two FotiGate devices using the built-in sniffer.If the administrator knows that there Is no NAT device located between both FortiGate devices, which command should the administrator run?
Answer(s): B
To captureencrypted IPsec phase 2 (ESP) trafficbetween two FortiGate devices, the correct protocol filter to use isip proto 50. According to the Fortinet official sniffing and debugging documentation, ESP (Encapsulating Security Payload) is used for encrypted phase 2 payload transfer and always uses IP protocol number 50. Running the commanddiagnose sniffer packet any 'ip proto 50'captures only ESP packets, which represent the encrypted traffic---whether originating or transiting the device.If there is no NAT device between FortiGates, ESP is not encapsulated in UDP (thus not on UDP port 4500; if NAT-T were required, packets would be UDP-encapsulated, but the scenario explicitly says NAT is not in use). UDP port 500 is for IKE control (negotiation) traffic, and AH (Authentication Header, ip proto 51) is not used for encryption in standard IPsec phase 2 with ESP.This matches the official CLI reference from Fortinet for VPN and traffic analysis.**FortiOS CLI Reference: diagnose sniffer packet, ESP, IP Protocol NumbersFortiGate VPN Administration Guide: Traffic Capture and Analysis of IPsec Traffic
Refer to the exhibits.An administrator Is expecting to receive advertised route 8.8.8.8/32 from FGT-A. On FGT-B, they confirm that the route is being advertised and received, however, the route is not being injected into the routing table. What is the most likely cause of this issue?
The 8.8.8.8/32 route is visible in the OSPF database on FGT-B but not installed into the routing table---the most likely explanation is that FGT-B is filtering it from being installed.
Refer to the exhibit, which shows the output of a BGP debug command.What can you conclude about the router in this scenario?
Answer(s): D
The BGP debug output shows session information for peers, including state details. According to official Fortinet BGP documentation, if the session state with a peer does not show 'Idle,' 'Active,' or 'Connect,' but instead shows 'Established,' 'Up,' or related counters (e.g., messages sent/received or uptime), it indicates the session is operational. In this scenario, the peer 10.127.0.75 is the only one showing a positive indication of a live, established session. Other options like neighbor-range configuration, AS mismatch, or route-maps blocking prefixes are not supported by evidence provided in a simple BGP session state debug, nor does the output show errors relating to local or remote AS issues.The correct interpretation comes from Fortinet's BGP troubleshooting guide, which outlines how to read session status and neighbor states in debug and summary outputs.FortiOS BGP Debugging Guide: Session State InterpretationBGP CLI Reference:Neighbor Status Fields
MULTIPLE CHOICEWhich two statements about an auxiliary session ate true? (Choose two.)
Answer(s): B,C
Auxiliary sessions in Fortinet are designed to support ECMP (Equal Cost Multi-Path) and SD-WAN scenarios, allowing sessions to be handled efficiently when traffic needs to be dynamically distributed across multiple links. With the auxiliary session setting enabled, FortiGate creates additional session table entries for each possible path in ECMP or SD-WAN---meaning that if the routing path changes (such as a link failover), a new session can be immediately activated and offloaded to the NP6 network processor for acceleration, ensuring minimal disruption. This greatly benefits high-throughput deployments.Official documentation specifies that when auxiliary sessions are enabled, FortiGate doesn't just rely on dynamically creating new sessions after a routing event, it proactively creates sessions for all potential paths. This means that in the event of a route change, two sessions exist and the traffic is quickly re-routed and offloaded, maximizing performance and reliability. Without this feature, multiple paths cannot be efficiently offloaded, and routing changes trigger a single session update, reducing failover performance.FortiOS Handbook: Session Table, ECMP, SD-WAN, and Auxiliary SessionsFortiGate NP6 Acceleration Guide: Auxiliary Session Behavior
Exhibit.Refer to the exhibit, which contains a screenshot of some phase 1 settings.The VPN is not up. To diagnose the issue, the administrator enters the following CLI commands on an SSH session on FortiGate:However, the IKE real-time debug does not show any output. Why?
Answer(s): A
To display debug output on FortiGate devices, you must always run both the application-specific debug command and the global debug enable command. The commanddiagnose debug application ike -1sets up the detail level for the IKE daemon debug, but it doesnot display any debug output on its own. As described in the FortiOS CLI debugging manuals, the commanddiagnose debug enableactivates debug output on the console, making all previously set debugs visible. This is especially important for VPN troubleshooting---without the enable command, no output appears even if there is VPN traffic.The correct diagnostic sequence is:diagnose debug application ike -1diagnose debug enableThis procedure is found in every FortiOS CLI debug tutorial and troubleshooting workflow.FortiOS CLI Reference:Debugging VPNs and Real-time Debug OutputFortiGate VPN Troubleshooting Guide: Required Steps for Debug Output
Post your Comments and Discuss Fortinet NSE7_FSN_AR-7.6 exam prep with other Community members: