NSE4 · Question #23
Examine the exhibit below; then answer the question following it. In this scenario, the FortiGate unit in Ottawa has the following routing table: S* 0.0.0.0/0 [10/0] via 172.20.170.254, port2 C…
The correct answer is B. The reverse path forwarding check. The packets are dropped due to a Reverse Path Forwarding (RPF) check failure because the FortiGate does not have a route back to the source IP's network via the ingress interface.
Question
Examine the exhibit below; then answer the question following it. In this scenario, the FortiGate unit in Ottawa has the following routing table:
S* 0.0.0.0/0 [10/0] via 172.20.170.254, port2 C 172.20.167.0/24 is directly connected, port1 C 172.20.170.0/24 is directly connected, port2 Sniffer tests show that packets sent from the source IP address 172.20.168.2 to the destination IP address 172.20.169.2 are being dropped by the FortiGate located in Ottawa. Which of the following correctly describes the cause for the dropped packets?
Exhibit
Options
- AThe forward policy check.
- BThe reverse path forwarding check.
- CThe subnet 172.20.169.0/24 is NOT in the Ottawa FortiGate's routing table.
- DThe destination workstation 172.20.169.2 does NOT have the subnet 172.20.168.0/24 in its
How the community answered
(50 responses)- A12% (6)
- B80% (40)
- C2% (1)
- D6% (3)
Why each option
The packets are dropped due to a Reverse Path Forwarding (RPF) check failure because the FortiGate does not have a route back to the source IP's network via the ingress interface.
While a forward policy check is performed, packet drops occurring before policy evaluation often indicate a routing or fundamental network reachability issue, such as an RPF failure.
The FortiGate performs an RPF check to mitigate IP spoofing; for a packet sourced from 172.20.168.2, if the FortiGate cannot find a route back to 172.20.168.0/24 through the incoming interface, the RPF check fails and the packet is dropped.
The FortiGate does have a route to the destination 172.20.169.2; it would use the default route `S* 0.0.0.0/0` via 172.20.170.254 on port2 for forwarding.
The routing table on the destination workstation 172.20.169.2 is irrelevant to why the FortiGate is dropping the *incoming* packets from 172.20.168.2.
Concept tested: FortiGate Reverse Path Forwarding (RPF)
Source: https://docs.fortinet.com/document/fortigate/7.4.0/admin-guides/508492/how-traffic-is-processed-by-fortigate
Topics
Community Discussion
No community discussion yet for this question.