How would fec-ingress and fec-sgress IPsec configuration affect an IPsec tunnel?

Question

Options

• AWhen an FGSP member in FortiGate fails, FortiGate flushes the corresponding tunnels and
• BFortiGate will consider all IKEV2 packets as fragmentable.
• CIf fragmentation occurs, FortiGate will allow the packets at the IKE layer.
• DFortiGate will add additional redundant information to reconstruct any lost or erratically

• A
  3% (1)
• B
  7% (2)
• C
  3% (1)
• D
  86% (25)

Explanation

FEC (Forward Error Correction) is the key concept here. When fec-ingress and fec-egress are configured on a FortiGate IPsec tunnel, FortiGate adds redundant data packets to the traffic stream, enabling the receiver to reconstruct lost or out-of-order packets without retransmission - making D correct.

Why the distractors are wrong:

• A describes FGSP (FortiGate Session Protocol) behavior during member failover - a completely different HA feature, not FEC.
• B refers to IKEv2 packet fragmentation handling, which is controlled by a separate fragmentation setting, not FEC.
• C also conflates FEC with IKE-layer fragmentation allowance - FEC operates at the data plane, not the IKE negotiation layer.

Memory tip: Think of FEC as a "safety net" - the F in FEC stands for Forward, meaning redundant data is sent forward proactively rather than waiting for a retransmit request. If you see fec-ingress/fec-egress on FortiGate, think redundancy for reconstruction, not fragmentation or failover.

No community discussion yet for this question.