NSE4 · Question #164
You are the administrator in charge of a FortiGate unit which acts as a VPN gateway. You have chosen to use Interface Mode when configuring the VPN tunnel and you want users from either side to be…
The correct answer is B. Create two firewall policies. C. Add a route for the remote subnet. E. Create a phase 1 definition. F. Create a phase 2 definition. To configure an Interface Mode IPSec VPN for bidirectional sessions with a single subnet at each end, you must create Phase 1 and Phase 2 definitions, add a static route for the remote subnet, and establish two firewall policies.
Question
You are the administrator in charge of a FortiGate unit which acts as a VPN gateway. You have chosen to use Interface Mode when configuring the VPN tunnel and you want users from either side to be able to initiate new sessions. There is only 1 subnet at either end and the FortiGate unit already has a default route. Which of the following configuration steps are required to achieve these objectives? (Select all that apply.)
Options
- ACreate one firewall policy.
- BCreate two firewall policies.
- CAdd a route for the remote subnet.
- DAdd a route for incoming traffic.
- ECreate a phase 1 definition.
- FCreate a phase 2 definition.
How the community answered
(38 responses)- A21% (8)
- B71% (27)
- D8% (3)
Why each option
To configure an Interface Mode IPSec VPN for bidirectional sessions with a single subnet at each end, you must create Phase 1 and Phase 2 definitions, add a static route for the remote subnet, and establish two firewall policies.
A single firewall policy would only allow traffic in one direction, not bidirectional as required for users from either side to initiate new sessions.
For bidirectional traffic (users from either side initiating sessions) over an Interface Mode IPSec VPN, two firewall policies are required: one from the local network (VPN interface) to the remote network (VPN interface), and another in the reverse direction.
To direct traffic destined for the remote subnet through the newly created VPN tunnel interface, a static route is essential, pointing the remote subnet to the VPN tunnel interface.
Adding a route for incoming traffic is not a standard or necessary configuration step for an IPSec tunnel; traffic already entering the FortiGate through the VPN interface will be handled by policies if the remote subnet route is correctly configured.
Phase 1 defines the security association parameters for establishing the initial secure control channel (IKE SA), including authentication, encryption, and key exchange methods.
Phase 2 defines the parameters for the actual data tunnel (IPsec SA), specifying encryption algorithms, authentication algorithms, and perfect forward secrecy for the user data traffic.
Concept tested: FortiGate Interface Mode IPSec VPN configuration
Source: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/339274/ipsec-vpn-introduction
Topics
Community Discussion
No community discussion yet for this question.